Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 06:18

General

  • Target

    1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe

  • Size

    1.9MB

  • MD5

    8bd20ee350a72cee7fbf9228e2827c21

  • SHA1

    e7d79089911c45a5ba54b026409e43211a469469

  • SHA256

    1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37

  • SHA512

    768e0488e8922ca1a6c4df3a44bb7766a91bb82b4de3cf83054e81ec228399c8fd978880084cd7fc4d3d5f3a4c6f3c6575e997c05bd01e06dfdba045e2e6b2cd

  • SSDEEP

    49152:kJJYq9FKHYKCADHOftEMA0aVPPmLtWcDwrHDTs+a:GiquHYtADHMtHAOtfwr

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

lumma

C2

https://reinforcenh.shop/api

https://stogeneratmns.shop/api

https://fragnantbui.shop/api

https://drawzhotdog.shop/api

https://vozmeatillu.shop/api

https://offensivedzvju.shop/api

https://ghostreedmnu.shop/api

https://gutterydhowi.shop/api

https://lootebarrkeyn.shop/api

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

default

C2

http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

newbundle2

C2

185.215.113.67:15206

Extracted

Family

xworm

Version

5.0

C2

188.190.10.161:4444

Mutex

TSXTkO0pNBdN2KNw

Attributes
  • install_file

    USB.exe

aes.plain

Extracted

Family

stealc

Botnet

save

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://gutterydhowi.shop/api

https://ghostreedmnu.shop/api

https://offensivedzvju.shop/api

https://vozmeatillu.shop/api

https://drawzhotdog.shop/api

https://fragnantbui.shop/api

https://stogeneratmns.shop/api

https://reinforcenh.shop/api

https://ballotnwu.site/api

https://defenddsouneuw.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Detect Xworm Payload 1 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 7 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 24 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 10 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 12 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3348
      • C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe
        "C:\Users\Admin\AppData\Local\Temp\1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2040
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:4612
          • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2092
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Checks computer location settings
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1724
              • C:\Users\Admin\AppData\Roaming\hTeItleYKL.exe
                "C:\Users\Admin\AppData\Roaming\hTeItleYKL.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4364
              • C:\Users\Admin\AppData\Roaming\rXPieE3Lxl.exe
                "C:\Users\Admin\AppData\Roaming\rXPieE3Lxl.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2688
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1240
              • C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe
                "C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3748
                • C:\Users\Admin\AppData\Local\Temp\is-RL1AA.tmp\stories.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-RL1AA.tmp\stories.tmp" /SL5="$60278,3554050,56832,C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe"
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:5004
                  • C:\Users\Admin\AppData\Local\Fido Video Recorder\gerdaplay3se.exe
                    "C:\Users\Admin\AppData\Local\Fido Video Recorder\gerdaplay3se.exe" -i
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:756
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1544
          • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
            "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1724
            • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              C:\Users\Admin\AppData\Local\Temp\svchost015.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4816
          • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
            "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:832
          • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
            "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3160
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:3020
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:4756
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:4708
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:212
                • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3332
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1232
                    5⤵
                    • Program crash
                    PID:3020
                • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4404
                • C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
                  4⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1572
                • C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  PID:5036
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5880
                • C:\Users\Admin\AppData\Local\Temp\1000354001\78239afd70.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000354001\78239afd70.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1804
                • C:\Users\Admin\AppData\Local\Temp\1000355001\3e3f5d198d.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000355001\3e3f5d198d.exe"
                  4⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4516
                  • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Adds Run key to start application
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4788
                    • C:\Users\Admin\AppData\Local\Temp\1000023001\b8e0eb3b41.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000023001\b8e0eb3b41.exe"
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1176
                    • C:\Users\Admin\1000026002\d9dcad593c.exe
                      "C:\Users\Admin\1000026002\d9dcad593c.exe"
                      6⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5732
                    • C:\Users\Admin\AppData\Local\Temp\1000028001\e8e97a2a56.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000028001\e8e97a2a56.exe"
                      6⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:2640
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                        7⤵
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:5608
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffef218cc40,0x7ffef218cc4c,0x7ffef218cc58
                          8⤵
                            PID:5148
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1924 /prefetch:2
                            8⤵
                              PID:4704
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2160,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2184 /prefetch:3
                              8⤵
                                PID:3484
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2604 /prefetch:8
                                8⤵
                                  PID:5996
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3188 /prefetch:1
                                  8⤵
                                    PID:5516
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3176,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3352 /prefetch:1
                                    8⤵
                                      PID:2184
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4664,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4504 /prefetch:8
                                      8⤵
                                        PID:660
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4792,i,4468346804886424740,15127152140368809931,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4832 /prefetch:8
                                        8⤵
                                          PID:1768
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                                        7⤵
                                        • Enumerates system info in registry
                                        • Modifies data under HKEY_USERS
                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                        PID:3756
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffef218cc40,0x7ffef218cc4c,0x7ffef218cc58
                                          8⤵
                                            PID:5328
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=1760 /prefetch:2
                                            8⤵
                                              PID:4380
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1928,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=2168 /prefetch:3
                                              8⤵
                                                PID:2144
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2288,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=2564 /prefetch:8
                                                8⤵
                                                  PID:444
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=3188 /prefetch:1
                                                  8⤵
                                                    PID:2212
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=3344 /prefetch:1
                                                    8⤵
                                                      PID:384
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4644,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=4656 /prefetch:8
                                                      8⤵
                                                        PID:2404
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4780,i,8587357802030050830,2461173482716876987,262144 --variations-seed-version=20240926-180503.836000 --mojo-platform-channel-handle=4788 /prefetch:8
                                                        8⤵
                                                          PID:4028
                                                    • C:\Users\Admin\AppData\Local\Temp\1000029001\d20bc07819.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\1000029001\d20bc07819.exe"
                                                      6⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3208
                                                • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe"
                                                  4⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2396
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    "cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
                                                    5⤵
                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                    PID:5488
                                                    • C:\Windows\system32\PING.EXE
                                                      ping 127.0.0.1 -n 7
                                                      6⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:4216
                                                    • C:\Windows\system32\reg.exe
                                                      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
                                                      6⤵
                                                      • Adds Run key to start application
                                                      PID:5692
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                    5⤵
                                                      PID:5172
                                                    • C:\Users\Admin\AppData\Local\Temp\neon.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                                                      5⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:5440
                                                      • C:\Users\Admin\AppData\Local\Temp\neon.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:60
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                      5⤵
                                                      • Accesses Microsoft Outlook profiles
                                                      • outlook_office_path
                                                      • outlook_win_path
                                                      PID:1500
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "powershell" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        6⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:4028
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "powershell" Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                                                        6⤵
                                                          PID:5156
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: AddClipboardFormatListener
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:5972
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2992
                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
                                                    3⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:5488
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3332 -ip 3332
                                                1⤵
                                                  PID:224
                                                • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:5956
                                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:5280
                                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1944
                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                  1⤵
                                                    PID:676
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                    1⤵
                                                      PID:2740
                                                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:5076
                                                    • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                      C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:3788
                                                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                      C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                                      1⤵
                                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                      • Checks BIOS information in registry
                                                      • Executes dropped EXE
                                                      • Identifies Wine through registry keys
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:4724
                                                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                      1⤵
                                                        PID:1692
                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                        1⤵
                                                          PID:5140

