8fb5890f75d501936e90d1891cd97c8b23396525842fd741f9b9a441405cd01f

Resubmissions

26-02-2024 18:15

240226-wv4khsdb8t 3

26-02-2024 18:01

26-02-2024 17:58

26-02-2024 17:47

26-02-2024 17:30

26-02-2024 17:25

26-02-2024 17:07

26-02-2024 16:42

Analysis

max time kernel
971s
max time network
973s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gato.jpg
Size

54KB
MD5

cd869039e351b02dde534759ae627caa
SHA1

8c227c8532a3106c82009117500a53fceb8adcda
SHA256

8fb5890f75d501936e90d1891cd97c8b23396525842fd741f9b9a441405cd01f
SHA512

81a5b30497bb3cf7b6257728ef5f04b2e45d1ec23e159035210292b13514a82313e19c68878f50bd10a9382ed5b6a83c6356d2d2c0607a79ec2e8afbc9bc3fc0
SSDEEP

1536:g6taN+v7AZswe0Q4qKjLkvqwWsXcWQeldDrVh5Bh0K4:QEAneazLaMWQWdDJh5vI

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	Free YouTube Downloader.exe

Executes dropped EXE 7 IoCs

pid	Process
556	usеrinit.exe
3504	usеrinit.exe
1092	usеrinit.exe
4336	usеrinit.exe
2840	usеrinit.exe
4936	Free YouTube Downloader.exe
4044	Box.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	activation-free.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Antivirus.exe
File opened (read-only)	\??\N:	Antivirus.exe
File opened (read-only)	\??\X:	Antivirus.exe
File opened (read-only)	\??\G:	Antivirus.exe
File opened (read-only)	\??\H:	Antivirus.exe
File opened (read-only)	\??\J:	Antivirus.exe
File opened (read-only)	\??\K:	Antivirus.exe
File opened (read-only)	\??\T:	Antivirus.exe
File opened (read-only)	\??\A:	Antivirus.exe
File opened (read-only)	\??\O:	Antivirus.exe
File opened (read-only)	\??\Q:	Antivirus.exe
File opened (read-only)	\??\R:	Antivirus.exe
File opened (read-only)	\??\B:	Antivirus.exe
File opened (read-only)	\??\P:	Antivirus.exe
File opened (read-only)	\??\S:	Antivirus.exe
File opened (read-only)	\??\V:	Antivirus.exe
File opened (read-only)	\??\W:	Antivirus.exe
File opened (read-only)	\??\Y:	Antivirus.exe
File opened (read-only)	\??\Z:	Antivirus.exe
File opened (read-only)	\??\E:	Antivirus.exe
File opened (read-only)	\??\I:	Antivirus.exe
File opened (read-only)	\??\M:	Antivirus.exe
File opened (read-only)	\??\U:	Antivirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
86	camo.githubusercontent.com
87	camo.githubusercontent.com
101	raw.githubusercontent.com
102	raw.githubusercontent.com

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1432 set thread context of 712	1432	[email protected]	114
PID 1944 set thread context of 3160	1944	[email protected]	122
PID 1496 set thread context of 2632	1496	[email protected]	126
PID 1968 set thread context of 4740	1968	[email protected]	131
PID 4776 set thread context of 904	4776	[email protected]	135

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnVi\virus.mp3	Antivirus.exe
File created	C:\Program Files (x86)\AnVi\splash.mp3	Antivirus.exe
File created	C:\Program Files (x86)\AnVi\virus.mp3	Antivirus.exe
File created	C:\Program Files (x86)\AnVi\splash.mp3	Antivirus.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	activation-free.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	activation-free.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	activation-free.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	activation-free.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	activation-free.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3880	888	WerFault.exe	159

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main	Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	Antivirus.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main	Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	Antivirus.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{3EDED10A-51F8-4AEE-B0BC-9121D59F3BB6}	Antivirus.exe
Key created	\registry\machine\Software\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}\u = "3"	[email protected]
Key created	\registry\machine\Software\Classes\WOW6432Node\Interface\{f456cbc2-bfc5-6f65-aca0-986e7eba0308}	[email protected]

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
316	chrome.exe
316	chrome.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2988	taskmgr.exe
888	Antivirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe
Token: SeShutdownPrivilege	1676	chrome.exe
Token: SeCreatePagefilePrivilege	1676	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
1676	chrome.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe
2988	taskmgr.exe

