amadey | da730557f8b4c1520f0de35abbe7680031db2dbd9ccc66560d58b3c4e2e29828

Analysis

max time kernel
63s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/02/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
Size 1.8MB
Sample240206-lc2cbsefhk
SHA256 da730557f8b4c1520f0de35abbe7680031db2dbd9ccc66560d58b3c4e2e29828
MD5 5ffa91652bd79f6a0938a7f01cf25a82
SHA1 bbd3e005d253320876ed820b75ea9293596e4544
SHA512 963ac8312daacf9f9ce825540a744745fcd2583a9b500a28ea9342636709cc0a67906db80af07fafef62d45151ce15ec95b32cc8a07789ad3ab8b568f8fd8997
SSDEEP 49152:RGATe4wEwYMW/37z+mFJJU7FG1dJCZzwTkN:A2e4wyfrCTIdazOm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline risepro zgrat @pixelscloud evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

risepro

193.233.132.62:50500

Extracted

Family

redline

Botnet

@PixelsCloud

94.156.67.230:13781

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/8468-581-0x0000000000400000-0x0000000000592000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000e00000002181f-837.dat	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral2/memory/2328-132-0x0000000004A90000-0x0000000004AD2000-memory.dmp	family_redline
behavioral2/files/0x000200000001e702-168.dat	family_redline
behavioral2/memory/4708-198-0x0000000000EE0000-0x0000000000F34000-memory.dmp	family_redline
behavioral2/memory/2328-204-0x0000000004B50000-0x0000000004B8E000-memory.dmp	family_redline
behavioral2/files/0x000600000002314e-627.dat	family_redline
behavioral2/files/0x000e00000002181f-837.dat	family_redline
behavioral2/files/0x0004000000021bc0-832.dat	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dota.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

.NET Reactor proctector 22 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/memory/724-188-0x00000000050F0000-0x000000000529C000-memory.dmp	net_reactor
behavioral2/memory/724-202-0x0000000004F40000-0x00000000050EC000-memory.dmp	net_reactor
behavioral2/memory/724-270-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-301-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-293-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-282-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-267-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-312-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-323-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-337-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-401-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-378-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-368-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-430-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-458-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-446-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-436-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-355-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-343-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-490-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/724-500-0x0000000004F40000-0x00000000050E5000-memory.dmp	net_reactor
behavioral2/memory/8468-581-0x0000000000400000-0x0000000000592000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dota.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dota.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	explorgu.exe

Executes dropped EXE 5 IoCs

pid	Process
4168	explorgu.exe
2328	leg221.exe
1360	fu.exe
1572	dota.exe
3520	Amadey.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	dota.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Wine	explorgu.exe

Loads dropped DLL 2 IoCs

pid	Process
3552	rundll32.exe
4788	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dota.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000032001\\dota.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fu.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000031001\\fu.exe"	explorgu.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000600000002312e-63.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3156	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
4168	explorgu.exe
1572	dota.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
File created	C:\Windows\Tasks\chrosha.job	Amadey.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8128	sc.exe
1676	sc.exe
2132	sc.exe
7812	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
8196	5312	WerFault.exe	126
1680	9540	WerFault.exe	193
9688	4272	WerFault.exe	202
5116	4272	WerFault.exe	202

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3156	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
3156	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
4168	explorgu.exe
4168	explorgu.exe
1572	dota.exe
1572	dota.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3156	SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe
1360	fu.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 2328	4168	explorgu.exe	93
PID 4168 wrote to memory of 2328	4168	explorgu.exe	93
PID 4168 wrote to memory of 2328	4168	explorgu.exe	93
PID 4168 wrote to memory of 1868	4168	explorgu.exe	94
PID 4168 wrote to memory of 1868	4168	explorgu.exe	94
PID 4168 wrote to memory of 1868	4168	explorgu.exe	94
PID 4168 wrote to memory of 1360	4168	explorgu.exe	96
PID 4168 wrote to memory of 1360	4168	explorgu.exe	96
PID 4168 wrote to memory of 1360	4168	explorgu.exe	96
PID 4168 wrote to memory of 1572	4168	explorgu.exe	97
PID 4168 wrote to memory of 1572	4168	explorgu.exe	97
PID 4168 wrote to memory of 1572	4168	explorgu.exe	97
PID 4168 wrote to memory of 3520	4168	explorgu.exe	98
PID 4168 wrote to memory of 3520	4168	explorgu.exe	98
PID 4168 wrote to memory of 3520	4168	explorgu.exe	98
PID 1360 wrote to memory of 208	1360	fu.exe	99
PID 1360 wrote to memory of 208	1360	fu.exe	99
PID 4168 wrote to memory of 3552	4168	explorgu.exe	100
PID 4168 wrote to memory of 3552	4168	explorgu.exe	100
PID 4168 wrote to memory of 3552	4168	explorgu.exe	100
PID 3552 wrote to memory of 4788	3552	rundll32.exe	102
PID 3552 wrote to memory of 4788	3552	rundll32.exe	102

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.13348.22865.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3156

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\1000019001\leg221.exe
  "C:\Users\Admin\AppData\Local\Temp\1000019001\leg221.exe"
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
    3⤵
    PID:6400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1"
  2⤵
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
  "C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/
    3⤵
    PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:2704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,932847780547764990,7752093696884460915,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:6720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,932847780547764990,7752093696884460915,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
      4⤵
      PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.linkedin.com/login
    3⤵
    PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5435553337515855126,9099032088770194545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
      4⤵
      PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5435553337515855126,9099032088770194545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:6240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
    3⤵
    PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:6956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:6948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
      4⤵
      PID:6172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
      4⤵
      PID:6164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
      4⤵
      PID:7568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:7892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
      4⤵
      PID:7696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
      4⤵
      PID:7708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:8712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:8704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
      4⤵
      PID:8532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3264273589734969780,6815815928632920242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
      4⤵
      PID:8328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10520256849176369990,13761748357077660867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
      4⤵
      PID:6292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10520256849176369990,13761748357077660867,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.youtube.com
    3⤵
    PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4942870268227031018,15415260722583780544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:6436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4942870268227031018,15415260722583780544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:1420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://www.facebook.com/video
    3⤵
    PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1452,7686216228404385653,12208516557042881926,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      PID:6980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1452,7686216228404385653,12208516557042881926,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
      4⤵
      PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://accounts.google.com
    3⤵
    PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
      4⤵
      PID:224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6317516368273662473,4510725775783207740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
      4⤵
      PID:7416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com
    3⤵
    PID:5072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9768b9758,0x7ff9768b9768,0x7ff9768b9778
      4⤵
      PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:2
      4⤵
      PID:8364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:8
      4⤵
      PID:8492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1964 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:8
      4⤵
      PID:8476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3288 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:8672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3264 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:8648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3600 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:6660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4420 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:9372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5012 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:8440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5008 --field-trial-handle=1768,i,2908933350102705772,2794980420662777276,131072 /prefetch:1
      4⤵
      PID:8996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.facebook.com/video
    3⤵
    PID:3892
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9768b9758,0x7ff9768b9768,0x7ff9768b9778
      4⤵
      PID:1704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1948,i,7013401059397104540,3211964657187103052,131072 /prefetch:8
      4⤵
      PID:9360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1948,i,7013401059397104540,3211964657187103052,131072 /prefetch:2
      4⤵
      PID:9352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://accounts.google.com
    3⤵
    PID:4680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9768b9758,0x7ff9768b9768,0x7ff9768b9778
      4⤵
      PID:5300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1924 --field-trial-handle=1980,i,7208567247642660811,9572906017625390570,131072 /prefetch:8
      4⤵
      PID:6312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1980,i,7208567247642660811,9572906017625390570,131072 /prefetch:2
      4⤵
      PID:3772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
    3⤵
    PID:5156
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.youtube.com
      4⤵
      PID:5480
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.0.553230322\138328101" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 1664 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a9679a7-f73e-4112-8050-4ec7c655f81f} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 1764 2052d1d1458 gpu
        5⤵
        
        PID:6276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.1.287416337\458142691" -parentBuildID 20221007134813 -prefsHandle 2264 -prefMapHandle 2260 -prefsLen 21565 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7ee4038-8595-49f1-96e6-51119f151269} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 2284 2052cce3b58 socket
        5⤵
        
        PID:7744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.2.761769872\652451589" -childID 1 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 21603 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6b94cfc-8760-47b3-b9e7-08fa9efc98b1} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 3612 20530caf258 tab
        5⤵
        