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\ProgramData\mozglue.dll

                                                          Filesize

                                                          593KB

                                                          MD5

                                                          c8fd9be83bc728cc04beffafc2907fe9

                                                          SHA1

                                                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                          SHA256

                                                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                          SHA512

                                                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                        • C:\ProgramData\nss3.dll

                                                          Filesize

                                                          2.0MB

                                                          MD5

                                                          1cc453cdf74f31e4d913ff9c10acdde2

                                                          SHA1

                                                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                          SHA256

                                                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                          SHA512

                                                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                        • C:\Users\Admin\AppData\Local\Fido Video Recorder\gerdaplay3se.exe

                                                          Filesize

                                                          3.1MB

                                                          MD5

                                                          508efa4023d49e99fe21de76ee7b8a07

                                                          SHA1

                                                          16fba7f6070150406404c71f75203a406dbf18c8

                                                          SHA256

                                                          6640ff66658230cec37c8cec4d3b3ab6e42cbc3dda2cda05b76393a98f50fc2d

                                                          SHA512

                                                          691c4ed723569f9af7bf1f8013b588ef179d6a8d4f78e78aa19e27609100696c53bd54ae292283692cba238fc7fc3ab0a2326c82ff35eaf4a23dc5c55d99d3db

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                                          Filesize

                                                          40B

                                                          MD5

                                                          2c76afc5a2c5731743f37706c1fc87cf

                                                          SHA1

                                                          7e9b3c33b0e65d011882eae9d8224a3f2e30f7f6

                                                          SHA256

                                                          77fc781aa22f91c1beb606634a96088bfbbda95c1c2f08b679c281f2ffbb2dd6

                                                          SHA512

                                                          6cc81e2569857200dcd7f7c161536e9dd1fff4c9fb993fdc58c7f86b79b064713001de5d6af01136b4666439ce16532626559734549150408c8c101601ed8683

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                          Filesize

                                                          649B

                                                          MD5

                                                          0814d61152c94ab99db7c5d3c1d30fa6

                                                          SHA1

                                                          0449deaebb95deead31575b41e64653ee973da5e

                                                          SHA256

                                                          504bd188ef934664bf60655476e0109d1b2f4e99b4cb899c36c633a2f4c4c33d

                                                          SHA512

                                                          d2bb4699ad74bdcd6b8ccc41c26c5da041d80f13cd1e6a117b77d64a5192d9a69ff6f75c32ec2aea979cbc3497671c6e09d5a2fd8d0b8a1a22f58d27dc9165d5

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          432B

                                                          MD5

                                                          7bae169c3c013a3349b341b8b1e76f88

                                                          SHA1

                                                          ee851d6e1d9a1fb5f8771ef080bf88f506c4630c

                                                          SHA256

                                                          69d1d51d0db6fe073b0f41f1029a2801f9a655b42ab4fa42738ab0fa013486c1

                                                          SHA512

                                                          cdf3a90d7b252c71c91a1caa70740efafff63f92a390ac46aa19a5b8ad0fb7d8c81c50c30a19c48d6a621d4270c562f136d2105f03ca079c96a434316d41a9b6

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                          Filesize

                                                          264B

                                                          MD5

                                                          ff6b433a8ae1bd409cd4fcb81bed0228

                                                          SHA1

                                                          980d49bbbe3c127f9299ff09e0a41a9d0e5b00c9

                                                          SHA256

                                                          3ff4f769fde92e788f8860b99acdf057563ab2113f5c2066fad6fd89ac20f3ab

                                                          SHA512

                                                          2d7c2458678606405230ba569a59fe83ab5a38e45e758a33176c93e3d2df630ef51d8cca5969d870960f787417f82f00b55131fd3e5f12c0f5df1a326d8c4661

