hxxps://github[.]com/pankoza-pl/malwaredatabase

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-es
resource tags

arch:x64arch:x86image:win10v2004-20220812-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
05/01/2023, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza-pl/malwaredatabase

Score

8^/10

evasion spyware stealer upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
4008	Antivirus 2021.exe
3116	1.exe
2204	inv.exe
972	glitch.exe
4008	lines.exe
4300	melter.exe
1848	chrome.exe
4068	chrome.exe
348	chrome.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022f39-138.dat	upx
behavioral2/files/0x0007000000022f39-140.dat	upx
behavioral2/memory/3116-145-0x0000000000400000-0x000000000050F000-memory.dmp	upx

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	Antivirus 2021.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	1.exe

Loads dropped DLL 6 IoCs

pid	Process
1848	chrome.exe
1848	chrome.exe
4068	chrome.exe
4068	chrome.exe
348	chrome.exe
348	chrome.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~1\WindowsApps\MI05FA~1.0_X\Assets\Config\EXPORT~1.JSO	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\Assets\Audio\SKBD1F~1.M4A	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\EmptySearch-Dark.scale-400.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\APE0B7~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\LargeTile.scale-400.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~1\AppList.targetsize-36_altform-unplated_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID5E5~1.0_X\Assets\CONTRA~2\SplashScreen.scale-400_contrast-white.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\Assets\Audio\SKBFA7~1.M4A	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HX6334~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\FlagToastQuickAction.scale-80.png	cmd.exe
File opened for modification	C:\PROGRA~2\REFERE~1\MICROS~1\FRAMEW~1\v3.0\PresentationCore.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIE788~1.SCA\Assets\SECOND~1\Car\LTR\CONTRA~1\LARGET~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\LiveTile\W5.png	cmd.exe
File opened for modification	C:\PROGRA~2\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\ShouldBeLessThan.snippets.ps1xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\models\EN-USP~1.OT	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\fr\System.Net.Resources.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIE788~1.SCA\Assets\SECOND~1\TRAFFI~1\CONTRA~2\WIDETI~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MIBBCB~1.SCA\Assets\AppTiles\CONTRA~2\STORES~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CalculatorAppList.contrast-white_targetsize-96.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\Assets\CAC284~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI32BC~1.0_X\GEOMET~1.CSO	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\oskclearui\oskclearuibase.xml	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\iediagcmd.exe	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAFF4~1.0_X\Win10\MI9B46~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\CONTRA~1\ON5046~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MI443F~1.SCA\Assets\WINDOW~1\WindowsCameraSmallTile.contrast-black_scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAFF4~1.0_X\MICROS~1.ADV\BOOTST~1.HTM	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\HxA-Advanced-Dark.scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\HX7960~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAA44~1.0_X\Assets\AppTiles\CONTRA~1\STOREB~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIBE99~1.0_X\Assets\GA3402~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\AppIcon.targetsize-256_altform-lightunplated.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI8AAC~1.0_X\SYCFDD~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI67C7~1.0_X\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\STICKE~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\RNWEBV~1.WIN	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4DB5~1.0_X\Assets\SECOND~1\Work\CONTRA~2\MEDTIL~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.5\System.Data.Entity.Design.dll	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\STOREL~2.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\images\OneNotePageSmallTile.scale-125.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI10D6~1.0_X\Assets\CONTRA~1\AppList.targetsize-96_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI4E99~1.0_X\Assets\WINDOW~1\WI7525~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI533E~1.0_N\APPXME~1\APPXBU~1.XML	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\ATTRIB~1\foreca.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI6F49~1.0_X\Assets\Images\Stickers\THUMBN~1\ST9D58~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MID54F~1.0_X\Assets\PH00F5~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI2B2D~1.0_X\Assets\VALUEP~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~3.0_X\Assets\AppTiles\CONTRA~2\WE7DA5~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MICROS~4.0_X\Assets\CONTRA~2\AP7537~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI33D2~1.0_X\REACTA~1\assets\RNApp\app\uwp\images\ONBOAR~1\CONTAC~2.GIF	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB28C~1.0_X\Assets\CONTRA~1\AppList.targetsize-30_contrast-black.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HX3F35~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~2\HX8BD7~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\fsdefinitions\keypad\ea.xml	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~3.SCA\Assets\PhotosWideTile.contrast-black_scale-100.png	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A7F~1.0_X\Assets\EQ_THU~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\EMPTYV~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIAA44~1.0_X\Assets\AppTiles\CONTRA~1\STORES~1.PNG	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI5AAA~1.0_X\MFC411~1.DLL	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI83BA~1.0_X\Views\UTILIT~1\Styling\css\Content.css	cmd.exe
File opened for modification	C:\PROGRA~1\COMMON~1\MICROS~1\ink\it-IT\InkObj.dll.mui	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI0A11~1.0_X\ANIMAT~1\ONENOT~1.MP4	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MIB44A~1.0_X\WINMET~1\Microsoft.UI.Xaml.winmd	cmd.exe
File opened for modification	C:\PROGRA~1\WindowsApps\MI11B4~1.0_X\images\CONTRA~1\EX25F9~1.PNG	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5020	timeout.exe
1468	timeout.exe
1620	timeout.exe
3680	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	Antivirus 2021.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1064	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3776	chrome.exe
3776	chrome.exe
4624	chrome.exe
4624	chrome.exe
3740	chrome.exe
3740	chrome.exe
3068	chrome.exe
3068	chrome.exe
1440	chrome.exe
1440	chrome.exe
672	chrome.exe
672	chrome.exe
2752	chrome.exe
2752	chrome.exe
4880	chrome.exe
4880	chrome.exe
4088	chrome.exe
4088	chrome.exe
348	chrome.exe
348	chrome.exe
348	chrome.exe
348	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe
4624	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4692	4624	chrome.exe	80
PID 4624 wrote to memory of 4692	4624	chrome.exe	80
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 2816	4624	chrome.exe	83
PID 4624 wrote to memory of 3776	4624	chrome.exe	84
PID 4624 wrote to memory of 3776	4624	chrome.exe	84
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85
PID 4624 wrote to memory of 4288	4624	chrome.exe	85