        PID:8544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.3.2127213795\91010960" -childID 2 -isForBrowser -prefsHandle 4036 -prefMapHandle 4032 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1477221-1a66-4122-812e-d005a8cd1eee} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 4048 20521364e58 tab
        5⤵
        
        PID:5244
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.6.1610574341\1266418425" -childID 5 -isForBrowser -prefsHandle 4968 -prefMapHandle 4860 -prefsLen 26685 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69d0e751-a367-4725-8358-33750b446f76} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 4724 20532fb4f58 tab
        5⤵
        
        PID:6824
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.7.857210692\1348654762" -childID 6 -isForBrowser -prefsHandle 5388 -prefMapHandle 5200 -prefsLen 26790 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a7f32fb-e09c-4a4e-a035-1c0986a0040d} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 5400 20532fb4658 tab
        5⤵
        
        PID:5752
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.5.768907268\577840031" -childID 4 -isForBrowser -prefsHandle 4880 -prefMapHandle 4936 -prefsLen 26685 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca00f76e-0ced-4009-b186-997b3108b33f} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 4924 205322b0a58 tab
        5⤵
        
        PID:8792
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5480.4.1954728665\1275992298" -childID 3 -isForBrowser -prefsHandle 4700 -prefMapHandle 4684 -prefsLen 26471 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7671feb1-8490-4937-a894-4e754e85ea8f} 5480 "\\.\pipe\gecko-crash-server-pipe.5480" 4632 205301a2858 tab
        5⤵
        
        PID:1676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://www.facebook.com/video
    3⤵
    PID:5376
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5376.0.2012612992\26199518" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1704 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {02a4781e-52d0-47f6-af38-701175cc77cf} 5376 "\\.\pipe\gecko-crash-server-pipe.5376" 1816 19849cd8658 gpu
      4⤵
      PID:8400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5376.1.1060551344\1306711657" -parentBuildID 20221007134813 -prefsHandle 2060 -prefMapHandle 2056 -prefsLen 17556 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94ae9a7a-054b-4193-96f4-449cecb1d9c1} 5376 "\\.\pipe\gecko-crash-server-pipe.5376" 2072 1984a14ab58 socket
      4⤵
      PID:9908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
    3⤵
    PID:5596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" https://accounts.google.com
      4⤵
      PID:5884
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5884.0.1624557794\1260000800" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1700 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bcb84c0-113d-4cfe-9015-0c35cc142231} 5884 "\\.\pipe\gecko-crash-server-pipe.5884" 1796 206c51d8358 gpu
        5⤵
        
        PID:6316
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5884.1.179046324\826901456" -parentBuildID 20221007134813 -prefsHandle 2044 -prefMapHandle 2040 -prefsLen 17556 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9343b966-d38c-460d-a8eb-705539751d79} 5884 "\\.\pipe\gecko-crash-server-pipe.5884" 2060 206c5044e58 socket
        5⤵
        
        PID:5868
- C:\Users\Admin\AppData\Local\Temp\1000032001\dota.exe
  "C:\Users\Admin\AppData\Local\Temp\1000032001\dota.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Users\Admin\AppData\Local\Temp\1000050001\Amadey.exe
  "C:\Users\Admin\AppData\Local\Temp\1000050001\Amadey.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3520
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4788
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:4172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\073191680435_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:5616
- C:\Users\Admin\AppData\Local\Temp\1000058001\alex.exe
  "C:\Users\Admin\AppData\Local\Temp\1000058001\alex.exe"
  2⤵
  PID:724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:8468
  - - C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe"
      4⤵
      PID:440
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe"
      4⤵
      PID:6384
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:3304
- C:\Users\Admin\AppData\Local\Temp\1000059001\sadsadsadsa.exe
  "C:\Users\Admin\AppData\Local\Temp\1000059001\sadsadsadsa.exe"
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\1000060001\1233213123213.exe
  "C:\Users\Admin\AppData\Local\Temp\1000060001\1233213123213.exe"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\1000061001\55555.exe
  "C:\Users\Admin\AppData\Local\Temp\1000061001\55555.exe"
  2⤵
  PID:5312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5312 -s 1112
    3⤵
    - Program crash
    PID:8196
- C:\Users\Admin\AppData\Local\Temp\1000064001\lumma123142124.exe
  "C:\Users\Admin\AppData\Local\Temp\1000064001\lumma123142124.exe"
  2⤵
  PID:6048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:9540
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 9540 -s 828
      4⤵
      Program crash
      PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\1000066001\redline1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000066001\redline1234.exe"
  2⤵
  PID:5084
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "ACULXOBT"
    3⤵
    - Launches sc.exe
    PID:8128
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "ACULXOBT" binpath= "C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:1676
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "ACULXOBT"
    3⤵
    - Launches sc.exe
    PID:2132
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:7812
- C:\Users\Admin\AppData\Local\Temp\1000067001\dayroc.exe
  "C:\Users\Admin\AppData\Local\Temp\1000067001\dayroc.exe"
  2⤵
  PID:8348
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe"
    3⤵
    PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\u634.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u634.0.exe"
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\u634.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u634.1.exe"
      4⤵
      PID:5388
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Local\Temp\rty25.exe
    "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
    3⤵
    PID:5240
- - C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
    3⤵
    PID:7916
- C:\Users\Admin\AppData\Local\Temp\1000068001\mrk1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000068001\mrk1234.exe"
  2⤵
  PID:9152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4272
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1252
      4⤵
      Program crash
      PID:9688
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 1236
      4⤵
      Program crash
      PID:5116
- C:\Users\Admin\AppData\Local\Temp\1000069001\RDX.exe
  "C:\Users\Admin\AppData\Local\Temp\1000069001\RDX.exe"
  2⤵
  PID:9512
- C:\Users\Admin\AppData\Local\Temp\1000070001\daissss.exe
  "C:\Users\Admin\AppData\Local\Temp\1000070001\daissss.exe"
  2⤵
  PID:7528
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5676
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:9792
- C:\Users\Admin\AppData\Local\Temp\1000071001\rwtweewge.exe
  "C:\Users\Admin\AppData\Local\Temp\1000071001\rwtweewge.exe"
  2⤵
  PID:9064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:8256
- C:\Users\Admin\AppData\Local\Temp\1000072001\dota.exe
  "C:\Users\Admin\AppData\Local\Temp\1000072001\dota.exe"
  2⤵
  PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9772e46f8,0x7ff9772e4708,0x7ff9772e4718
1⤵
PID:2204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9012

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:7012

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:7100

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
PID:6788
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  PID:7932
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    PID:2524
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:8784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\073191680435_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:5132
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  PID:5060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5312 -ip 5312
1⤵
PID:5472

C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
C:\ProgramData\hlkwogclqprr\uwgxswmtctao.exe
1⤵
PID:7364
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4272 -ip 4272
1⤵
PID:9656

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:7816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4272 -ip 4272
1⤵
PID:5224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 9540 -ip 9540
1⤵
PID:9660