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          260913e2fd8edc707155b5bc900b6e2b

                                                          SHA1

                                                          b54f21a3bb33b45a19d792db6ace9d5d1a05b125

                                                          SHA256

                                                          1f561f3394abc1da09755e2c281226dddcdc69b3ba32149d11f1113ec4abca28

                                                          SHA512

                                                          e325ed5769be9600750b409aaadacdd13488157015a6d97ad552f09ec853f3e9781df1a2ee8fe52e56f6f5eb962d3625875a482faf3639787f167a08c56f583a

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                          Filesize

                                                          2B

                                                          MD5

                                                          d751713988987e9331980363e24189ce

                                                          SHA1

                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                          SHA256

                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                          SHA512

                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          859B

                                                          MD5

                                                          390561dde4dd95e4827ebeddd01c15a7

                                                          SHA1

                                                          b771a86bc6d4a3b859338525be53384ed5a4e72b

                                                          SHA256

                                                          f8174e37cad5b7562add24eace76d62a5608bb1c7cca946901eed9f209b0941a

                                                          SHA512

                                                          2f4b68a195a10070f25f5616b016b955213655ed0e4ccbbcc21e4bae154ed6ed7b0803b6a74f7cbb2c5e04e619564c83a41999341853b095e5571e8eaa981194

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                          Filesize

                                                          692B

                                                          MD5

                                                          4da397064ceff6b1bcdb006624d668bc

                                                          SHA1

                                                          3988a9c683ff7c81e989317112f86eef812198d0

                                                          SHA256

                                                          40b8d3d943758e6624da0c4e6dc78c9a82a511922c9bfb62ad44cb2088f3f9de

                                                          SHA512

                                                          a2c6d0801d7d417490227075f45df1a11dbbf97c9b452bb5568617bbe43d66d8c99dcf2c7bad38bd1330924522748ceced69b664ebc8350a5cf99c98b6ab6519

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          1cdcef977b9c360d6c6063b16097c0a4

                                                          SHA1

                                                          804b4229475062f637b9a7e878ae5d8e06672142

                                                          SHA256

                                                          420474bf9bbfe71d375c6d2ac06f982159e82626afc2ad6ce2e1f502817e4090

                                                          SHA512

                                                          fbe44d9bf00ad150d2f17979d57389d84a3ffe169267e817758002cade2f8fb9af5c2f07616383ef126362e60e4c3c0245587dedb9e3e1313518a1e3b9b82d8a

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          eeb06060c20aaf772a2ac026ea355df1

                                                          SHA1

                                                          ce858b2f03ac1018d7a15ce469422ece91c5809b

                                                          SHA256

                                                          db4d1eb176f1aa63397b10153d724e488bb187f7a30db8f5c64580c867b8ece2

                                                          SHA512

                                                          746612eb67df55271ea2ea4fad31016b4d3afe8a1ead8844e09e67e4c61262e783c9f47bad594aff219df47a4407d6c447c1b14f08c47ce30b17f8a26b518bcd

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          10KB

                                                          MD5

                                                          7f0f0fbf174167b5a20a1d9cab1200f6

                                                          SHA1

                                                          6e6c2351d82dfdb82d6c32f8fb9f248f2e8222ec

                                                          SHA256

                                                          a2d8e71de2a69e9a6d1162d3a4d863cf00b9a49a384310105dc5d869f894a96c

                                                          SHA512

                                                          bbfa59c494f659bdee8e26896fd32c09d68c1d103b91bcade821fbd04b9005d092daea99bd7099212ce6d28787e26568702c8eca605d232a0ed97e7f345848cd

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          4cd61a1974f2ae9c5aef5e06d28405f8

                                                          SHA1

                                                          6661f04edb669ca1e2c780e6e87796729ba0e7ea

                                                          SHA256

                                                          b1a2caf48345b665d3c75cbaf49e5e085d28d3f95e1c83d82073faad8fe9013a

                                                          SHA512

                                                          de66f9c27cf724516d4944f81fbe7d9a2fabb35855ddee99a567d5a29470759288b3765c92e1325a7b00eb8aa64b94b6c256d2f05e8f226aaddefe467cfd81c5

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                          Filesize

                                                          9KB

                                                          MD5

                                                          1b9d1dd7ea85afa3148797f319211721

                                                          SHA1

                                                          2ac9835342784f9a353c6f024633b59c36ba808d

                                                          SHA256

                                                          ce02f56f504c456774e5822ec17dfb19ae81b3f886b6ba265f4877c869d302ed

                                                          SHA512

                                                          8ec2bec708caefd59dba109c9d3b63fa9915a34a767bfff2eefc4538c463fea59c1a2ee29578938298212098e9cbf7239835264bd1349e98c6970e7f8bc175ec

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                          Filesize

                                                          15KB

                                                          MD5

                                                          6a1fb8f29fa1ac4d875da1cc0bcb6b82

                                                          SHA1

                                                          b03dd48aafbb2828c61cf7afc77cb7318883c0dd

                                                          SHA256

                                                          17c71590d27f35940e365ca3e19c1be6752cc77a3b17b754c1b7ad1a4b4ca303

                                                          SHA512

                                                          c145d4ae53318f44f89cc6aebe3fe371d4ed933571d2565f55fbb37a5e9d419f60565d265cb0c2edd1b974e29f191b4348424f3b9e12bbec6a6247098a1af8fb