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://github.com/pankoza-pl/malwaredatabase
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ff8c57a4f50,0x7ff8c57a4f60,0x7ff8c57a4f70
  2⤵
  PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2304 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:880
- C:\Users\Admin\Downloads\Antivirus 2021.exe
  "C:\Users\Admin\Downloads\Antivirus 2021.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Modifies registry class
  PID:4008
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Antivirus.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Checks computer location settings
    PID:4900
  - - C:\1.exe
      "C:\1.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:3116
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8211.tmp\1.bat" "
        5⤵
        Drops file in Program Files directory
        
        PID:100
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:1064
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\8211.tmp\inv.exe
        
        inv.exe
        6⤵
        Executes dropped EXE
        
        PID:2204
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\8211.tmp\glitch.exe
        
        glitch.exe
        6⤵
        Executes dropped EXE
        
        PID:972
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\8211.tmp\lines.exe
        
        lines.exe
        6⤵
        Executes dropped EXE
        
        PID:4008
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5 /nobreak
        6⤵
        Delays execution with timeout.exe
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\8211.tmp\melter.exe
        
        melter.exe
        6⤵
        Executes dropped EXE
        
        PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,11970904593017401403,9330811532576421364,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3508 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4452

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
1⤵
PID:4056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3560

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.exe

Filesize
342KB

MD5
1698c972976295cd6072fb70a73c0cdc

SHA1
1c7e38ca6f7eeced6904d4b823f62b1569cf7f7c

SHA256
0ac6268c3d4ecddd9efdc853f4a2096dfa197f1e729960f55507b1f6276807dc

SHA512
4d4f2268e49ee1a5a014084227367062832c56c5e538159d3977cd46a2fff031dc72bb6c9dadb420095af90fd25a421aef1a35ae5d200bc434c87e34d9cce11f