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 935b4cba7114f9adb0c7ae6acbc8903ec672ae318ac63c5d5e5edf857b4db207
MD5 8ae25b226e0662d256cdb32f2777f840
SHA1 39594f82a6dd98b6e4a341648cd56e9efc6aa16e
SHA512 e529649b71c7a7fccaabc2833af3cbfc9bb15b66cc5735fc95a2bd741c502bd11af05853946d045a49d823e3f6899523d050fe7d33c485af5abccc8e2ca02e8f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 d563c8fbb0cf66f59a27f899a7557a13a3740c64654001dd8e6a076d6b1d95f7
MD5 f0a3e32c2c5e6e75ca9c72642dedd5af
SHA1 6b89a67e6123cb586a7f87edc74bcb43c46e16cf
SHA512 c7b8890e8668f5b25a6b4a82e296d712fe8986ce2b93d7240cd40e15ea2740e0ba90f4f314415f1d19a156fe67789bdea4b02310094aec114781ac4583768533
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5bb7dc3c79c9f886a59706ecd36e1d6f0b6377167002effd7236054f4536f2c0
MD5 8c4bd69a2c5e24de1f69ea016e25ecfc
SHA1 6d733ffbcaebf641461cb7d1227a881f65e2da7c
SHA512 f843c9ab3f550cf4f53140aa707dfef29579949d7c2b63b4b9b26c4a6bc6560ba7ae5797c03d14ff38f8a01c2ec54184ad8ae7f22b90f4fabaf01e29f6d20333
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 369B
SHA256 5b57f9a533ce4d2061cc948a79a3aa52e77d69673a0e559eeed882a713084c34
MD5 e78231872fa52dce5339238dc5f1205a
SHA1 74238a0c408fd1bc10bc598bc2924f56a1e62ebc
SHA512 064e6d04fcdb706b0b1bd31d71ce78faf67534572267f7f6ab4970c285012aab22d1f89448ed8a5f9f49e50a6c2f25386aa9b6d90cafb32ab78dd2bc714c273f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 f3d9eeb615cf0f40317a09244e884739a8040ed08c1ea527e47b411a9a1afef8
MD5 b424fa65689b3016190b61a951a75302
SHA1 40cbcf3336710d2ccecfe8425ad6c7ea2ea38879
SHA512 a3a7c3d9d74e43c886b927b8ca547e75289048a83e5131fd4683f207ec484100f894627d4a709a4a6276d431d198e68f68d8041529f97af309fa6291278651ad
SSDEEP 192:lQOF8qqET+yy+FWk5tGkXFxDotjEsXtScPS:lQNyxx3WtIsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 5KB
SHA256 75fb28ec064724af7514606704caecc715385a28bdf86558e34844d2d862b4e1
MD5 783f852a3e7742dc65a6a6b6c612a44e
SHA1 4e68728ca31bf48d9d99cd0bb0d3738cd71a767d
SHA512 046a939cd8c6cd9fcf711a80e5115042b6d5921a453f0150a9a8c66789c8f14c8941682cc1f140507eecf10c58621bb3b011fa28aba6fb0ecf731538d7e3d244
SSDEEP 96:l4POKIMkd8iZRy7Di+6MsmderIOFop57jVhYtjEsXt0/cg2Vup:lQOF8syy+FSmotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 57787d6ba7f2ae330ca1162b1dd6e08b3bdf5989c59b2532397a75eb818a743b
MD5 aa838bd5a47c4ba8297570eacae71e13
SHA1 2316636f0dbecfebe73f44893c1e92c82d0be03e
SHA512 1abe243a50d8d44cacd2ba7978dd933d4a33667d414aff54c75cd5026c608d36634b6dcd10afb53e972cd77b34b870a8ce9cea8c42563b6e7c59f7fc631c0293
SSDEEP 3072:Ljl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCh:LB+70xBmboJnf9/ToH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 57948612e7719cd9621bd01d23bc7952c47b05893d15bd22a07fd7f14e389a31
MD5 337828d920a04e8a114bf8aa8cba7254
SHA1 349257f40174b4ad690a961957b389134ad1a841
SHA512 07327248de68ffcd9a522a8397600b8ed0e987b6958d47d427a239e8c3e2851ff1560cebbfa6c0b29c70fd56fedfbb9386dc0d04f42e2978a88101bf142e58df
SSDEEP 3072:Yjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCh:YB+70xBmboJnf9/ToH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 114KB
SHA256 494c5a6728be532aa08ce5c43b754999b25305c7abe554d673c83f67eaa27d7b
MD5 3aa492c1d92d5b96fa1a4f3d180dece8
SHA1 a1abf50a5571dcc793379403014636d90a16a2a2
SHA512 a1b3af17b7635053f86f58d050144425164b470738098a62facfd71968c52c23e3947fb4a5f97f7ed728771d211cb481d441928f305178039cffbe17498c84ec
SSDEEP 3072:Pjl+RZ3ExBmTyNAccce6M1OvEOnf5SD2A0hea11o9MCh:PB+70xBmboJnf9/ToH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
Size 86B
SHA256 2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93
MD5 f732dbed9289177d15e236d0f8f2ddd3
SHA1 53f822af51b014bc3d4b575865d9c3ef0e4debde
SHA512 b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d1100cf9e4db12cc60cce6e0e2e3d9697e762c219f6068eb55a1390777bf4b45
MD5 b810b01c5f47e2b44bbdd46d6b9571de
SHA1 8e3d866cf56193ca92a9b74d1c0e4520b5a74fdc
SHA512 6bbf900b2f7614dd17aa6d5febe3ad1100851e2309ba2cd5219c5aa5af7bf830eec2cc88071d37987aa7e3f527b8df5b2d85e8b21b18fcb071baaab1a2eadae2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 99KB
SHA256 5e03df5cf23f281e1468adbd4f7c6fecde0aa49aa091dff502c502259f08804e
MD5 6686240bc8fde45cce7a08351901aa87
SHA1 9a77b17cd17da5bfefa44813944c2f83a0be7fe4
SHA512 54d778639e5cac66fc9c6cc47198afef9ddb12052620ee35116c7e84131e10da986f45188db5ab384eb038d27d45ac7986ceb5a45f5683145b79c0f6d92c14e5
SSDEEP 1536:HF2cg2UWbyn+Qu2w7ahu466uzjNHFfOBNlGkLeDHM31uXyKORy6h1MKj0aEqQ:HFdg2RP2w7F465FONlI4qyLh+KREP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 a5b3c6e130497d211592ad82da032f6c74115871a0da7c129dd3a8c742ae4125
MD5 0fa97ee131b7acb1c7b7ddae00686102
SHA1 58b61c5ee17cd0e0a36aa5d625b9e0fba2e2b3a0
SHA512 f93304d90c02ab86a5c25ad32305f17685642f0599b31d9061f3fce95ce7b1ad1da95573104c13a17434f9d415b13d3b273f6775d6bae86accc11a41a4b36152
SSDEEP 192:nMkArTl2dtWMWPYX2PYryuGYYdExWdPQ7mmrV:nMJrQWlYuJ0yi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2cbd8d565439ee82414611889a2f027fb7ce8f6a234bbf048c113f54d6f17182
MD5 cf709ffd6cae3a120301033bc49e3bbe
SHA1 e17f560af9dc0c9ebffb681decd12cc805ce4885
SHA512 f6ecbf770469d7079fdd9670a5f8f1224ecef94d32218b9926d7ba1a71ccd5887e2c3849994b77a889862db007ef44abef6a7a468f0ad87d542f0ae416ecae9b
SSDEEP 96:nMk7E1VTlwpXdtWMoiVmdepYrMkMtYdMk4xWoZcmUWQyV+VDCAiEwb:nMkArTl2dtWMZYr4YdExWoumrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 99e2655a7f371533cf1dd0bd553fec6cfe27c013cdf1c6a6494db314fa9c7840
MD5 0b9918811a8aedf29cebbf7e9a610e71
SHA1 4e46d23b67c978339eb50e5b1714ec94b6e21ad8
SHA512 a8140456502f370abd9f8b61a578ec0bd8754a653c5f7a19826b13c67761570efb31cea52aff8fa8febdb514b360b3f3f1a39c754d41d232d676e9b58b870714
SSDEEP 96:n6kAE1VTlwpvWMoiVmdeHcamUWQyV+VDCzia:n6kFrTlGWMXxmrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 160748e667f6b7e98dbd04359cd296bec28f2a1bd67ee23c8c653d003e01b77a
MD5 db62c56f6be56b2f46c337656ca78df6
SHA1 20125a5d8ad5797573cb103a31f3ecaab59b0127
SHA512 304387189068149d60dfb1f30f397a0c02557165f2a683980011eb0303a2c3b72495c4799e09541163fb5c8ea0378d7375d44d57bf066e112739f3967805c689
SSDEEP 192:nMkArjl2dtWMWPYX2PYryuGYYdExWdPQ7mmrV:nMJrAWlYuJ0yi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 875B
SHA256 211807a93b3e35d9f5a754cc5600591347c8c72f0b33eb963098d000e680d847
MD5 78fa56ca837b9d79c09ce445dc7387ed
SHA1 9b712cdad2c644a56c63e4036b196e7b3944f624
SHA512 5a2e0cfcdf993cb29cb8a57e525d10699883ef3e9254d01eea3fb9fb19a71116a2ce19253afdbcefba8d325e6785181ed12c2e1a8310261f781ca27d1cbd110b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 875B
SHA256 fe95dcdee17531f4d6615144cd71fefe73d38f730a5632d43134193618f804b1
MD5 0a3f30f1a3acb49579ddeff20a369c4c
SHA1 4c503e9ea44c9cf3ed9d12faa224b708c300ac4d
SHA512 b3ea9a00201fa4f2086fc7dfe570f408477549c3b9bffe24c168daae3985efae1e89f51b0d40c56ea4bcdafafe5a7acd51fe2bd9ce4d328bde36367deb277020
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe59bf20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59bf20.TMP
Size 707B
SHA256 64cf7e34ff9cc20ea5f8915698bf87415b7aa06f7306958a3bd025e9703e6807
MD5 6a886b2f59475ed37bcc305a1bab4b84
SHA1 2d62a2f0e2f4f5f2c78651effb24e84e72809dd5
SHA512 3b2405b853f0a3d97f8ffc624fcdeee874435ea47ea436cf29c5d150ea1b3da305800971c2312dc6a583d34c46510d708a1bfdad6efcefa0df24ff4b79eaad51
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 5154c1495e574685612c9da670bb2085d87dbe074a987101eb626272c58a46c6
MD5 1802c9c89a159c10f2866a9360dba991
SHA1 a580692a18a0a2daf3f43ba290e048b510dc627a
SHA512 7e5053228c198be71a38a9db99884774cf1778c0bc7eda963269139e84e21dc84e196b868667a1bf2205831b920590f3895512d97f788e6a1b25b14a65da1af1
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 3580dfddfaf7459a7ede5c84be3c64bf6e12bc45f550195997cb0bd72b3d03da
MD5 e703c3c0a5c84c4d08dbde0ae343191b
SHA1 6f9731d1a69624e31a46e57c1bed12164906592a
SHA512 55fa4a1353a3c0b54ef4233cc05e9742a61bb16b3c793ef62bd57aec654a2684c00a41a5ba2eebd5b9ee291f92a1e14c1732cc48f532151e4697acc9072a8d95
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 63615ebf81848e3c7340cd0310cb7c699e0ceccd408bf684b217b366acd3ef89
MD5 9277674f86ec06faeef53fe297b144c4
SHA1 d0a6698c394626657d20a0e3446d800e66be637e
SHA512 fdc2667b1568ce9718e44e2aa8c1475db03ba95ba5b8095a2ae580e6798154f9f4c1daf1514a22b7becd174ed63e4c18cc0ba9d6815ed1da32455e8573d1bddf
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 a43b0d4ad874888d49a8fab304deaa57ae356b836b062f51d72c2702f023e995
MD5 6a7eeccf5aa39a77226cd1cc9d0df493
SHA1 30c585e53089be51aebe0fd97c19dbfe651267cd
SHA512 194897492427bec24ad8285a3c10c3de83c73f1bf7fc75b0382c9457d503f86cac9ff603cc3a31a1a39f4129897934b0e7747879332e676e11dede7464909f38
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 912ee9c821b983166d2d69b4189df6510eacdad12f0bf855f27ffafe1050d8ed
MD5 e6ff910837326ca4c40d15fdc206dd2c
SHA1 c3f038e5161c6c5ebc759f2f8c805bc916b67182
SHA512 e497369e89f9b703fa4bb0849232b5ffee791618b27bc9b11d5b6886a4266cd2b2f4aea4787a30f4324e4fb9c756de2191d0b1455c87a557bec65624ba59330b
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6tzge2RUutHehTw8AftwKG:N9iIxuERzA83h09RZxY6YxR86W2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 be303b072ec61fae42607ce376d652916fff42e903f4f10c710232750de4e846
MD5 6af4ba2fc9e33c448349ce3878db05b7
SHA1 0312e3c6f4a0735dbfda3b7102a92a3a4d0380d7
SHA512 76957ae53cedac7af44570991d485b31504b575c85a273ac09c55f046eaec7a225b9caf0a473728aeecedb70b689204661ab44f6dc5e19e6ad6ee1f2cc5ae583
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 2KB
SHA256 59ae02abd81a68a721524fdf1f0a2f39e110b5768588ca57ee893f23d02a3215
MD5 adbbaa087e6c10a13d7e16065accc4c2
SHA1 c6e9e7f20ff3cc56e6c17f8b5811e9ee76c98d46
SHA512 cb58bc961bbaa3c254f9b93794a80fe10fe547aea0d7f1e01192f9aa17584804d7c366a6f2568bb4a24c26be7ec276951126d24eb3e96f11c060341db45ec709
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 2ee41f4cc671841be29f2331559e2e38859b4e5b4b83ff2eb02c698c0d95426c
MD5 b82a6953c000d465942322da5f71774b
SHA1 3e415f6c6803725c102e581df3195be1c44dcf43
SHA512 16213cc5740514237b515b76b471232aca515cd4e7c19d91cc4847505b2289917af9f4017e90e5a161ade9a8730c5e253b4897f842fe5f0608b36fa8f54356c9
SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup6tzge2RUutHYhTw8AftwKG:r9iIxuERzA83h09RZxY6YxL86W2+
MD5 SHA1 SHA512 SSDEEP