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          116KB

                                                          MD5

                                                          eb1baff1d37eaaee218adb2672792a54

                                                          SHA1

                                                          939de7b6b47b9a63de7a9886e383de8a9fc94ab6

                                                          SHA256

                                                          3bd372e585cb00d911f4c7a3b62cc292a512c99d21ca3df3352ffe10fcca4e25

                                                          SHA512

                                                          0e07fbf9b45dc212fa0caf9026f7f2bb0e0a8d8b8de164c50a576111b982322341a88f73b3dac06c85812715b047909459349ea170c74d9fd46f50e52ae72ef0

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          212KB

                                                          MD5

                                                          2a43f327a5880aae47869c076345f768

                                                          SHA1

                                                          7f9c397879c6336780d984a7f6dc65ac4377d950

                                                          SHA256

                                                          232ee3dc789f175cff6fdedab0950c15599fc0b3b7b96070ead652a9e661e535

                                                          SHA512

                                                          c45fd7f38b37d6a71c85368e68e4560ea8da324c8de7846e6ad3dee3d8db77913722c55933c6e4bc7810123e2d9ab452d5c7ef6e2c9a3fbf03f3ad34f8b88c10

                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                          Filesize

                                                          212KB

                                                          MD5

                                                          4af25863088856ba8e8c3280039e4a7a

                                                          SHA1

                                                          d7c01d99dd5d41669171076628cf9caf619b2746

                                                          SHA256

                                                          54033cb99184d5965f128477aa78e39aba4f011a1e89e6a511f1166875737d40

                                                          SHA512

                                                          176b8d47336720dfc56b78e79695aea912c16293cb7cff481d5afe99b7f49ab77ae22208ec3258edc607326d8092c841e988640fbfc47bd0b35704cd932c7455

                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          3d086a433708053f9bf9523e1d87a4e8

                                                          SHA1

                                                          b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                          SHA256

                                                          6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                          SHA512

                                                          931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Filesize

                                                          18KB

                                                          MD5

                                                          23dc801a88ebd165a83c5f239a512b52

                                                          SHA1

                                                          8d65d3bbe517716b2de16896f60b1c6203883c64

                                                          SHA256

                                                          edcecd7b5d68cb596bdcdd4ced4ff4f4a1678693947d5c7496b4d2d24b764ed3

                                                          SHA512

                                                          24bcb0ca2c1a7e0375cbc81d237ef17a97f489d078dca8d7be1f90d31bc119352face9b7f5a80af51758e2df1826f66af8ba786d970d2554b562722be8750246

                                                        • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

                                                          Filesize

                                                          312KB

                                                          MD5

                                                          389881b424cf4d7ec66de13f01c7232a

                                                          SHA1

                                                          d3bc5a793c1b8910e1ecc762b69b3866e4c5ba78

                                                          SHA256

                                                          9d1211b3869ca43840b7da1677b257ad37521aab47719c6fcfe343121760b746

                                                          SHA512

                                                          2b9517d5d9d972e8754a08863a29e3d3e3cfde58e20d433c85546c2298aad50ac8b069cafd5abb3c86e24263d662c6e1ea23c0745a2668dfd215ddbdfbd1ab96

                                                        • C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe

                                                          Filesize

                                                          882KB

                                                          MD5

                                                          84263ab03b0a0f2b51cc11b93ec49c9f

                                                          SHA1

                                                          e6457eb0e0131bec70a2fd4d4a943314f0bd28d4

                                                          SHA256

                                                          7d6e4e01c452dd502361640ee095e2bee35e3f55fd11edc9e94c3580d2c132b5

                                                          SHA512

                                                          db35a02345b5166077e300524675c523a8b4082fa62fc151c0797141348cae5e173eeaec5ad1e95556e048ea6ed34a78b90b1184420557c53cd91f351417ebb2

                                                        • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

                                                          Filesize

                                                          416KB

                                                          MD5

                                                          f5d7b79ee6b6da6b50e536030bcc3b59

                                                          SHA1

                                                          751b555a8eede96d55395290f60adc43b28ba5e2

                                                          SHA256

                                                          2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                                          SHA512

                                                          532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                                        • C:\Users\Admin\AppData\Local\Temp\1000028001\e8e97a2a56.exe

                                                          Filesize

                                                          1.1MB

                                                          MD5

                                                          cf2cd80a393670f0241c8c3740ac1ff2

                                                          SHA1

                                                          5b964539130e93ea7ec8a36e0c08a0da84624ce9

                                                          SHA256

                                                          64c99465ec6ccad13433eb32c6069b3f636efa881f027015d518576aa2bc6b31

                                                          SHA512

                                                          870562c47963165ef45c947a78d62ab34356ed288b45efc7b2c82ad10cfe3c7791b3bba4827274b371019a4e3146add2c699553013a90c613d23ae76528bf4d8

                                                        • C:\Users\Admin\AppData\Local\Temp\1000029001\d20bc07819.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          fc16f8c6b738fbb7d1a03848329360ea

                                                          SHA1

                                                          27260a586b8511d4375f086210bd751b79e50b1b

                                                          SHA256

                                                          40e3298b5e6b98f8b52a2af928463a543e7f0a6dca869565e8ac8ad867f3ce61

                                                          SHA512

                                                          55dccd477a2f35743fddc72fdae8a7c30cfca356ff00857604152afc9d9be4856aa822321b8e822131f7d4e3e9ff9e67020f63e712601f33201c86faf876fd6d