Download Submit
C:\1.exe

Filesize
342KB

MD5
1698c972976295cd6072fb70a73c0cdc

SHA1
1c7e38ca6f7eeced6904d4b823f62b1569cf7f7c

SHA256
0ac6268c3d4ecddd9efdc853f4a2096dfa197f1e729960f55507b1f6276807dc

SHA512
4d4f2268e49ee1a5a014084227367062832c56c5e538159d3977cd46a2fff031dc72bb6c9dadb420095af90fd25a421aef1a35ae5d200bc434c87e34d9cce11f

Download Submit
C:\Antivirus.hta

Filesize
662B

MD5
8630fa16691e438e5272f37096806782

SHA1
4d49582d446120da6d7856eba3f486c61692a98f

SHA256
0189de779a96cd4a5b0ce942264ef9d4fc05b7b62e1dde01bac9731d3ada6f96

SHA512
4748c5188e0f59beec03825eede6c143502388dfa60d8d0fca677287e209daf4da5f2d49709f8fb6609576854e47f36483bee54ff2019d6beed568179d602092

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Filesize
152.4MB

MD5
4647f04fadf6315ddbb67d88f9931e99

SHA1
5cd73d30d5c6164054c5115b3a6eb51ccd28a220

SHA256
25a25cf16e0050613450e6af2cfce712327cf10e400f210ca89cf3b236d3b79f

SHA512
14d7e042f38bb93abc3835b392df8bab9d65f8422e1fbcf0971871b406c3ca6b0f8dd71824825c451b21086c8ea425f77b89ac6f9edb64dcc2fa1246375fa824

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Filesize
152.4MB

MD5
4647f04fadf6315ddbb67d88f9931e99

SHA1
5cd73d30d5c6164054c5115b3a6eb51ccd28a220

SHA256
25a25cf16e0050613450e6af2cfce712327cf10e400f210ca89cf3b236d3b79f

SHA512
14d7e042f38bb93abc3835b392df8bab9d65f8422e1fbcf0971871b406c3ca6b0f8dd71824825c451b21086c8ea425f77b89ac6f9edb64dcc2fa1246375fa824

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Filesize
152.4MB

MD5
4647f04fadf6315ddbb67d88f9931e99

SHA1
5cd73d30d5c6164054c5115b3a6eb51ccd28a220

SHA256
25a25cf16e0050613450e6af2cfce712327cf10e400f210ca89cf3b236d3b79f

SHA512
14d7e042f38bb93abc3835b392df8bab9d65f8422e1fbcf0971871b406c3ca6b0f8dd71824825c451b21086c8ea425f77b89ac6f9edb64dcc2fa1246375fa824

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_elf.dll

Filesize
1.0MB

MD5
3ef5e8c9dc943b9516a3473891ea7005

SHA1
b82e4ebf94568600ad41d65519ceed5e4d12d704

SHA256
aac3e725277eb46e0f4a4415b2c5e16db29669e437d75d9fd55bf51705e3dfff

SHA512
9f1a58f23ee1491e87a35c8639e4128b0a006a254b75d0d123f875620c7009917020c6b9b6ac781e1aa5f328b6dd4cb4cafbcc533a76ef15acae6c394b7eded5

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_elf.dll

Filesize
1.0MB

MD5
3ef5e8c9dc943b9516a3473891ea7005

SHA1
b82e4ebf94568600ad41d65519ceed5e4d12d704

SHA256
aac3e725277eb46e0f4a4415b2c5e16db29669e437d75d9fd55bf51705e3dfff

SHA512
9f1a58f23ee1491e87a35c8639e4128b0a006a254b75d0d123f875620c7009917020c6b9b6ac781e1aa5f328b6dd4cb4cafbcc533a76ef15acae6c394b7eded5

Download Submit
C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_elf.dll

Filesize
1.0MB

MD5
3ef5e8c9dc943b9516a3473891ea7005

SHA1
b82e4ebf94568600ad41d65519ceed5e4d12d704

SHA256
aac3e725277eb46e0f4a4415b2c5e16db29669e437d75d9fd55bf51705e3dfff

SHA512
9f1a58f23ee1491e87a35c8639e4128b0a006a254b75d0d123f875620c7009917020c6b9b6ac781e1aa5f328b6dd4cb4cafbcc533a76ef15acae6c394b7eded5