Suspicious use of SetWindowsHookEx 27 IoCs

pid	Process
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
3748	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
888	Antivirus.exe
3200	activation-free.exe
2904	activation-free.exe
888	Antivirus.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 784	1676	chrome.exe	86
PID 1676 wrote to memory of 784	1676	chrome.exe	86
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 5008	1676	chrome.exe	88
PID 1676 wrote to memory of 4384	1676	chrome.exe	89
PID 1676 wrote to memory of 4384	1676	chrome.exe	89
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92
PID 1676 wrote to memory of 664	1676	chrome.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\gato.jpg
1⤵
PID:4600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdf069758,0x7ffcdf069768,0x7ffcdf069778
  2⤵
  PID:784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2912 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2904 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4656 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5276 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5400 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3868 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4072 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5760 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 --field-trial-handle=1908,i,11234019543952923416,6511978928215620517,131072 /prefetch:8
  2⤵
  PID:4380

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:836

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2988

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1432
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:712
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  PID:556

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1944
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:3160
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  PID:3504

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:2632
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  PID:1092

C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus 2010.zip\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:1968
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:4740
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  PID:4336

C:\Users\Admin\Downloads\Antivirus 2010\[email protected]
"C:\Users\Admin\Downloads\Antivirus 2010\[email protected]"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
PID:4776
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  PID:904
- \??\globalroot\systemroot\system32\usеrinit.exe
  /install
  2⤵
  - Executes dropped EXE
  PID:2840

C:\Users\Admin\Downloads\Antivirus\Antivirus.exe
"C:\Users\Admin\Downloads\Antivirus\Antivirus.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3748
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
  2⤵
  PID:4452
- C:\Windows\SysWOW64\net.exe
  net start wscsvc
  2⤵
  PID:4884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start wscsvc
    3⤵
    PID:1340
- C:\Windows\SysWOW64\net.exe
  net start winmgmt
  2⤵
  PID:1048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start winmgmt
    3⤵
    PID:3080
- C:\Windows\SysWOW64\net.exe
  net stop winmgmt /y
  2⤵
  PID:2836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop winmgmt /y
    3⤵
    PID:2596
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  PID:2392
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:4868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:2444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3ec 0x2fc
1⤵
PID:1828

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\00ef64eae2304206bc0ae8ea25fdff38 /t 3060 /p 3748
1⤵
PID:1968

C:\Users\Admin\Downloads\Antivirus\Antivirus.exe
"C:\Users\Admin\Downloads\Antivirus\Antivirus.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:888
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  PID:4116
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:4376
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
  2⤵
  PID:904
- C:\Windows\SysWOW64\net.exe
  net start wscsvc
  2⤵
  PID:4232
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start wscsvc
    3⤵
    PID:4576
- C:\Windows\SysWOW64\net.exe
  net start winmgmt
  2⤵
  PID:2504
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start winmgmt
    3⤵
    PID:4396
- C:\Windows\SysWOW64\net.exe
  net stop winmgmt /y
  2⤵
  PID:1944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop winmgmt /y
    3⤵
    PID:2260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 888 -s 1848
  2⤵
  - Program crash
  PID:3880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:3440
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:4336

C:\Users\Admin\Downloads\FakeActivation\activation-free.exe
"C:\Users\Admin\Downloads\FakeActivation\activation-free.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3200
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4936
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
    3⤵
    - Executes dropped EXE
    PID:4044

C:\Users\Admin\Downloads\FakeActivation\activation-free.exe
"C:\Users\Admin\Downloads\FakeActivation\activation-free.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 888 -ip 888
1⤵
PID:3696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
dcebcc85f3b863b6dc595395e457b42a

SHA1
295c1d1938a675df7a2eb0964e2b5a4d4bfd8aed

SHA256
f07c1748e5a0577b6cb26e53c1758b5cd61fb6fdb1a5ce6ab21b3b9e294209f0

SHA512
c5ad9cd62a419554c844781b806fafc7303e1e3dbc6799878240ff1b7fad344b8fc96fda9f2e536525e48360e1e80248a040548d9ca69e42b43d23e27b73b88f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9855a750230d0d0a943673b77555377d