                                                        • C:\Users\Admin\AppData\Local\Temp\1000065001\stories.exe

                                                          Filesize

                                                          3.6MB

                                                          MD5

                                                          70c097a1f88fe8dbd34ee098f80d68b2

                                                          SHA1

                                                          aa1d64d8b4f25cc6cadc413903d11837ba1fd586

                                                          SHA256

                                                          3ec528934f091def5518ec3b7731e5e113f1d8bc3c75be591e43280226c0cb40

                                                          SHA512

                                                          5a0c5312642532b886d3904798428e134acc2a8d43f77ee08621bdbfab4fb32ba2354c48552b584f81b3187264d002dd0d5904f4615725168e6069b52ceca777

                                                        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

                                                          Filesize

                                                          187KB

                                                          MD5

                                                          7a02aa17200aeac25a375f290a4b4c95

                                                          SHA1

                                                          7cc94ca64268a9a9451fb6b682be42374afc22fd

                                                          SHA256

                                                          836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                                                          SHA512

                                                          f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                                                        • C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

                                                          Filesize

                                                          4.1MB

                                                          MD5

                                                          7fa5c660d124162c405984d14042506f

                                                          SHA1

                                                          69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f

                                                          SHA256

                                                          fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2

                                                          SHA512

                                                          d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c

                                                        • C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

                                                          Filesize

                                                          409KB

                                                          MD5

                                                          a21700718c70ec5e787ad373cb72a757

                                                          SHA1

                                                          027554ab5ff3245e7617f3b83d6548bf7919f92e

                                                          SHA256

                                                          87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6

                                                          SHA512

                                                          ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b

                                                        • C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe

                                                          Filesize

                                                          314KB

                                                          MD5

                                                          ff5afed0a8b802d74af1c1422c720446

                                                          SHA1

                                                          7135acfa641a873cb0c4c37afc49266bfeec91d8

                                                          SHA256

                                                          17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                                                          SHA512

                                                          11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                                                        • C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe

                                                          Filesize

                                                          352KB

                                                          MD5

                                                          2f1d09f64218fffe7243a8b44345b27e

                                                          SHA1

                                                          72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe

                                                          SHA256

                                                          4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2

                                                          SHA512

                                                          5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

                                                        • C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe

                                                          Filesize

                                                          304KB

                                                          MD5

                                                          58e8b2eb19704c5a59350d4ff92e5ab6

                                                          SHA1

                                                          171fc96dda05e7d275ec42840746258217d9caf0

                                                          SHA256

                                                          07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

                                                          SHA512

                                                          e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

                                                        • C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe

                                                          Filesize

                                                          963KB

                                                          MD5

                                                          1ef39c8bc5799aa381fe093a1f2d532a

                                                          SHA1

                                                          57eabb02a7c43c9682988227dd470734cc75edb2

                                                          SHA256

                                                          0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4

                                                          SHA512

                                                          13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682

                                                        • C:\Users\Admin\AppData\Local\Temp\1000349001\cccc2.exe

                                                          Filesize

                                                          359KB

                                                          MD5

                                                          6b470f7251aa9c14d7daea8f6446e217

                                                          SHA1

                                                          a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4

                                                          SHA256

                                                          8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f

                                                          SHA512

                                                          fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4

                                                        • C:\Users\Admin\AppData\Local\Temp\1000354001\78239afd70.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          db555e4fdc380e9e8a19fcc609f7d1aa

                                                          SHA1

                                                          be66e90a5d5ce54f1a90bd59a3b4723e1a53d89c

                                                          SHA256

                                                          c1cd69890f1f81efd491b94bfff2d9e1263f4a843fc42b649aac082cf378f3a8

                                                          SHA512

                                                          6c48434a9457204b2beaf6cbb6a3668af343a42e82d289acdb6bdf8c05f53fa518ba0b150a5afe45426c19d81b7d0deab42d08228b1d20ead7b213335cdec8db

                                                        • C:\Users\Admin\AppData\Local\Temp\1000355001\3e3f5d198d.exe

                                                          Filesize

                                                          1.8MB

                                                          MD5

                                                          0fc09656aa3f642c56e40297326df58d

                                                          SHA1

                                                          e380ac49608735e0cf627a1d662088a360a4f3c9

                                                          SHA256

                                                          f053f59098a67146b4a067d1decc7a78e23e751cb15355cd953e4b2b307d2e13

                                                          SHA512

                                                          a6eed1d5512fa724081079dacf70bbc304b078f68d35877da1eb9d5ded820c0948623830628146a7c021bc54c35e1390c0ba349492d6e1cf0fc909f48aef0398

                                                        • C:\Users\Admin\AppData\Local\Temp\1000356001\neon.exe

                                                          Filesize

                                                          3.5MB

                                                          MD5

                                                          b3fd0e1003b1cd38402b6d32829f6135

                                                          SHA1

                                                          c9cedd6322fb83457f56b64b4624b07e2786f702

                                                          SHA256

                                                          e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

                                                          SHA512

                                                          04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

                                                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

                                                          Filesize

                                                          1.9MB

                                                          MD5

                                                          8bd20ee350a72cee7fbf9228e2827c21

                                                          SHA1

                                                          e7d79089911c45a5ba54b026409e43211a469469

                                                          SHA256

                                                          1d51503c34d63c3df4687f630c252b7a0a9cb194f42a7af8cf3b9c8c51642f37

                                                          SHA512

                                                          768e0488e8922ca1a6c4df3a44bb7766a91bb82b4de3cf83054e81ec228399c8fd978880084cd7fc4d3d5f3a4c6f3c6575e997c05bd01e06dfdba045e2e6b2cd

                                                        • C:\Users\Admin\AppData\Local\Temp\TmpD5AF.tmp

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          1420d30f964eac2c85b2ccfe968eebce