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.2MB

MD5
b555ce6924de8b22121d29a6a153d3fa

SHA1
49e5a197e7e4e5bded33820a55ab664c370c9794

SHA256
0c6a37537be50d03c4c7d7fb1d64e881a2c363185712a1c0e1e2c86f2faf3f19

SHA512
1109aa9a26c2baec61fba873e4e27bbc4871e88366301dc32b7fd7383ea83da6d32ab8173db66c211b1ef3e334e1427370da19d77da8b804a71118bdbe35a1e0

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.2MB

MD5
b555ce6924de8b22121d29a6a153d3fa

SHA1
49e5a197e7e4e5bded33820a55ab664c370c9794

SHA256
0c6a37537be50d03c4c7d7fb1d64e881a2c363185712a1c0e1e2c86f2faf3f19

SHA512
1109aa9a26c2baec61fba873e4e27bbc4871e88366301dc32b7fd7383ea83da6d32ab8173db66c211b1ef3e334e1427370da19d77da8b804a71118bdbe35a1e0

Download Submit
C:\Program Files\Google\Chrome\Application\chrome.exe

Filesize
2.2MB

MD5
b555ce6924de8b22121d29a6a153d3fa

SHA1
49e5a197e7e4e5bded33820a55ab664c370c9794

SHA256
0c6a37537be50d03c4c7d7fb1d64e881a2c363185712a1c0e1e2c86f2faf3f19

SHA512
1109aa9a26c2baec61fba873e4e27bbc4871e88366301dc32b7fd7383ea83da6d32ab8173db66c211b1ef3e334e1427370da19d77da8b804a71118bdbe35a1e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AD

Filesize
306B

MD5
703886e95a528d6c03ef2e9da05d31fc

SHA1
eddf80f8cb69850dd6db6de127fdbfe4c3862480

SHA256
c04fda38de18271d976b46189fd1ec22ca79cbbfe747e7a49fc1f57a948372b7

SHA512
e7581797e8969048d6408ef1ff8779e51139e6ceb9f58b2f66a1c8afb502f86d858fd56f189c7be0ab53df3b18130195775654c7857b35e801a775dbe0616722

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AE

Filesize
355B

MD5
8ec6db307ae064bd001287b5fd4ec4c2

SHA1
ecb26aafd383b7b752659ec2e160c148f1d4b035

SHA256
598c16d505277fad4511354207efc045ed8b2308687fd5149d73dc6e40471d9b

SHA512
5815ef9c5ca75356a1fb9cc0bb598dd850a3f46b0e26b936dfa8e36e86bc94d20efb6749a0f681bd85a6e1d28df1afe4b8cde6c145795c1f1d9110358f96ec35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AF

Filesize
2KB

MD5
d894a238bc3726ab19b8f20e132f4476

SHA1
13680836a413a411b2ff11ccc0932bad96eb3903

SHA256
78a596cf65cab9d4a23c516a728c5dabeaa07966bbf58ca43d88e552ca990337

SHA512
f39214300cb9bad386a9872c1384694645f6b677389936f2b5459801e04046a1f8bda77cea98a90ea6059632cc4269947e55543a2eac3171a9da3fb62f78dbea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AG

Filesize
234B

MD5
7c5d2c7ca9e2ca9c495558036a51d5ef

SHA1
08449e8873f3e1ae654e5e2c1b4f1a6ec0476949

SHA256
1d17963a0bceb45dc17ee324b800dbaf9219789444e816c7c810f5884abed150

SHA512
a292250914d43c03755479976f208d20b0a8e90205540ead681ec1ff85a87170d2202d6ac1e19166a3bcc16b65de24e1ee92a0a089e1d0a3cd8bfdde0be45b44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AL

Filesize
590B

MD5
f27644c5ba5cc0a2e163ea14d5f680c8

SHA1
3bcd1d5f4cd818f4770ede91a64cf66525289fc3

SHA256
7e240c202f48467658dff2f67d6e32a9cda456c4f094b23de158cebd08680536

SHA512
d3c27c4cf634143aaedfed3a94fc41687a1abf92cafe8b15ed73745b231476ecd91425f00d32d553a99e3b32a7a35c97dd0e846427748302ac5ec1136802bfb5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AM