SHA1
1460419e7db87bfac082ec08477bd86ed12b5cf7

SHA256
4f248f3de193f1e315eaab588a8032a86779469fd1dbfd19f8976e56770357a3

SHA512
db6dda0acb72b8f0b46154d7142430b9556237b24911f67629cb98c09f7b9ca01fb8863a67eea1ef4b96490111ce266c3b9eb5b274c3bda3da4aca08cc69447f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
4b8dc31d356a670728c67c08fae4872c

SHA1
aad50b1b13c050998cfd017e60de8bb20744c354

SHA256
5fd59485dc32d3890cd6e3bfe82ffd02b40016220cff2b4038892f74c4ea38b1

SHA512
2af4f2483e433b539c1eab95d89a49685b557d5087bc0f3ada62327d049add5a2cf6f360198d78b947c69362a363b60a584a2d26d3caa6d2a8870d170daee10d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8aeae7d69e6ae929f4010609a9a79567

SHA1
fa1105afe76f715929c280ebc667d2a4fd7925c2

SHA256
9612cb9c3df952a34a92e57f2e66f9b17127cfe560ffaa11cdf13b513f42073b

SHA512
19fd20ba96e27d1aed0462f319db66878bd2646e35409a074da8f5a67b0495b24145a7726f7cfaf877404c616a11ff689b44a2450e383f8619ee30895285cf95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
8cc06a7a3e899fb998f65b7fad8d3e73

SHA1
940727b73c2e8a6e93ac408e2802fe094546ce28

SHA256
3fad57123d69d80dd7172323f409853423e37ec88f051e3bb29e1666cd1cdb80

SHA512
c2ce7ecf1232b0b944f4f5e0c8fafc3523dbe49fd18602b5a4beeaf753cc117013587238067474165a1723075fb6df870ceca3337cc45e2a36629f286d30cb16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
34c41ddd7c296a8bc20241fbe7821094

SHA1
60c5f9d41ce29b2f1ea4cb3886aeb4cceb4b7acb

SHA256
419b6b9689c3b14357f5d63a9453917c8db5312a906952d2b1e9b94d28be7702

SHA512
9d8fb31c62ed5aade8444aac12fb4e4c261d7172b6b50a2ca4066622fca4f663f2da22fd64493c2d5960a96c2610c620a7622e9ea1d5e72b16c01513a7c5b343

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
2071b6448786d0d7c09b0258569b3ec6

SHA1
712cc575d82293bacd66395d417925fcef957a84

SHA256
8ba91ea442b8cf34ab9c0d8223ceafdd267b77913e96ae3803eca12b0fefff79

SHA512
e738b434cd7b41fae5a3246eb44af9294102b9f8e91e786208442a882cf51886e4bc2277346fa65fb8030c4722519582029a02a4380751cbd8b68bb1150e94e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
024ebb91289637e69c9779a219ae4bee

SHA1
53ca2307650e6eb433954e6c3e875dcefd6d4c26

SHA256
c59c38a46413a7b619eb07e4570c236dbdf09e68ecbd10e0d3aaf095bbfe87da

SHA512
87a0fb5dea4b8d4588f9829a6495fe96759ddc6bd98cf4524832cc99e1ff65dcb30801241cae532e2b7104a55b4fe1da066e09f37d56c5738fa6dc203d28474d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
4beaad1028a66bcf5add4b8bb69f8c5a

SHA1
29c272b1371e045c89fa81d28f343da63f525b08

SHA256
cb98a2cce7f897263e36901fc60b592486d313529533b0ade8a7079e8781e356

SHA512
d19b67945e23f8bf58cd54352cb3fae37a8b521b2ace0abff6258d21b7a8c0540fe4dfcb8a3b9e12e01360d98ccdc846a598cfa0f6ac1ceaa985dcbe74992bb6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7257e15a69fe4405a1eb06d847cae798

SHA1
5153913413ba532aa842c0ca0feb3e7c149e7815

SHA256
3e5ca96809153de2ebb2e8ecb4295717962b03762d7517f10f7fb7047f7beb05

SHA512
8515826b28e16e0ce73ec7d9961b4d0f2f811da0b368ff56d43c6fb4bd9d32bcfdcd0e4da7156f061a2eb4a06a3a92430ff1057d311dc0eccad0f2ed24a9751d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
371B

MD5
fa704328f2e5be13bd8620cc7bd713bf

SHA1
93a016707185447ec38d3d5ab04f3aa4cb8d6efc

SHA256
901cb2282e898e71c53d87641edd356e954732bedaa09683e8a55b219e3fff11

SHA512
d847c03bc9efa2752fddbabc7ee0b08c681d7aa970ebd051d0e7cdfb820e6c00ee3da6f3a852bffc595546e861f09c4048caae4adf846fbd7a36b9c0f334ef1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
874B