                                                          SHA1

                                                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                                          SHA256

                                                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                                          SHA512

                                                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iru1ukno.3ki.ps1

                                                          Filesize

                                                          60B

                                                          MD5

                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                          SHA1

                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                          SHA256

                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                          SHA512

                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                        • C:\Users\Admin\AppData\Local\Temp\is-K6U0G.tmp\_isetup\_iscrypt.dll

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          a69559718ab506675e907fe49deb71e9

                                                          SHA1

                                                          bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                          SHA256

                                                          2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                          SHA512

                                                          e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                        • C:\Users\Admin\AppData\Local\Temp\is-K6U0G.tmp\_isetup\_isdecmp.dll

                                                          Filesize

                                                          13KB

                                                          MD5

                                                          a813d18268affd4763dde940246dc7e5

                                                          SHA1

                                                          c7366e1fd925c17cc6068001bd38eaef5b42852f

                                                          SHA256

                                                          e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

                                                          SHA512

                                                          b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

                                                        • C:\Users\Admin\AppData\Local\Temp\is-RL1AA.tmp\stories.tmp

                                                          Filesize

                                                          692KB

                                                          MD5

                                                          f24984c218db4c7aee2f86434dac013b

                                                          SHA1

                                                          2094cf56e8200cbfe2d5ee99cac4c26becd3bff3

                                                          SHA256

                                                          1ed6814fb35c5769468452c22fa920807add3a70c67ecc9bee77bfcd48f33fb0

                                                          SHA512

                                                          bd613ab2058819ad08e984c28528dc39c5a55a3d57333a52d47066d0a0d1be4707364eda597099191c2947c126a25afb27cc5db249a529a61f3624f737291b16

                                                        • C:\Users\Admin\AppData\Local\Temp\neon.exe

                                                          Filesize

                                                          76KB

                                                          MD5

                                                          0e362e7005823d0bec3719b902ed6d62

                                                          SHA1

                                                          590d860b909804349e0cdc2f1662b37bd62f7463

                                                          SHA256

                                                          2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                                                          SHA512

                                                          518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                                                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe

                                                          Filesize

                                                          2.9MB

                                                          MD5

                                                          b826dd92d78ea2526e465a34324ebeea

                                                          SHA1

                                                          bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                          SHA256

                                                          7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                          SHA512

                                                          1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-945322488-2060912225-3527527000-1000\76b53b3ec448f7ccdda2063b15d2bfc3_03d68389-5a68-4d9e-92ac-47b927e624dd

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          f30f6b2b6b496b5043601f9a8118a14a

                                                          SHA1

                                                          33e9d22428df785948be37e64ad354c872e1ae81

                                                          SHA256

                                                          8182e62561012522a7aa8063d5e82ad25b6fb5a0a9eaf2ae99b41f2a9fe12463

                                                          SHA512

                                                          cbcab9e98e0c6db9f810e05d34bc987594743b5bbd0bddfb0fd0afcba183f25baa16fe518c2e93288e04d945b74daa7908f58696c79bc2ebf3f7d7554ab55b06

                                                        • C:\Users\Admin\AppData\Roaming\hTeItleYKL.exe

                                                          Filesize

                                                          356KB

                                                          MD5

                                                          a3ef9920a91b891837705e46bb26de17

                                                          SHA1

                                                          9cfbcd0f46ec86fb57d3d6d74a064f9098adf117

                                                          SHA256

                                                          171cef885f6c285e995ce3ec5960c5ea4e4ed049cec362745058fee39e4136cc

                                                          SHA512

                                                          c65e91091b95c3aba0af7df4ed6543d26bcb5b54d6fab82f9d2ac1ba156f475f98124a1a0e8851d69be23b1dc945c76c075cd32515203273260802e1224dbd6e

                                                        • C:\Users\Admin\AppData\Roaming\rXPieE3Lxl.exe

                                                          Filesize

                                                          304KB

                                                          MD5

                                                          4e60f3fd76d9eab244f9dc00f7765b0b

                                                          SHA1

                                                          1a154d6e837e7105c551793131cde89f157c4330

                                                          SHA256

                                                          d6945846cc23c01b9c9ad2b97d35b5a14c01f1a4cc2ec651a596f06777ba4fec

                                                          SHA512

                                                          44727e25781f448579ac35aab94aff550ed9fe5ac58d95bd394569c62892dc78216ac687baa43cef66187ebe629f5dd9cd63ea274222d11dbef3440ec4d7f77a

                                                        • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          df35b1229e045b7cfd9b9576c7af6a0a

                                                          SHA1

                                                          4d685fce7540a4ec10853b20987ca8831e5f184b

                                                          SHA256

                                                          8168f2470bb7a27e3a09aaa7e8748b2150e4e96a76f6017214c8392d907ce2bc

                                                          SHA512

                                                          8b8ebc2f658180edec34e20337491bd60829832110d1be28e08544afa2707b8b064933ac8662f524b88b4e0c79776df526e44a786ccc04388271ba9013c1dc55

                                                        • C:\Users\Public\Desktop\Google Chrome.lnk

                                                          Filesize

                                                          2KB

                                                          MD5

                                                          353e9e2fa47d7a9c14a35cceac0360b3

                                                          SHA1

                                                          18c41db29a4c28597f096ba252868cb57186eff1

                                                          SHA256

                                                          a402c8dac3b12da5d655c7b3dcd6483fa998dc33fb49c8fcf8ec0d63fc4bacbf

                                                          SHA512

                                                          60a044bcdff9cdaf3ac7011e5ca6eca8ce4657db73a1d428008ea153f890e679dce2474917666290764545effb6215b4f4a836304c03ebf1e32da354b685c7ed