Filesize
672B

MD5
b4e8434859a17a93ab265f7b6fa9d87d

SHA1
e98685155916f7da56116a2693c5bcbb38054ef7

SHA256
e629841baef6dec28edb3c6f1fe325d8da5fdfe409a4714757a0da172d168178

SHA512
b057452e221d31a74aa2e1f07623b225fc6deeec1678c93a5165ce6fe99e4c9f4948fda461971528b6fa0a037181a67933bcaa64182a8c1ff66c34271051f3f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AO

Filesize
584B

MD5
d4a5d94e8da946d5958403ffbe702473

SHA1
8a4d3e8a13c4cd55b8d3ab232b74d4c0b4e0f7f4

SHA256
4da61b81c7eb8353249d558531581d6b75850db2a73dfddf94a68596836d67c1

SHA512
df604a178eed1768ff9645e530568eb8d5c2837a40210038d1f43e25094bf7a8d473f3c127e79e7df643d7b3925c65f51e6ea042a08cd87e1ea436498f22bd31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AR

Filesize
1KB

MD5
706246d4a09909a28df0012c561a7f40

SHA1
acd7d6ee0ea9504ea5ea86ef7d671e0fff8d9c02

SHA256
d8d959d3fdb1aeec6bf86ec456e5f9ca1720f0b4a79d947c29e48585c9f367f8

SHA512
4288117ad9267c78c13f66976027afe26d7d18106a5718fa89784bb1f7c3699e1581e5704828d5e2852a7438f36f144fe3da687ba525240079e89220e419b0a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AS

Filesize
72B

MD5
c40f229fa035d76909a63a776a99ecb2

SHA1
842adeeb5df37e5d4af76a4c169c865bc8834ed8

SHA256
6e8f98242cabdfa073b304515783ae740934b21af50c017efa4ed7c16eed905c

SHA512
bab361f7fa2abd42e421c19e2e2c17898dad0b34456c2f5d4ef2b2e40e125bd11481e1168680159f8877f80bc736de943104d40aa5dcd582c7a2db2eee1f6082

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AT

Filesize
219B

MD5
47c9e52a65c07926784bb0ea99671c81

SHA1
848eb23bceee95bc6d6ee3ff31aaf50d4c320542

SHA256
45dcb070172326bf5157b89174972b94c30e1defbb439c7d7e15537133646917

SHA512
92de707adc32866fc16f1d26310ce1dfe16287dec5c04e40c7cdd31a4e37e79fcba050eaa28f8c95a13aef385f4fe89b74d8cedadb40fff25694740a51f5b201

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AU

Filesize
221B

MD5
6963e74d5a1dfe40afd9186f3e4046d2

SHA1
8fc88f26634e2d770ad303ffeb78b33ffa359aa1

SHA256
b46b3f2168d78f610edc047dd47e09297b33c1c8aabcfe391dff39ae3dffd43f

SHA512
d5f76faa8ace4c3b4173457a13c6b4f9675011781681d9e9f3e1265fd2d3dcbde10de8c05aea7692fceee5f7a059600d6383a35e568ce9e2c1ef7fed07af5bdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AX

Filesize
87B

MD5
a16881ff20fa9c1b98e3709e53d4eb28

SHA1
c80da92531732a132c86851c5f2b343821f57e0f

SHA256
15a7cf465603da8e23de9b7b4b2eb315f68f94940284640ccc98c69ef479fb61

SHA512
9188922720f12bdd7710e370f75797838385792f81e515a1d9fd536565ca8a667df8272947e650e547dae4f9660bb72b344a4f137a3801aa6a30deb283cf4292

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\AZ

Filesize
83B

MD5
ede5ba716d76eaf1038f5def8fc210a6

SHA1
be516e361425f3390c283d1a378ad69a0683c884

SHA256
18f1c1bec41822d38dfa7642c11ca54d2769756fc6a9cf7a9b6c9c07fb4bfce2

SHA512
83754d2e7afe9d4e79d888b5a3986230bd3828a39bc02ec9be4aacee4bb0dab2e14c5fd719e98ccf2112ee6367d54ecfdf85bd7e26f33ac4dc8101f6ea2cc452