MD5
fdeb8c6ec33bb6988c1262699d2c24e7

SHA1
67de6afce03143c41ada0eadf065c3109e3a5719

SHA256
9bf6eb8cba35c0d54c2eaf262efebf5d840277731d9389d315bb92ce2fb7f848

SHA512
900ab27c08b6e233556a6c9771bce208fd3b46e8256e1984dec3b2aa8892d08af32d69b4fcdb455af3c28b4745d2cac3ed4b333711c31058de2846a662a6006f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
ab00d056fc61f4acccba58efdcde2560

SHA1
3bae29620d9cbb1d9fc9b5e7f6a93b3f11cac6f9

SHA256
7e9b790efc584d645376a3f91e0f477d047dd356f7d9e3bdaf43cebe0d57a8b8

SHA512
00142533cb7c8ae55390349b2b863226b904cf0a76c5cfd5e0a22f82225300cd0d69c3d43a1b99af5d61787e551e3e77748596ebac68151c6cdbb48c39ff9426

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3282c19a8341302119713aba6cd4c0ba

SHA1
0445935a44a63e42575ded8ab87ce4085236614d

SHA256
14c5b6874cb63eba02996bad6f1210297ee67bc785b7a867236fb033103465da

SHA512
cc0151c88517451c53688681c559433dd8ebbca822828ead1dbf6f1cc4e99701a119b6a8f748ff209202abf4f03bff14a390983753e6441c44326f2884dda92d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
25c8c97622812537a8d7823c97a81394

SHA1
32f00e8bc3fbb7b67d2c8a36f63f971877b0e776

SHA256
f3fe1088a4da18294443514ede3ba75275ec23f179868aa1bd4910e66187618b

SHA512
0fa9d97f7579cf5cc8fea7144d8000f8970d12f5807945c5d81669ca4bd78e6e924848a54dee617062eab8e9256ac92257f0dbcb2b16f99dfb526610d5e88915

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4a7f00e0271fb589239fe6ca4a5f9bf0

SHA1
e00ba21de86f6892dc2754f792aa5473557f57f9

SHA256
5ae0b50e5e30ae8a052faac4d46684d1f102acbe76d489a0a40f1a813e681411

SHA512
1bcaa4fdf1f51f69fbcfe3342fb73e569598e8affead3fe2ab8a767841aa35c288ac8f7abb520aa1fad57cc8d90c1ce3c5b3ecf6adc8bee834f850a63c6c6c14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c9c1c56f336838f9ff1a4f824ed43fee

SHA1
e4ccffafb6a23563a56aab3c2db69d307719d746

SHA256
5754145aac4144321d13fbbfecce802b6c98824dd36207e53af9ab7fcb5b9e76

SHA512
ec15583800db724aab013a232d98b0aca65a93636bf17db26b778f28be811ac8dee2205ff64c82a759c9b0f3d6099e51d98fc96350dac4c5d0a2060a92b79aeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
51a6e9c44e66b5ab84dadd55979d9a3e

SHA1
922385a645656ba728dcab2d5c6dab85bf249676

SHA256
83b563f96102ec5cc3772a772a3772cdc4fe67f8c8f5ab9060b8f35587871f9d

SHA512
d16dd74152ea91b71687c1bcf31cbd2c07fb7d498aa4b95202b137e642125cabea3fc49f53c97dc54097fc1b20013d919963eb6f8ece2b3cab0fb5f2a18cc476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d5adbcbe1a3c4b39836198809bfceb54

SHA1
5fb9a46f1955fdb9a48a444203b65e231b6af76a

SHA256
9eab95739160dbc16dad8086417855ced9b1366753c6ad4a91a106e913d7629d

SHA512
48a0470a1de6e97dbd8b1a69400185c9a9f0df531720f21774e15edb585b69c68a9ca573a655dde0bcbccfb07c0fc7f7148d201b57ab5886565058d5455cc45c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4ec0460a8f288335824204c9533c6615