                                                        • memory/212-375-0x0000000000400000-0x0000000000452000-memory.dmp

                                                          Filesize

                                                          328KB

                                                        • memory/756-277-0x0000000000400000-0x0000000000720000-memory.dmp

                                                          Filesize

                                                          3.1MB

                                                        • memory/756-2202-0x0000000000400000-0x0000000000720000-memory.dmp

                                                          Filesize

                                                          3.1MB

                                                        • memory/756-280-0x0000000000400000-0x0000000000720000-memory.dmp

                                                          Filesize

                                                          3.1MB

                                                        • memory/832-330-0x00000000005C0000-0x000000000062C000-memory.dmp

                                                          Filesize

                                                          432KB

                                                        • memory/1176-1757-0x0000000000F80000-0x000000000161C000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1176-1762-0x0000000000F80000-0x000000000161C000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1500-2432-0x0000000040000000-0x0000000040030000-memory.dmp

                                                          Filesize

                                                          192KB

                                                        • memory/1544-207-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                          Filesize

                                                          972KB

                                                        • memory/1544-423-0x0000000000AF0000-0x0000000000D33000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/1544-184-0x0000000000AF0000-0x0000000000D33000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/1572-493-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-513-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-1588-0x0000000005940000-0x0000000005994000-memory.dmp

                                                          Filesize

                                                          336KB

                                                        • memory/1572-1579-0x00000000057C0000-0x0000000005828000-memory.dmp

                                                          Filesize

                                                          416KB

                                                        • memory/1572-1580-0x0000000005870000-0x00000000058BC000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/1572-503-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-486-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-487-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-491-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-495-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-497-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-499-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-501-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-505-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-507-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-484-0x00000000003C0000-0x00000000004B8000-memory.dmp

                                                          Filesize

                                                          992KB

                                                        • memory/1572-485-0x0000000005040000-0x000000000512E000-memory.dmp

                                                          Filesize

                                                          952KB

                                                        • memory/1572-489-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-521-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-520-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-517-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-515-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-511-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1572-509-0x0000000005040000-0x0000000005128000-memory.dmp

                                                          Filesize

                                                          928KB

                                                        • memory/1724-420-0x0000000000400000-0x000000000081B000-memory.dmp

                                                          Filesize

                                                          4.1MB

                                                        • memory/1724-135-0x0000000000400000-0x00000000004DE000-memory.dmp

                                                          Filesize

                                                          888KB

                                                        • memory/1724-95-0x0000000000400000-0x00000000004DE000-memory.dmp

                                                          Filesize

                                                          888KB

                                                        • memory/1724-105-0x0000000000400000-0x00000000004DE000-memory.dmp

                                                          Filesize

                                                          888KB

                                                        • memory/1724-107-0x0000000000400000-0x00000000004DE000-memory.dmp

                                                          Filesize

                                                          888KB

                                                        • memory/1724-108-0x0000000000400000-0x00000000004DE000-memory.dmp

                                                          Filesize

                                                          888KB

                                                        • memory/1804-1624-0x0000000000E50000-0x00000000014EC000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1804-1616-0x0000000000E50000-0x00000000014EC000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/1944-1802-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/2040-41-0x0000000000170000-0x00000000001C4000-memory.dmp

                                                          Filesize

                                                          336KB

                                                        • memory/2040-40-0x000000007318E000-0x000000007318F000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2092-85-0x00000000000E0000-0x00000000001C2000-memory.dmp

                                                          Filesize

                                                          904KB

                                                        • memory/2396-1711-0x0000000023EE0000-0x0000000023F7E000-memory.dmp

                                                          Filesize

                                                          632KB

                                                        • memory/2396-1890-0x00000000261F0000-0x00000000261F6000-memory.dmp

                                                          Filesize

                                                          24KB

                                                        • memory/2396-1889-0x00000000261D0000-0x00000000261EA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/2396-1707-0x0000000000390000-0x000000000070C000-memory.dmp

                                                          Filesize

                                                          3.5MB

                                                        • memory/2688-421-0x0000000007980000-0x0000000007B42000-memory.dmp

                                                          Filesize

                                                          1.8MB

                                                        • memory/2688-137-0x0000000000520000-0x0000000000572000-memory.dmp

                                                          Filesize

                                                          328KB

                                                        • memory/2688-309-0x00000000069E0000-0x0000000006A46000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/2688-419-0x0000000007560000-0x00000000075B0000-memory.dmp

                                                          Filesize

                                                          320KB

                                                        • memory/2688-422-0x0000000008080000-0x00000000085AC000-memory.dmp

                                                          Filesize

                                                          5.2MB

                                                        • memory/2992-1712-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/2992-1684-0x00000000082E0000-0x000000000895A000-memory.dmp

                                                          Filesize

                                                          6.5MB

                                                        • memory/2992-1713-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

                                                          Filesize

                                                          32KB

                                                        • memory/2992-1634-0x0000000003080000-0x00000000030B6000-memory.dmp

                                                          Filesize

                                                          216KB

                                                        • memory/2992-1639-0x0000000005B90000-0x00000000061B8000-memory.dmp

                                                          Filesize

                                                          6.2MB

                                                        • memory/2992-1710-0x0000000007EE0000-0x0000000007EF4000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/2992-1653-0x0000000006490000-0x00000000064B2000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/2992-1708-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