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\BA

Filesize
247B

MD5
8fef3e2538fc2d1e9bacb9fdbd93b84f

SHA1
f7df4c396eef39b2effb64ef26c7a35a46ef5588

SHA256
18945b001ae55765d8d2caca33ec22f1a20f7769ddd04a1f58a949ea1628ab5e

SHA512
78d39add187a80858c0c5e1ae8c096b0384e1fe222bc8237164c27834a9c7a9e27847957f774238319e73b84753067b8d47d2ac7f39e996948bd2596824c536d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\USERDA~1\AUTOFI~1\202011~1.164\BB

Filesize
384B

MD5
600e3d06956c5ab4498fba7569d6255e

SHA1
ac490bd1f32a670f52d49cdf2916686395fdbabd

SHA256
fdec40401191290328818fa66281cd0fcb159ad1f0002d260920487fc37f9bd5

SHA512
df54475bf989d281096dc84da14fe76b1eec353a3cc7e524ce5fcc596e018eaf149636ed4b274c9feb12d255928e411c03cc4b968ee0a970aec8b360a9a93780

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\1.bat

Filesize
318B

MD5
fbaf6a747886546293880045bce009c9

SHA1
f8cb6fd8c3c00dd0d77bd80740dcaaa576ab19e1

SHA256
57a4468d52641b7e1cc06afed3f7c077ae686ab184625ee0adb4915e1966ce51

SHA512
3b395280a07bd80798f9ba7f602f426361b4d121a1c6f8f38371412f8c4af9bff1840d90b1948839a7cf71f3523a9e2041d6f418cab64c9139cc61da625398f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\glitch.exe

Filesize
103KB

MD5
47801f0cf73d320054676a56d0264edb

SHA1
14147de6009f6ad7308cd0cc42864f85d4f41fa9

SHA256
f25853b17ee25c1df537cd39ba15a338b92b0812833e3a523aa2f90efbf766e8

SHA512
2d8f22ea28fbde67f63ea59d262df06658f075d1ef05c2837cea599528d01115a84ab5f88678c4a1fefd4f66a4946b7b20c7744a5bea8dcb3b5444e6c614d2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\glitch.exe

Filesize
103KB

MD5
47801f0cf73d320054676a56d0264edb

SHA1
14147de6009f6ad7308cd0cc42864f85d4f41fa9

SHA256
f25853b17ee25c1df537cd39ba15a338b92b0812833e3a523aa2f90efbf766e8

SHA512
2d8f22ea28fbde67f63ea59d262df06658f075d1ef05c2837cea599528d01115a84ab5f88678c4a1fefd4f66a4946b7b20c7744a5bea8dcb3b5444e6c614d2ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\inv.exe

Filesize
359KB

MD5
ebb811d0396c06a70fe74d9b23679446

SHA1
e375f124a8284479dd052161a07f57de28397638

SHA256
28e979002cb4db546bf9d9d58f5a55fd8319be638a0974c634cae6e7e9dbcd89

SHA512
1de3dcd856f30004becee7c769d62530f3a5e9785c853537adc0a387d461c97b305f75cbaf13f278dd72ba22d4650e92c48edf3c3a74b13ed68ffc0d45e13774

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\inv.exe

Filesize
359KB

MD5
ebb811d0396c06a70fe74d9b23679446

SHA1
e375f124a8284479dd052161a07f57de28397638

SHA256
28e979002cb4db546bf9d9d58f5a55fd8319be638a0974c634cae6e7e9dbcd89

SHA512
1de3dcd856f30004becee7c769d62530f3a5e9785c853537adc0a387d461c97b305f75cbaf13f278dd72ba22d4650e92c48edf3c3a74b13ed68ffc0d45e13774