SHA1
3f4eedbca7584872dc9e54017b387d952408d1d6

SHA256
f6f88a451895679129ba17b2c349d2aa63a9e693f4a4a2d16d028d4411d4c5ba

SHA512
3763562b005933d91500873c47e932f82573d3a87388f489fd45d1d78038c4d812ee13b87eff3febdf686d3b94ce92a6e2f5031d12f8b01f4633a15e5a657221

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
64d08ff05b1cc73fd0c9fa1701076b2d

SHA1
c96d6be5d2a8d39f2fc76a4e0ec5af5cc2d2c73e

SHA256
5db8365b8629f8ec8f58f97361b57008e2619b8a5fb0d255766b04bf0448b9ba

SHA512
e0e09381c08e04a52faa7bccfa42dd47b594dc92820847430f29806f0a1134f031e9456bd6c4112bc94fe7cb1b0bb3b94cadafeb174928781dda01e4aa7e56d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
65002346986e96ab98607d66756f9809

SHA1
c1cf783fcf79ab46a6e8a3c10d69138a471c7793

SHA256
167aa550b66c126bfba017cd40640feb16678b313b59c2b08a449fdba38fd0f2

SHA512
53535bc6d2492a5de4d80f5ed4932fe32b88cac0bff60336ea34bd29950b953a99d30dd7785045cab3961aba3cc41fc30b41b9fa591d95be37d3a29b92fd8482

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
034c6490bf23a7c42a21a1c8441512a1

SHA1
15d9132480cae4c0339a03df4bb93cfe6ff741fe

SHA256
95a77ecbe7f823fdde5c0bbc64410b2f7be34d83903c38c3c7087b0680ff68e0

SHA512
83d5c27d74995002beb2c1f7d4f12886fcd5427f752d4db9fd5a2cb11edfb08421d124d4738045631fb0f5a0d4f5de3b5ed66cbb799e7d44461116d9dbd70a97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
68cd6ae744b38c4357bb0c20fc5946d7

SHA1
e9ca5a75211515031331942826508b7d5b424e92

SHA256
cedb6521cd802d0befcd4dcb9b739ab61600ffcbbe80243fdec6a6ffe83382bf

SHA512
ccbf42e341a3317374bc05aa1830560ada01dd1ddf722909ac596fbc09727727e99bb0ed4621b5d9d48c32a463f1a0d7a196e55a6250022249f967e23b3bdc91

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a8ba89f91bdebc241ab7b9a84853a8b9

SHA1
2ea06dbb078436fb1f60862382e99087465fdd56

SHA256
32a433a4db8e6e90789f78d9697833dd087093466e23cadd54e6a89d99cedd6e

SHA512
0dce29d9965e6210198d795c1f2f28cc2bf5b4b5d1c325858b00d730ba3e3e9d1fd165a9a8d2215c6e78b5aa8924fc5d8726fae294092564775ba96568b6a088

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
9ddbdf84c62c222897cffca15b3eb3bc

SHA1
cf2d5e11ca3842bcde9bc11b3e16b41a0fb05723

SHA256
16b21866f2a66d81bb46d4531e0d8c18f0694813be6d80aa271d7ece0b7bda44

SHA512
e3ff903a7c21417f28d38378c46dbca0525f7b29e3f97bc347fb9b969f3230a82b17fdbd64375d784f366bd938857a464dfbbce03477a24658662a437369d42c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
dd6b4adf4a5ec55a30942a90d14df8ed

SHA1
6b9341ccfcad30f4d9a332fb266a4d61b57e0e69

SHA256
50214ff9aaeee24fc72b53b9f231727bbf96fdb1f36fb35bd5d9eb02ac36cc01

SHA512
618b51a8da3070e36f2bcf7a4801d684370145706b79ca33be9a20558a158fa8c2978348e8ef5b401047935202f154c7cf634ef9eb847729002ee4541ec1c38c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
cae3ab15d303f9eec9ab83d4aa70f129

SHA1
208120b53d080ef735d9bbf11c7c5b505f4f533c

SHA256
9300c4bc4765c48387d7f920f771f8d7c1a446f470c624f4b80322e1e74efd07

SHA512
5385d5af87893d5408e7c4ce24c0b132cdb5629d6edde9c6f98817f6febcbe27554d594d24e3c64a484590a08536a59eab814b7f7ce702aa2cbb88cd899e6193

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
99bef64695a34fccc6b6b80af8ff0b4b