Submit Download

4832D199584363B876D3E7D57CA02A9B0F4D91CD

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\x3x6afp6.default-release\cache2\entries\4832D199584363B876D3E7D57CA02A9B0F4D91CD
Size 13KB
SHA256 0eee020e52f9ca62c22b8e6d2b933fdd520ecf61b1f932249f254d9aeef47f52
MD5 87f939dd226a81db309e269719bdfd2c
SHA1 112f0c5a8697ba6b436682798587e80d570acb62
SHA512 c931125ff390bf081ad901089a385a2a00b1ff1d6d683e9174304d9d9c1d1a4fa915b7af1b9f116c19e798ab95d261ab7a8f7ebe71a2300a9f75bb52bd49f5a0
SSDEEP 384:Hhyu9fiGLm4pUCJ0DuDyS4uWg938+iLO4O0lpDIIgSU:FBi8mCUCJ0DkyS4ub9gLOwD87
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorgu.exe

Path C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
Size 1.8MB
SHA256 da730557f8b4c1520f0de35abbe7680031db2dbd9ccc66560d58b3c4e2e29828
MD5 5ffa91652bd79f6a0938a7f01cf25a82
SHA1 bbd3e005d253320876ed820b75ea9293596e4544
SHA512 963ac8312daacf9f9ce825540a744745fcd2583a9b500a28ea9342636709cc0a67906db80af07fafef62d45151ce15ec95b32cc8a07789ad3ab8b568f8fd8997
SSDEEP 49152:RGATe4wEwYMW/37z+mFJJU7FG1dJCZzwTkN:A2e4wyfrCTIdazOm
MD5 SHA1 SHA512 SSDEEP

Submit Download

leg221.exe

Path C:\Users\Admin\AppData\Local\Temp\1000019001\leg221.exe
Size 292KB
SHA256 4296e28124f0def71c811d4b21284c5d4e1a068484db03aeae56f536c89976c0
MD5 d177caf6762f5eb7e63e33d19c854089
SHA1 f25cf817e3272302c2b319cedf075cb69e8c1670
SHA512 9d0e67e35dac6ad8222e7c391f75dee4e28f69c29714905b36a63cf5c067d31840aaf30e79cfc7b56187dc9817a870652113655bec465c1995d2a49aa276de25
SSDEEP 6144:iDKW1Lgbdl0TBBvjc/vGDn5rm0YEPFbBCM/:kh1Lk70Tnvjc2DxmNENdp/
MD5 SHA1 SHA512 SSDEEP

Submit Download

do.ps1

Path C:\Users\Admin\AppData\Local\Temp\1000030041\do.ps1
Size 922B
SHA256 f4cc3a4606856fd811ecbcdf3fc89fa6418a1b3c8f56ca7ff5717713e8f806a2
MD5 d769ca0816a72bacb8b3205b4c652b4b
SHA1 4072df351635eb621feb19cc0f47f2953d761c59
SHA512 cf13fd667e71707d63d394391b508f5a1ee5ffa7ac27fe35906e15059e9fccc8ad61e91ce3ffd537e8daa0f6306d130997e9b448a4466407fa0c894917850b64
MD5 SHA1 SHA512

Submit Download

fu.exe

Path C:\Users\Admin\AppData\Local\Temp\1000031001\fu.exe
Size 897KB
SHA256 2d85179f546d5710ab4c4dc38249c5c463b3224e661ebac2c98a9aa0c44bc243
MD5 ffff3fd0ed19aac17443f309d2abda2c
SHA1 8f018deadb4648a6c8863dbe4d6c3f03812fe7b3
SHA512 bef0cf65f9ad8d90e75c5678da03e67ae81455bd2aec63887818d5e8e2d702dcf8aa664c6c44a14451164e00fabf27f2cd777e2adb373cfc6ed8060b2859777d
SSDEEP 12288:mqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaTTM:mqDEvCTbMWu7rQYlBQcBiT6rprG8anM
MD5 SHA1 SHA512 SSDEEP