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\lines.exe

Filesize
103KB

MD5
50caeee44dc92a147cf95fd82eb6e299

SHA1
a6619a150a31f4c1b4913884123f5b5334e23489

SHA256
81b9a2e3e9ee39f05b585ad871696a946837fcf784d3d4ecd4b9caea16560a1e

SHA512
e009de28d24abbecac2b20c4dcbbe4bd2de461c0d3140043d1ef6db3e4807d13723fb1916bc9bd1a636cfdc4bb3e102ecae645e783901ebdf9996e9bcdd9466b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\lines.exe

Filesize
103KB

MD5
50caeee44dc92a147cf95fd82eb6e299

SHA1
a6619a150a31f4c1b4913884123f5b5334e23489

SHA256
81b9a2e3e9ee39f05b585ad871696a946837fcf784d3d4ecd4b9caea16560a1e

SHA512
e009de28d24abbecac2b20c4dcbbe4bd2de461c0d3140043d1ef6db3e4807d13723fb1916bc9bd1a636cfdc4bb3e102ecae645e783901ebdf9996e9bcdd9466b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\melter.exe

Filesize
455KB

MD5
615d04a80c94f9e36efb9c567a8afc34

SHA1
cb3b158ce9b5a0eef3097c55c226e6084a4f4877

SHA256
9f2c6d14a476d10615fe8e099ef8f87681b80382665b81c041eb5128ae7c7cb8

SHA512
0b4c3e073d170b7de1635e3b6af1f641215d217ce9f96d6c57d2ca8a6af45c9aa94a84b6b9f0876a7a8a7a31763943ba5e3bb6f44316a3a2007574359c461294

Download Submit
C:\Users\Admin\AppData\Local\Temp\8211.tmp\melter.exe

Filesize
455KB

MD5
615d04a80c94f9e36efb9c567a8afc34

SHA1
cb3b158ce9b5a0eef3097c55c226e6084a4f4877

SHA256
9f2c6d14a476d10615fe8e099ef8f87681b80382665b81c041eb5128ae7c7cb8

SHA512
0b4c3e073d170b7de1635e3b6af1f641215d217ce9f96d6c57d2ca8a6af45c9aa94a84b6b9f0876a7a8a7a31763943ba5e3bb6f44316a3a2007574359c461294

Download Submit
C:\Users\Admin\Downloads\Antivirus 2021.exe

Filesize
603KB

MD5
a9781403e2e0f3539b81dbbc4ba52f07

SHA1
cba433e3c7690c1628bc620a43912f06db331065

SHA256
16837f396802d446e72fb4d02c68a2e07b5657e3e1d3d738b79a2c8992ad1ad0

SHA512
6c985a47a7bed1e150cbed5da08cb2528fdf8e5d80a482610ad7fb14d079cb19756872453b23ace8dade982b4979ff885de7b41e798b3d4ccdc957f2564836c5

Download Submit
C:\Users\Admin\Downloads\Antivirus 2021.exe

Filesize
603KB

MD5
a9781403e2e0f3539b81dbbc4ba52f07

SHA1
cba433e3c7690c1628bc620a43912f06db331065

SHA256
16837f396802d446e72fb4d02c68a2e07b5657e3e1d3d738b79a2c8992ad1ad0

SHA512
6c985a47a7bed1e150cbed5da08cb2528fdf8e5d80a482610ad7fb14d079cb19756872453b23ace8dade982b4979ff885de7b41e798b3d4ccdc957f2564836c5

Download Submit
memory/3116-145-0x0000000000400000-0x000000000050F000-memory.dmp

Filesize
1.1MB

Download
memory/3520-198-0x000001DB2C350000-0x000001DB2C370000-memory.dmp

Filesize
128KB

Download
memory/3520-196-0x000001DB2BF40000-0x000001DB2BF60000-memory.dmp

Filesize
128KB

Download
memory/3520-193-0x000001DB2BF80000-0x000001DB2BFA0000-memory.dmp

Filesize
128KB

Download
memory/3560-185-0x0000011AF8D70000-0x0000011AF8D80000-memory.dmp

Filesize
64KB

Download
memory/3560-186-0x0000011AF8E70000-0x0000011AF8E80000-memory.dmp

Filesize
64KB

Download