SHA1
e53940a8ebe2dd8a281b2dbcab3a83f88a8ed9ec

SHA256
8a848bf08e252c26cf3a7728f16225d630ad0eaeae44700ff54ad7d10c3f6c95

SHA512
d7a73a232a208e48c9d6a706cd54b5dab6d014a7f53b5e1b64a2d6e086556fe38db50fbbf1e117b8d1701fb7d1ff0ac043e6c21fbb19b4ca46f89ea07dffb790

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
de9fc4ecc2380bb809de68ee61d20197

SHA1
719cae95f5ffd44a3eed5092b933d363ec9e53a9

SHA256
4120c347d384bd127279cea3194c89495c45cad33f68ecb7d2026bfaeb6902d0

SHA512
02514b6291e76bb9810626148acb9ee5a5a799fe52641fdf3da54cfcdfd5bc31711f31d3093c618c8368ba70eeb225bebadb950bea2f65aa0318a0bc1e60dc9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6edc3ccb63046417ba9885c342d0d963

SHA1
7bbafa79e225d7fa339e452b8c6839b6761c1161

SHA256
b2c499714de8ccc2c8cf4c32f010028d61cafe65a739cff0d0a5a7178367813e

SHA512
c712f80201b6be576a65fa081e2cf52424ea92dd0a16b9ac672555233aa406d8e89cc24610f28057d329cb54ffc78f07fbb57de52fe216c4be5870555ee4fd1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2c4fb1b65a1e22f0c7b7aaff8bc4ef86

SHA1
2e119014885daa2e74b5f9c900a6ab0ffea077fb

SHA256
46890ebf24d27d612e6062ee79b9ff52cc4777cb974f860fe6bcc60b6c6d1e72

SHA512
500c53229c1b39c2fe23f8630bc8eb79956bd3ee170dc3fed6bdbbe1cb6ee5eeda9931aa5350ec62a47fedae7cedb180087c8ce7aa404ccf41851bc759859c56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
253KB

MD5
17f55c6eae1307e16385e1552d7a29d5

SHA1
b7913529a2ef5d364e8a65d9095d166bb6057f5a

SHA256
2a7cbe81a4b37e236dfab36468b61c7d38512414ae3523e19a488be3d1f6e4e1

SHA512
c1c8f8270cf0cd510042ad51445449bccce1d19865ec4a7d1ff2b3817ec6283c180101759a28186537564d5c2fac0785e36fad8253dc6761ee2f46e25ddc17d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
c28b2203ceda8db8bf52a77dcb1c1261

SHA1
25fdd4a30c6eb9a4cdd4202782bc3db1842535a2

SHA256
d8550af0a7de779d86cf1b95270d5bf7255557fdeaae97a181013176a5255689

SHA512
b33b4c7bc34e0a43259df6324dfcc700528356f2615391e2d2b762e46d4be808a2c74108e14c0675487c0c7f3bd60e0c4a5011f347864db451a08c13b6e8ca4d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe596279.TMP

Filesize
96KB

MD5
5222cb352658f79866be7dc865a27529

SHA1
c6eec2889b5d4aaca0e38d96a168dad8614d1bf0

SHA256
8cbf702a76fdbf9078d6287e5070665a868d151fe8268fb7bde2866db60ce87a

SHA512
1b41621dab72f5ebec38fc64a4380e4f732a9f0a232f0bfd536827d0c45ef5617adf8c9c4af7d5949a1c408d87ff9ecfc292d32480d03a11b0712aa3a4516037

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

Filesize
36B

MD5
8708699d2c73bed30a0a08d80f96d6d7

SHA1
684cb9d317146553e8c5269c8afb1539565f4f78

SHA256
a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

SHA512
38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof

Filesize
443B

MD5
7fad92afda308dca8acfc6ff45c80c24

SHA1
a7fa35e7f90f772fc943c2e940737a48b654c295

SHA256
76e19416eb826a27bdcf626c3877cf7812bbe9b62cc2ccc5c2f65461d644246f

SHA512
49eed1e1197401cb856064bf7fdbd9f3bc57f3c864d47f509346d44eed3b54757d8c6cdb6254990d21291065f0762d2a1588d09e43c5728f77a420f6a8dcd6ea