Submit Download

dota.exe

Path C:\Users\Admin\AppData\Local\Temp\1000032001\dota.exe
Size 2.2MB
SHA256 29032175799c414a455f4867fcbf402d50dcd5c7e9f86302a6d30460c4e8ee8e
MD5 d589e2a948f062dc6d4921598d351188
SHA1 d35f8030bbbc26aca7f6f14782e648b8ddfaa35e
SHA512 23a1eaad00a69b18e337b4a6516d97a1daac42f45d593c05886dbde83919f52d21ce14fbe24b49b0170fa53aaa3820b022fa57b0997775ee643197db5d3e3e64
SSDEEP 49152:2D/HqTFuyvJAc+269ufc7L7zL+jb2DQYV2/UmmsLJog53Szv:S/qT7+2FqL7mjbvYV2osLmg5SL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amadey.exe

Path C:\Users\Admin\AppData\Local\Temp\1000050001\Amadey.exe
Size 413KB
SHA256 fedb08b3ec7034a15e9dee7ed4dec1a854fb78e74285e1ee05c90f9e9e4f8b3e
MD5 d467222c3bd563cb72fa49302f80b079
SHA1 9335e2a36abb8309d8a2075faf78d66b968b2a91
SHA512 484b6c427e28193ddb73dd7062e2bfbd132ddc72ce4811bfe08784669de30e4b92bc27140373f62a4ce651401000a3c505188620c43da410bf6b0799a0791fa7
SSDEEP 6144:0UorLrzMYSnDyTtDOYtf3J7+YZIPcrPJruPWeX2/e1Cw+GOpumhauZef6P5rwmx:0vcYZD17DMPWev1Cb3umhauZef6a
MD5 SHA1 SHA512 SSDEEP

Submit Download

alex.exe

Path C:\Users\Admin\AppData\Local\Temp\1000058001\alex.exe
Size 1.7MB
SHA256 4e6015f1e7c8790a2907de407d2ea9e14ccc04e925c81607fb815bd73c372389
MD5 a615f2eee64c5d7449a8792cc782b6d6
SHA1 cf1dff4fbbf172c6870c30fc3784bdbd53d49a69
SHA512 9b0a2e7c7c4310300cb7f1f14d8b9ec11c7e5d6013b0bdf5c33af9e8f3de92be74ac95d83c0b637e6919f61cdffd8f7a9bf7c5411c23fcdf56b2a753a2830f0c
SSDEEP 49152:8kQTAxXCwWJ7d2JtVYtcbQk4fkr73Vreyvi1wwlaYjYMm3:8axbhJItfxMP3Visi1r7sMm
MD5 SHA1 SHA512 SSDEEP

Submit Download

alex.exe

Path C:\Users\Admin\AppData\Local\Temp\1000058001\alex.exe
Size 1.4MB
SHA256 9540531a605d3ebb4b5a02398ac4af223a42101949d326bb9b7cd670cabb4c7e
MD5 3ad37fb33c45690c0063eee6ff4e0d5c
SHA1 2602f881b0a68de289763eabfab4d3cd76db242c
SHA512 3e956fe3c3395ee37d48cd0bc876684673d2c4039e88a7254b61ca33bfda224e2d809e3b6e13b355f8b251888786a96f143457b13c694e4cc556655830c94898
SSDEEP 24576:8k70TrcxLTCwCRJ7d2KAOckcYtCn1bQgj4fkrEt5i8QVrezOB:8kQTAxXCwWJ7d2JtVYtcbQk4fkr73Vrb
MD5 SHA1 SHA512 SSDEEP

Submit Download

sadsadsadsa.exe

Path C:\Users\Admin\AppData\Local\Temp\1000059001\sadsadsadsa.exe
Size 313KB
SHA256 54b5e43af21ab13e87ff59f80a62d1703f02f53db2b43ddca2bbd6b79eb953c5
MD5 5a6358bb95f251ab50b99305958a4c98
SHA1 c7efa3847114e6fa410c5b2d3056c052a69cda01
SHA512 4ba31d952bffbe877a9d0d5df647e695e16166d0efe7e05e00ddb48487ab703413351a49043965d5d67ed9faca52832ed01bf9fa24d5943fd591b2d263cf05c0
SSDEEP 3072:fA0/mZGN+KNxIKRPFuDt9dV8HvnqvCi6VxsFRbMRqfjDv/YUeqiOL2bBOT:DbDNlFI3au6VxsbMRqfjD4aL
MD5 SHA1 SHA512 SSDEEP

Submit Download

1233213123213.exe

Path C:\Users\Admin\AppData\Local\Temp\1000060001\1233213123213.exe
Size 1024KB
SHA256 8b1dd27176cd4fbbfce7291e0e68b4adb35e9c260064edc8c12641d7c30bbd4c
MD5 9a8f25abdda9b669e64495c6371f8044
SHA1 03ea32cd6e6d48d72eaef98e65b072c64c98fc22
SHA512 5461d76b614831aa9422f85a6aac2bf1b82114ff2438b270f9fd153ab311b52916e13e2c6b47dffefa076f1d9f13172d53fa1aa446aad3ce5986e3ce6e1c4c20
SSDEEP 12288:0JDGS2v+fc6k8U5aB/Y9x3DI8JVBCeYjzq3:09qv+fc6VU5mEx3DhJX9Yvq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

1233213123213.exe

Path C:\Users\Admin\AppData\Local\Temp\1000060001\1233213123213.exe
Size 1.6MB
SHA256 abf906c98624ad62e09efe87fc2885ac8e0f4e36da9c73d38530ce027c7324e3
MD5 2d4e55ba08721363fb0d9de432de6c56
SHA1 41747ab85cf804fe22dad01f56a81cbed65aef1e
SHA512 bf6bbe97e8d52bc1aa937978634f0372e9ebca07ae9d4b39b1b3f92cc818120c3c2571071de0b1a382aa76427c3333248f86f8fc80f0e0be9321b71164e53630
SSDEEP 24576:09qv+fc6VU5mEx3DhJX9Yvq2vcdVKApjOgkeRXHOzI4mD9AB5q/:9xVm0KsjOgkwuEfD9Gq/
MD5 SHA1 SHA512 SSDEEP

Submit Download

1233213123213.exe

Path C:\Users\Admin\AppData\Local\Temp\1000060001\1233213123213.exe
Size 2.1MB
SHA256 9e1ee68334b41078287c9a4ba7fa3857ecf835c2426257e2a903fa2dadbdd9de
MD5 76219f839d9e1950f0f6c4eb45ae2e9e
SHA1 c3f8d252346833739daf0c7257ff800fe3587b29
SHA512 8f179eaaf471d1f76e289640f6a2b277b145371f07352d04940e89048e954b5f27a726fe04894048d81212c0aee4e5469599ce535e400ff000db74592fb46c75
SSDEEP 49152:9xVm0KsjOgkwuEfD9GqLToTy1No2IiXwb:J1S0TooVX0
MD5 SHA1 SHA512 SSDEEP

Submit Download

55555.exe

Path C:\Users\Admin\AppData\Local\Temp\1000061001\55555.exe
Size 655KB
SHA256 620bace13215ee69bcbdf8ac237798e8ab2ff052492303e2bac32d0a5a03f44a
MD5 167c40ace009f5d5cda541008804c3b3
SHA1 541bc50815f39227b9e01e5e4db6a08c02cedf4d
SHA512 60aa62eb8803bc2a8e95ea3ecadeb93e3859288d1b06a1d63451f48b10b8bbeef862c978143b419cf82d9f0fb6e1792cf82dd466f184173ca9bc8a7ffae09c15
SSDEEP 12288:N7D2B/BSBPPdVUQK6HeZ+0PRJl0cTPqvo4qMP/Ai:NdEQlXplvo4bPd
MD5 SHA1 SHA512 SSDEEP