                                                          Filesize

                                                          56KB

                                                        • memory/2992-1654-0x0000000006530000-0x0000000006596000-memory.dmp

                                                          Filesize

                                                          408KB

                                                        • memory/2992-1655-0x00000000065A0000-0x00000000068F4000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                        • memory/2992-1656-0x0000000006960000-0x000000000697E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/2992-1688-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

                                                          Filesize

                                                          68KB

                                                        • memory/2992-1687-0x0000000007F20000-0x0000000007FB6000-memory.dmp

                                                          Filesize

                                                          600KB

                                                        • memory/2992-1672-0x000000006C840000-0x000000006C88C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/2992-1671-0x0000000006F40000-0x0000000006F72000-memory.dmp

                                                          Filesize

                                                          200KB

                                                        • memory/2992-1682-0x0000000006F20000-0x0000000006F3E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/2992-1683-0x0000000007B40000-0x0000000007BE3000-memory.dmp

                                                          Filesize

                                                          652KB

                                                        • memory/2992-1686-0x0000000007D10000-0x0000000007D1A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/2992-1685-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/3160-373-0x0000000000FA0000-0x0000000000FF4000-memory.dmp

                                                          Filesize

                                                          336KB

                                                        • memory/3208-1906-0x0000000000560000-0x0000000000A09000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3208-1904-0x0000000000560000-0x0000000000A09000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/3748-205-0x0000000000400000-0x0000000000414000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/4404-442-0x00000000008E0000-0x0000000000932000-memory.dmp

                                                          Filesize

                                                          328KB

                                                        • memory/4428-18-0x0000000000941000-0x000000000096F000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/4428-20-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-293-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-17-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-21-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-185-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-186-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-245-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4428-19-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4516-1643-0x0000000000FE0000-0x000000000149F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4516-1669-0x0000000000FE0000-0x000000000149F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4612-83-0x0000000005CD0000-0x0000000005D46000-memory.dmp

                                                          Filesize

                                                          472KB

                                                        • memory/4612-93-0x0000000006DF0000-0x0000000006E3C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/4612-44-0x0000000000400000-0x0000000000452000-memory.dmp

                                                          Filesize

                                                          328KB

                                                        • memory/4612-47-0x0000000005320000-0x00000000058C4000-memory.dmp

                                                          Filesize

                                                          5.6MB

                                                        • memory/4612-48-0x0000000004E70000-0x0000000004F02000-memory.dmp

                                                          Filesize

                                                          584KB

                                                        • memory/4612-49-0x0000000005040000-0x000000000504A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/4612-86-0x00000000064C0000-0x00000000064DE000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/4612-89-0x0000000006E50000-0x0000000007468000-memory.dmp

                                                          Filesize

                                                          6.1MB

                                                        • memory/4612-90-0x00000000086D0000-0x00000000087DA000-memory.dmp

                                                          Filesize

                                                          1.0MB

                                                        • memory/4612-91-0x0000000006D50000-0x0000000006D62000-memory.dmp

                                                          Filesize

                                                          72KB

                                                        • memory/4612-92-0x0000000006DB0000-0x0000000006DEC000-memory.dmp

                                                          Filesize

                                                          240KB

                                                        • memory/4724-2278-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4724-2282-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4788-1670-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4788-1780-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/4816-1598-0x0000000000400000-0x0000000000643000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/4816-414-0x0000000000400000-0x0000000000643000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/4816-417-0x0000000000400000-0x0000000000643000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/4816-418-0x0000000000400000-0x0000000000643000-memory.dmp

                                                          Filesize

                                                          2.3MB

                                                        • memory/4936-1-0x0000000077574000-0x0000000077576000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/4936-2-0x00000000000D1000-0x00000000000FF000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/4936-3-0x00000000000D0000-0x00000000005A5000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4936-4-0x00000000000D0000-0x00000000005A5000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4936-15-0x00000000000D0000-0x00000000005A5000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/4936-0-0x00000000000D0000-0x00000000005A5000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5036-1591-0x00000000003E0000-0x0000000000440000-memory.dmp

                                                          Filesize

                                                          384KB

                                                        • memory/5076-2280-0x0000000000940000-0x0000000000E15000-memory.dmp

                                                          Filesize

                                                          4.8MB

                                                        • memory/5280-1781-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5280-1800-0x0000000000E90000-0x000000000134F000-memory.dmp

                                                          Filesize

                                                          4.7MB

                                                        • memory/5440-2112-0x0000000000D80000-0x0000000000D9A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/5488-1759-0x00000000071E0000-0x00000000071F4000-memory.dmp

                                                          Filesize

                                                          80KB

                                                        • memory/5488-1758-0x00000000071A0000-0x00000000071B1000-memory.dmp

                                                          Filesize

                                                          68KB

                                                        • memory/5488-1726-0x0000000005760000-0x0000000005AB4000-memory.dmp

                                                          Filesize

                                                          3.3MB

                                                        • memory/5488-1749-0x0000000006E60000-0x0000000006F03000-memory.dmp

                                                          Filesize

                                                          652KB

                                                        • memory/5488-1737-0x000000006C840000-0x000000006C88C000-memory.dmp

                                                          Filesize

                                                          304KB

                                                        • memory/5732-1777-0x0000000000140000-0x00000000007DC000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/5732-1779-0x0000000000140000-0x00000000007DC000-memory.dmp

                                                          Filesize

                                                          6.6MB

                                                        • memory/5972-1593-0x0000000000500000-0x000000000052E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                        • memory/5972-1594-0x0000000004960000-0x00000000049FC000-memory.dmp

                                                          Filesize

                                                          624KB