Download Submit
C:\Users\Admin\Downloads\000.zip

Filesize
119KB

MD5
d113bd83e59586dd8f1843bdb9b98ee0

SHA1
6c203d91d5184dade63dbab8aecbdfaa8a5402ab

SHA256
9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

SHA512
0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

Download Submit
C:\Users\Admin\Downloads\Antivirus 2010.zip

Filesize
688KB

MD5
1876b2d886ec392d71f37423dfef0c11

SHA1
af78db6206cada4f780f030d45fcaa881f892a99

SHA256
61ff034c476d4060fbea6debc5f84494cf02f337a9a897ddb6b3eb3a28c16406

SHA512
9070d1c35ddc045c7d5aa7938d231d139437c0b363c72a71d1edf3b77ea40484869c92e3dc9b021c2897d224d3f2b6bcf64b4dcf44149da9d6cc15d4dfa9951e

Download Submit
C:\Users\Admin\Downloads\Antivirus.zip

Filesize
1.3MB

MD5
e1ac4770f42bac0e4a6826314331c6ea

SHA1
66493386ad995819871aca4c30897b6f29ab358f

SHA256
eabf7fdd31c5838d66ccbc3ca52b0f6eaf8120f83eed43f372f21e4d31734b73

SHA512
e691103064075b24b1fc2f5b4d1a1c2701ee7c5074c96a7faaf284f975de3d7309e7a3ea9b80fb6a2d8950a3b12aceb22e3516777508cac70cba8be48527f55c

Download Submit
C:\Users\Admin\Downloads\FakeActivation.zip

Filesize
275KB

MD5
6db8a7da4e8dc527d445b7a37d02d5d6

SHA1
4fcc7cff8b49a834858d8c6016c3c6f109c9c794

SHA256
7cc43d4259f9dbe6806e1c067ebd1784eaaf56a026047d9380be944b71e5b984

SHA512
b1b4269da8a0648747c4eee7a26619b29d8d1182fe12446c780091fef205a7b5e6fb93c9b74c710cca5d2e69600579b9d470e31a32689ecc570d0c4bbe4fe718

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\System32\usеrinit.exe

Filesize
139KB

MD5
4acd14244d2cd76d06939163127cfb10

SHA1
75f3e3c764f7d20c9950f5410f753f3210bcc2e7

SHA256
29b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb

SHA512
001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031

Download Submit
C:\Windows\system32\wbem\repository\INDEX.BTR

Filesize
673KB

MD5
3d2d588c151b15d8a1c2012b96ae9868

SHA1
3e89d2b6e0a442b770c992018e6e2bcfce9a4fd0

SHA256
94de2e50781416805a7b179ddb6602c7144d8e174459c781c637bea43c5f4665

SHA512
6b52ea63465fb0ccb6e4715e1461bbee2fedf0895229003966c7bdbe82ddb357809665a1aa5b8c921a74d67ceb5657151726eabd8311cec9d11131c344cce347

Download Submit
C:\Windows\system32\wbem\repository\MAPPING3.MAP

Filesize
207KB

MD5
761da05ae49e9de5f0542660dff0dfd0

SHA1
5ae2554b6bb292ca09af3da6015bb5df3e9ac71b

SHA256
e387ecf650792e70389cc8c35e07d36c71b9ba3011d19853fffb443d6e5d3526

SHA512
22fea9079091afdd657ee13a815153fc1f47b3e1ea43f54796919fe43eb013cbe31428f28892c2948137b29543fba472c9371152909d41af104fb6db18574897

Download Submit
C:\Windows\system32\wbem\repository\OBJECTS.DATA

Filesize
960KB

MD5
4446d739e754d7c18e4756018e8b4cda

SHA1
38b504475ef299f0602c54ddb2eacec785c194a1

SHA256
c1ca45b95196c6549dd5f9b5ddc5aca5f1c0b260ea4b81c41a16e7e2bb5bdeeb

SHA512
4c775833db291150b292bf52baa3f8de7059aa757cce768b8a66bf115d6c7076fe942ba50dabd955f1081c8cdb1a34868e9b74d54b14164e04f19ab3700b536d

Download Submit
\systemroot\system32\exefile.exe

Filesize
115KB

MD5
72178bb0f9674f0ce0b6b188d1219266

SHA1
ae3c43c7846c0ef977fa90991e1c366e34ab671c

SHA256
09cd3c864182b703a1384a15e60424c0ee8c82c3fd19f197c391a0e3ec5bd16e

SHA512
d9004c1b8402375c92690525f06ae83198bb929bb18dfc46fda9036a4054ed9c38637438b13ecc2566f98f2a8ac297ec7f0151b63a59c4f7bbc2ab8f7b6d779e