Submit Download

55555.exe

Path C:\Users\Admin\AppData\Local\Temp\1000061001\55555.exe
Size 320KB
SHA256 37a395e5964a57cd448251bdbce17e95b2e27e538f37cc285db62f529e40b345
MD5 0a60fdae6f92f9105b863feeafa6693b
SHA1 55a4a16cec66ba5f9316e5ffc93f860e8b9df5a6
SHA512 cb6afe284d4480adea2a1bb5134b8f94a805f930fcdd3f07bbd0e473792970bba790c36439b1459d4bd19a0ec813bbd08de83e08b43bfcf0b2c18a012b9528b2
SSDEEP 6144:jH0oTqTADFwB/BSBrZ1kSm0+cUQK6Tjd/IH5qm+0PRJ/:N7D2B/BSBPPdVUQK6HeZ+0PRJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

lumma123142124.exe

Path C:\Users\Admin\AppData\Local\Temp\1000064001\lumma123142124.exe
Size 600KB
SHA256 1ac5eed2f7fc98b3d247240faa30f221f5692b15ea5b5c1eba3390709cb025c6
MD5 cad41f50c144c92747eee506f5c69a05
SHA1 f08fd5ec92fd22ba613776199182b3b1edb4f7b2
SHA512 64b89f3a3b667cd81f33985db9c76ffd0bb716ce8ed93f97c24d3c20e7236d91d02af9371a26d41f55b564702bd1f6fd7489055868fcd1610c04beb79ae8c045
SSDEEP 12288:1sKVfj/bA2NajHE88uelZk6sDEcEHPUF5ZwbJFhHPA7:lVPA228N7uF5ZwbJY
MD5 SHA1 SHA512 SSDEEP

Submit Download

redline1234.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\redline1234.exe
Size 896KB
SHA256 a5fb1a83241155a5f52e57214726e3363f7bf1343344945fe28ada1891cb6a07
MD5 7c4d4bcb186222b30cb6bd497b81d67e
SHA1 9d4aefaab25330ab90f809562e667a5490021022
SHA512 c9a0f1b5a57dfba865e7b87753342b43598cf2a0382450704bd6a17a15f95de0db9d56721ace0e3c46d7eda357b7a09b0c91ab4dc920818f1cd0a2657fec8e3b
SSDEEP 12288:A0+beh882wQuBA4Mnl6lHjUyNv6YNjiv6/oJDkDBl1nsGahvntD:A0+ehMlqDXCYNmy//ldkNd
MD5 SHA1 SHA512 SSDEEP

Submit Download

redline1234.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\redline1234.exe
Size 448KB
SHA256 c5fa55a379244ec9ffbf116a47c8dc9c8eb323615ccfb537385536f94df5bdb4
MD5 e71e19c3ae7ad556642b7384553bc690
SHA1 e5195a8419659e29a6f525dba3f3f2b1a327c373
SHA512 c82fbd7e8b0c39d4af71b706c6cf89983aefe7b1bffe3c51101c7087ab16a907aa4c8cb3ad383333f260be5c312c229ddd322038b50f73b7d21f1ccc4ef23315
SSDEEP 6144:ACdW2f3c/TbAjV2yeaj8O6B5Ju52stw/l0wuWLCvpNY6VFUP4ulMSz:A0+beh882wQuBA4o
MD5 SHA1 SHA512 SSDEEP

Submit Download

redline1234.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\redline1234.exe
Size 320KB
SHA256 203a50f4a1d6ba17bf85444c6ffc5ac421ee9dafb74e4a033457c3132bdb5ada
MD5 b6b8a2db4d1decc145c0fa2c06136c64
SHA1 fe8ed9e285c2a2e58b6be77fd17d7eda2ab1dd3e
SHA512 c16e316c15d9b9f934f701e09227e99b0cbcb8853876d5242b972cf6bbbd6d7984d945046cf68d239fe7979e31b465d827d1a3a9d86b7b17b307cba222ad8ac3
SSDEEP 6144:ACdW2f3c/TbAjV2yeaj8O6B5Ju52stw/l0wuWLCvpy:A0+beh882wQuBs
MD5 SHA1 SHA512 SSDEEP

Submit Download

dayroc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000067001\dayroc.exe
Size 320KB
SHA256 7ca97708f8dcfdb0a0583d9d5cfadeeccc83784fc4d1dc2918b44fcf20c89e44
MD5 3013fc4043f1b392a25e7040e0001c94
SHA1 77fe9f5064ad2b1c7e252c9833eff63a609b9730
SHA512 99ebc310fa3cd824f560b15cddf0c959667f70c280da049227b708b4c01e507684a69e3b986846b6b97d665799f3759c8c6630808a7379c9623a6dd5570b46eb
SSDEEP 6144:/g2/P7YFYpuHvy9MFIMrAzInJU8cMVB33wsh2Ea9S3vI5:YyoYMHvyunJU8cOB33wG2Uw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

mrk1234.exe

Path C:\Users\Admin\AppData\Local\Temp\1000068001\mrk1234.exe
Size 192KB
SHA256 d9b24c353ff07d2d589447b141fe9f6237f7672cbf6de1b5bbeed14192ad8fa1
MD5 2d5c24dc51ce930fd3665f5a8c4fb922
SHA1 35a3c99b900b022938da42071f22643a2dcbc247
SHA512 3a0ad9954474c73355d91baefca770aa64d168aebeea9f8ec8135c397fa3df9bdca0d1eebb88887c94a616940253faa789901af2df1587fef2d70edc233013a6
SSDEEP 3072:gDKW1FgppLRHMY0TBfJvjcTp5XoT+opmbIUWMts6h4d7z:gDKW1Fgbdl0TBBvjc/e+opmEUjsMq
MD5 SHA1 SHA512 SSDEEP

Submit Download

RDX.exe

Path C:\Users\Admin\AppData\Local\Temp\1000069001\RDX.exe
Size 313KB
SHA256 e7216d8b7084c0c36d90aefaf30bb7b6d10ae2ecae700889d459ed5ab1b26a59
MD5 f733785f9d088490b784d4dc5584ebfb
SHA1 6c073d4208fee7cc88a235a3759b586889b91adf
SHA512 43589b18333b0edcd6e300577f86de685058df5533bcbfdd3e30497aa76176008125fbd28deecaca5e6132c42cc5c0a583c34497f40dbe4ea577333eaebab899
SSDEEP 3072:kA05OJdM+K9F3OFq70W09SIg8Ikn2YSxx1m6MRqfjDv/YUeqiOL2bBOE:sma9Y40r8IIDxx9MRqfjD4aL
MD5 SHA1 SHA512 SSDEEP

Submit Download

daissss.exe

Path C:\Users\Admin\AppData\Local\Temp\1000070001\daissss.exe
Size 64KB
SHA256 d0785303b115d17e9402f4e597691ee10bf090a600dde304a2ae6c69878ae356
MD5 6fbf21ed22ac46155819df665fcbbdda
SHA1 8b5e5c46a73350ea2b313133693b454486739c75
SHA512 1c9ddb80eaada130b35a09b662e506da8f3c5cc67b4df491f788e1f7511bff50fe70a4a63061a5a40f42e28505c720472fa277036c11a18af84b18449ce94ccf
SSDEEP 768:2YgIkbKyiLYWfhCPG6wbWLgIej76lG+TRP19bMisPgX5VW5ElhP8KSB7+iZXTBQj:RxKY+T6KW5CvE4XWk
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallSetup_nine.exe

Path C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe
Size 128KB
SHA256 1095a31bb063141f27624d8ba197ec7584d4cf0d0cd4564f54ae992d61c18749
MD5 55efcf4980bba7ebb24fb73bded4cf0b
SHA1 925018c10e2c36eba2d1775459445a9e4faa5905
SHA512 110a9fccff460bf161b0de0ce2c4006fc7c0ffd984c3752dc924e3c81a964dd037b659cecc2247f4a39defdb66bb1ace38a3b790b606a3707c3ed1c8160ad9c9
SSDEEP 1536:M+1nMlEYUjuLsCOggWlLfSlAa/0U/P0sJ2/wW5AGgcfhL9rcRAnvxk+lZo5uQMyo:M+1ghLNrlSsrzgcfhL9eaJNZCNaTZMM
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bmbkkxy3.yxj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmbkkxy3.yxj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

rty25.exe

Path C:\Users\Admin\AppData\Local\Temp\rty25.exe
Size 128KB
SHA256 c9bd8d2ac6fed35669781eaea6e35eab0c77b8176ad6108236e0139d45c9d2a5
MD5 ce3033fe7ef081c32a5b7969dd6e3648
SHA1 8bba2a76423f38e7a30930a4c06b3840e693d069
SHA512 879b00a328fb0c0a2bc33564db292fccc18a91a6c4c8e31bf4e9b7e6a8f27b94ce994d24d0a4fb250a728f8b26d8e6f9b89a2ec9ae93ff55abfeff90bbeb1988
SSDEEP 1536:gmURLvkjWklKy3cLo5lJlaaCBdNMMC7uWjFzwTXxqXIC6UWyo7Humtd63kFekhUq:nURLpkl1Mo5rMBEuvxkIC6UWQKTFenq
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 442KB
SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
MD5 85430baed3398695717b0263807cf97c
SHA1 fffbee923cea216f50fce5d54219a188a5100f41
SHA512 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1
SSDEEP 12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
MD5 SHA1 SHA512 SSDEEP

Submit Download

toolspub1.exe

Path C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
Size 238KB
SHA256 a613b6598e0d4c2e52e6ff91538aca8d92c66ef7c13a9baadcba0039570a69d1
MD5 8c20d9745afb54a1b59131314c15d61c
SHA1 1975f997e2db1e487c1caf570263a6a3ba135958
SHA512 580021850dfc90647854dd9f8124418abffbe261e3d7f2e1d355dd3a40f31be24f1b9df77ad52f7fa63503a5ee857e270c156e5575e3a32387335018296128d7
SSDEEP 3072:ZWTAKLhXk2EYjcc9ct9cccX83bNryx6mshaIX7x5XIJG:lKL9EYjF9JccM3RdLwc3I
MD5 SHA1 SHA512 SSDEEP

Submit Download

u634.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u634.0.exe
Size 285KB
SHA256 bfc0cab4cfa151d368968640b7c9c30597d118782332e98ca7219f644975a356
MD5 2177dc2002a28ecea4ab593befd5e885
SHA1 8b5bdd26049137f1e697485fe4cf88031182fd98
SHA512 5708076d1768392adf7711e2bed6996cac52d52364ed9fb60e2075cfca7c7a5a9a09f935ae7e17aab2a6d165106770e82e4d1cfa3d0e872335159a93ef3fc2ee
SSDEEP 6144:rI+Py72ieJVszu9BJglIqIur7Dwufs1s6rxlVram1h:rI+Py7aJ7glfySs1u+
MD5 SHA1 SHA512 SSDEEP

Submit Download

u634.1.exe

Path C:\Users\Admin\AppData\Local\Temp\u634.1.exe
Size 1.5MB
SHA256 7c4e464c59aa9b1df7f37d5bd197f2fe05c724b7ec48817e813183a0624ac2e3
MD5 9d5e496d8857ba91ba83ecc2a1be7c70
SHA1 3f118bc510749562fffdc04b931c546ea457a736
SHA512 df8355db99252628c5ed94ff67d46c6db9cf733c7910097a4e19e61fcbd78b8e06f05c0e5f335dbe8b4a9f1cf555bde7babfd8a7b8ee42321159c7ecd48df79d
SSDEEP 24576:9T8Eb3E5kMG9S1UDWmAdd81rpEti0Bhboss/IBhAbGHNhR2:90oSiZh
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 64KB
SHA256 de0b07310345ac980b36a58042d094a44a1a7c6dfabdbca82840bce9b2d13d92
MD5 b6e852ed566188db3124b62cedf1f2b8
SHA1 292a10e3c8d01aa7d2a3ee7cbd2c95d8eaceff7d
SHA512 9b014543149bac0b34aab8feece9ce41f55dda94b7d207663bc5b1241e917284f25b016ddeb3d4dceb82289a55d94236f352fc0e8174599ffa81c2644583d04e
SSDEEP 768:s753UMChKKYX8qohoRm+MBfr9heER6FK1k/JbhwPKhsO8xGCb+ZzC76w0YzuPBFz:xEMQRmfekeWJn+Z+5aPTMp0bGxmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 109KB
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
SSDEEP 3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 1.2MB
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
SSDEEP 24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

qemu-ga.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
Size 4KB
SHA256 9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
MD5 a5ce3aba68bdb438e98b1d0c70a3d95c
SHA1 013f5aa9057bf0b3c0c24824de9d075434501354
SHA512 7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79
SSDEEP 48:68kM4rRDxNMk+wwnikZsFtRvlm4MI9BFipfbNtm:8vVDB+wwn0/MvzNt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\db\data.safe.bin
Size 4KB
SHA256 b82a5d60a8efc942313eddc2cdadf65d7f4ef9ba855efa4e7462bc5fe58826cf
MD5 622f4d95b5ce0ccf888efb1a548e1639
SHA1 3e8ddc3afe0fd14b7e4742e769a71698fcb725ea
SHA512 aa507d38bc311e085a9db767e49546e4b4e44bbf4eddca937cd1bfc4309b1e68e0f44735ea9b0699536d815a6087b4f02e09e2cc07d5fb67eb52a51537090d82
SSDEEP 96:ASFF9TbkiOazx/PPkeTDt3e5eS7nSY+DSY5fLVsoQ52+SHkC:A2vTbtOwJPBDNseSjbGb8hC
MD5 SHA1 SHA512 SSDEEP

Submit Download

8c80561b-dd21-47b2-80e0-3f76d826c2f9

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\8c80561b-dd21-47b2-80e0-3f76d826c2f9
Size 11KB
SHA256 23f8a81919308025cccdeabbee073e34411eec235fb90c2436423148e457198d
MD5 f2ab1e3cd1c9a0ce79ca3555148a21b0
SHA1 b1b5417909cee799dbc769f5bde42fa058affba9
SHA512 15282b3c30aa09f8da64e068671ead988af50106d65ed1207e55151a51ea08c443f5fc9edc76262c49a4437634a97bc75f325e2d867823e01c228515ce3aed02
SSDEEP 192:VCsAvKEITKb2WtPY33Lq9vLt53BR6yMLUjft2QTfM1M1+5KVvi5+wvbiL7ZViOdA:8qXp9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f4f6cf03-b1d9-4086-9b01-049e206e745d

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\datareporting\glean\pending_pings\f4f6cf03-b1d9-4086-9b01-049e206e745d
Size 791B
SHA256 5fbc978c9ab692aa8f9e27e231b3a776af5944ff63a709a6eb9c45ad18140e7f
MD5 f43e05cd0e2223ac86fde4f787c00bdd
SHA1 d09b29263779165abb97d2147207a85482a1c30f
SHA512 0234456e1af0de96ec13f883140308c5d5967cde61cb57c55cf049524bb59ff24c7e0f75dc8ca819a120167781afacddeda1ac2568f29edc2f39f18dabed3d4b
MD5 SHA1 SHA512

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
Size 997KB
SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
MD5 fe3355639648c417e8307c6d051e3e37
SHA1 f54602d4b4778da21bc97c7238fc66aa68c8ee34
SHA512 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c
SSDEEP 12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
Size 116B
SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
MD5 3d33cdc0b3d281e67dd52e14435dd04f
SHA1 4db88689282fd4f9e9e6ab95fcbb23df6e6485db
SHA512 a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1
MD5 SHA1 SHA512