Download Submit
\systemroot\system32\exefile.exe

Filesize
96KB

MD5
b1796cfdb305016424bb318507a200d9

SHA1
4af167daf44839f4e1990e77608980379aca6e1f

SHA256
573b3aab910fb7edca1b27b157b025e9f4011e1fc0000bfbdfa47818d9f20f0f

SHA512
54626e4cd35ee00df8ca41cebf3d90d8ff656b5a2b6d78bc3aa5ce611df0b5403cb517ed6efc1babeed19931436ceeaa788440fa6a86e6e41bbb23e9981b7876

Download Submit
\systemroot\system32\mseeeeee.dll

Filesize
718KB

MD5
8736c2a37ff0adf6f03d94bb34d1f784

SHA1
e4867b136e100c9d45f6adea593c9a636134f308

SHA256
dbe318e7c72f9558f836c920510a5245ae5af29996b62f661399ce3724458ec3

SHA512
2bbb22540e6ae0ebdd7c5303f67fb3911025a9f8f68c1c192edf5247a66bff885e292dded093d4522488b9a98f5bb00f24b00374e8eeb219184faacc95818848

Download Submit
memory/1432-488-0x0000000000760000-0x0000000000960000-memory.dmp

Filesize
2.0MB

Download
memory/1432-496-0x0000000000400000-0x00000000004C4400-memory.dmp

Filesize
785KB

Download
memory/1432-487-0x0000000000400000-0x00000000004C4400-memory.dmp

Filesize
785KB

Download
memory/1496-524-0x0000000000850000-0x0000000000A50000-memory.dmp

Filesize
2.0MB

Download
memory/1944-513-0x0000000000400000-0x00000000004C4400-memory.dmp

Filesize
785KB

Download
memory/1944-517-0x0000000000720000-0x0000000000920000-memory.dmp

Filesize
2.0MB

Download
memory/1944-531-0x0000000000720000-0x0000000000920000-memory.dmp

Filesize
2.0MB

Download
memory/1968-539-0x0000000000810000-0x0000000000A10000-memory.dmp

Filesize
2.0MB

Download
memory/1968-548-0x0000000000810000-0x0000000000A10000-memory.dmp

Filesize
2.0MB

Download
memory/2904-753-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2904-755-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2988-473-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-483-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-481-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-480-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-479-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-482-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-484-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-485-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-474-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/2988-475-0x00000215E22C0000-0x00000215E22C1000-memory.dmp

Filesize
4KB

Download
memory/3200-739-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3748-647-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-650-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-652-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-653-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-644-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-645-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-651-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-646-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/3748-649-0x000000000AC80000-0x000000000AC90000-memory.dmp

Filesize
64KB

Download
memory/4044-785-0x0000000005010000-0x00000000055B4000-memory.dmp

Filesize
5.6MB

Download
memory/4044-786-0x0000000004B00000-0x0000000004B92000-memory.dmp

Filesize
584KB

Download
memory/4044-809-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4044-788-0x0000000004AE0000-0x0000000004AEA000-memory.dmp

Filesize
40KB

Download
memory/4044-810-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4044-789-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4044-808-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4044-783-0x0000000000050000-0x00000000000C4000-memory.dmp

Filesize
464KB

Download
memory/4044-784-0x0000000074DF0000-0x00000000755A0000-memory.dmp

Filesize
7.7MB

Download
memory/4044-787-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

Filesize
64KB

Download
memory/4776-555-0x00000000007C0000-0x00000000009C0000-memory.dmp

Filesize
2.0MB

Download
memory/4776-553-0x00000000007C0000-0x00000000009C0000-memory.dmp

Filesize
2.0MB

Download
memory/4936-748-0x0000019777030000-0x0000019777040000-memory.dmp

Filesize
64KB

Download
memory/4936-747-0x0000019777030000-0x0000019777040000-memory.dmp

Filesize
64KB

Download
memory/4936-746-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-745-0x0000019777030000-0x0000019777040000-memory.dmp

Filesize
64KB

Download
memory/4936-744-0x0000019777030000-0x0000019777040000-memory.dmp

Filesize
64KB

Download
memory/4936-743-0x00007FFCCB730000-0x00007FFCCC1F1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-742-0x000001975C9C0000-0x000001975C9EE000-memory.dmp

Filesize
184KB

Download