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
Size 6KB
SHA256 b6bc57565dde3ce41233b1033a97d06ba288a6317c55970eb2715ec8ce53549b
MD5 5a14e784cb2ac9492519eaf71d717d0e
SHA1 261c087e5e4bc4c6eced5c643c2b816fe7df5ec5
SHA512 765838a73ff4273b7bf597850d9efdfb75e13b7bbc818360e75dc4b9ab9da8eceeaef138855de600903074e467824a2b829181e70acb5495549006b86e05e357
SSDEEP 96:xHQUnUTeqGqKdYsAeOTzS9PXAnpj2Hxva2zH4CfBw8HVmcD:aUnIRKdYsAenPXDxy2zHvBw8HVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs-1.js
Size 6KB
SHA256 9a27b9023b72311a385d6ceb20a3f3e8c2dee4770b0a5e4374b0ad8aab329fb5
MD5 67d119192451a1d6921949c3c35d63cb
SHA1 c3df7ae4ccb871a6fd50302ecafaca293e3cdc63
SHA512 daedf48c3141339c9b102ebfb2a248e2f76f0855a39d168636b4327095906ea9ca263fdfd64850f8617883bb845ec0d84cb2012cb5232ff835f1d37aa0b5f7fd
SSDEEP 96:xHuUnUTeqGqKdYiKeOTzS9PXAnpjsHxva2zH4CEBw8HVmcD:wUnIRKdYiKenPXFxy2zHUBw8HVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\prefs.js
Size 6KB
SHA256 c374665c2524e854331d9d91c126040510cf7a25dcc28a67b97de252f0589e97
MD5 c4c340774908167ba218710bd6c79542
SHA1 f421fbb409fb115bd18f763c2ea5286e25689c8c
SHA512 a207bae6c026383ad305d94af876aaf3dbd6188b32f1590ed326aeed1aa45ab5a3cfeaae33b3860483bbb060c9739013391328f8e639376a90c35efcd17becb6
SSDEEP 96:xHu5nUTeqGqKdYiKeOTzSzPXAnpjsHxva2zH4CEBw8VVmcD:w5nIRKdYiKe9PXFxy2zHUBw8VVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 37e40e3c166aa333971461c4fdd0dfb15abd082dba90226b7115155b9ecaf02d
MD5 fa753fa1d6a75426d9689315e3fe594b
SHA1 36fb5146d4744e99d203d00a0257d3b0c2d45d08
SHA512 3d15f523834e2c97ab8b0f60903818445e301eb231c6808b79746c481dbf43ed123455fa24a7eebf5b362656d178814f39de1caffe2d7a55974c0c70c0b3ac18
MD5 SHA1 SHA512

Submit Download

3870112724rsegmnoittet-es.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x3x6afp6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
Size 256KB
SHA256 3f2f9d3aba9e33c6f9bed1a46260e60b4f358842b29d0a691ab2db6d2d278f29
MD5 66602d41401e7a3e442f1f5adf8baeb5
SHA1 e46499b9af90ae609e019e185f5cfa3516acda96
SHA512 1955825587ae7dc850d952791ff828776da234f738319c26543d556031991792b22ef6a47b09131f3e61a3ffec9161b288fe38d97e7f0df112629a4bf7c39bde
SSDEEP 3072:WscHjeHM+2MZN3y3SO9vAUf+PIUoeL6uaAR88+8Q4:WscHjeHM+jZN3y3DUhL6uaOA
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Size 109KB
SHA256 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
MD5 154c3f1334dd435f562672f2664fea6b
SHA1 51dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA512 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
SSDEEP 3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 128KB
SHA256 690faf64a8be596b378ba2d88abc36d8e7542946321679d130a4de1c5ad6a0c9
MD5 43df78051fe29a0012b91f345844476a
SHA1 bb87e4545d52bd83a0045e1fdec007bb1bdd2692
SHA512 411ab55cfd2942d3e6b987ec59215361aac8a555116551ce0114b9b96ecf916197d18b10ac26612c9f90ebebab99559c5375a0c50c75a6fd14a3ddeefd7073eb
SSDEEP 3072:zakELIrQuS/xFCZ0GTJqMYENdTiSCrbLQ8y:zakELkQuS/aZhTJ9YYdTgrbLQ8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Logs.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\Logs.exe
Size 325KB
SHA256 73e5d1b5c0d2134f08a76a09b913efa9076bd492e509cd0346794db436c54d30
MD5 3058f10b2fe431d9f8a487a35cd89ba3
SHA1 adf31cfada940e96a02305177bea754d4ee41861
SHA512 4f59602a4f557a9947d15a1ed13d8e1b09d0ba3660130fa7e029219b21062a3dba55f7da6db0efa9f2f5ac5053dda51ed4e183ae171789374e239c4d7609eae5
SSDEEP 3072:oINTb07HYf51N7vuFoEvtWsAxD7399sj1XADxsfndqKnK1CxIqfDkWxNn2pU9f2e:oKTbKu1JgJVWbxnsj6GAKCCxIqfD
MD5 SHA1 SHA512 SSDEEP

Submit Download

olehps.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\olehps.exe
Size 313KB
SHA256 cf650d13eea100a691f7f8f64674189a9c13d7948e31468963e10a23726dc341
MD5 5ea776e43112b097b024104d6319b6dc
SHA1 abd48a2ec2163a85fc71be96914b73f3abef994c
SHA512 83667045b7da8596fad90320880d8d7c83f71a1f043d73f7b68a0ad948ae2e530a753d5c7943a096a307e696f8d9fa433025b30078af6d4530d1a2f2a4b12ed2
SSDEEP 3072:4A0L+56S+adN4OFq70W09SIg86n1XxLCbWMRqfjDv/YEeqiOL2bBO9:Qn8dn40r8IMxLrMRqfjD4qL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/724-282-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-267-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-446-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-270-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-292-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/724-458-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-301-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-293-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-201-0x00000000052A0000-0x0000000005844000-memory.dmp

Download

memory/724-200-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/724-490-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-355-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-197-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/724-202-0x0000000004F40000-0x00000000050EC000-memory.dmp

Download

memory/724-430-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-196-0x0000000004F30000-0x0000000004F40000-memory.dmp

Download

memory/724-312-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-323-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-337-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-500-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-188-0x00000000050F0000-0x000000000529C000-memory.dmp

Download

memory/724-436-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-190-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/724-401-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-343-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-368-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/724-378-0x0000000004F40000-0x00000000050E5000-memory.dmp

Download

memory/1572-136-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download

memory/1572-131-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Download

memory/1572-268-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-281-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-100-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-128-0x0000000004D20000-0x0000000004D21000-memory.dmp

Download

memory/1572-129-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Download

memory/1572-818-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-130-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/1572-961-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-684-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-134-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-135-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Download

memory/1572-137-0x0000000004D80000-0x0000000004D81000-memory.dmp

Download

memory/1572-138-0x0000000004D10000-0x0000000004D11000-memory.dmp

Download

memory/1572-151-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Download

memory/1572-504-0x0000000000260000-0x0000000000807000-memory.dmp

Download

memory/1572-148-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/1572-149-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/1572-154-0x0000000004D90000-0x0000000004D92000-memory.dmp

Download

memory/1868-70-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/1868-174-0x0000000003020000-0x0000000003030000-memory.dmp

Download

memory/1868-194-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/1868-112-0x0000000003020000-0x0000000003030000-memory.dmp

Download

memory/1868-203-0x0000000005A60000-0x0000000006088000-memory.dmp

Download

memory/1868-133-0x0000000003030000-0x0000000003066000-memory.dmp

Download

memory/2328-204-0x0000000004B50000-0x0000000004B8E000-memory.dmp

Download

memory/2328-177-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/2328-180-0x0000000004C30000-0x0000000004C40000-memory.dmp

Download

memory/2328-195-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/2328-77-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/2328-132-0x0000000004A90000-0x0000000004AD2000-memory.dmp

Download

memory/3156-5-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/3156-14-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-7-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/3156-4-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/3156-0-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-9-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/3156-12-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-6-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/3156-13-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-10-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download

memory/3156-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/3156-2-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-15-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3156-8-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/3156-1-0x00000000775A4000-0x00000000775A6000-memory.dmp

Download

memory/3156-19-0x0000000000330000-0x00000000007D9000-memory.dmp

Download

memory/3496-242-0x0000000003450000-0x00000000034AE000-memory.dmp

Download

memory/3496-716-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Download

memory/4168-783-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-23-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-30-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/4168-29-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/4168-28-0x0000000004A60000-0x0000000004A61000-memory.dmp

Download

memory/4168-27-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/4168-25-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/4168-26-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/4168-24-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/4168-681-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-22-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-91-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-123-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-31-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/4168-445-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-253-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4168-152-0x0000000000F80000-0x0000000001429000-memory.dmp

Download

memory/4272-791-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4272-784-0x0000000000400000-0x000000000048A000-memory.dmp

Download

memory/4708-198-0x0000000000EE0000-0x0000000000F34000-memory.dmp

Download

memory/4708-199-0x00000000731C0000-0x0000000073970000-memory.dmp

Download

memory/4708-231-0x00000000057F0000-0x0000000005882000-memory.dmp

Download

memory/4708-300-0x0000000005990000-0x00000000059A0000-memory.dmp

Download

memory/5312-377-0x0000000001FB0000-0x0000000002039000-memory.dmp

Download

memory/8468-581-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/9540-683-0x0000000000400000-0x0000000000495000-memory.dmp

Download

memory/9540-693-0x0000000000400000-0x0000000000495000-memory.dmp

Download