amadey | c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Size 1.9MB
Sample240928-b798lsshne
SHA256 c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5
MD5 b8fc8a5801e3c0172a199430c7dba1d6
SHA1 2a53f4961410bea07de2259fd7875b30ae6a7856
SHA512 b6a2e23babec64712408dbf0e1a9ce5720a4aff14c6de3e90a756c00ec97d01f394a18608de1cb2a90f87ce6c6fa8b4829ca57f77b8c110462b65af10e9ba3ec
SSDEEP 49152:Pfxsg8rRSzxCa2w6G/fSrvYMSdkhNebdu:HxaVo0w6oKbYXdkhuc
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

136.244.88.135:17615

Extracted

Family

redline

Botnet

@OLEH_PSP

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29862

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

xworm

Version

188.190.10.161:4444

Mutex

TSXTkO0pNBdN2KNw

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

stealc

Botnet

save

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

47.238.55.14:4449

Mutex

rqwcncaesrdtlckoweu

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

lumma

https://defenddsouneuw.shop/api
https://reinforcenh.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3272-1543-0x0000000000400000-0x000000000042E000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/memory/1216-42-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x0007000000023495-76.dat	family_redline
behavioral2/memory/1504-84-0x00000000009A0000-0x00000000009F2000-memory.dmp	family_redline
behavioral2/memory/4608-282-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x00070000000234ca-336.dat	family_redline
behavioral2/memory/2796-350-0x00000000002C0000-0x0000000000312000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/7976-2917-0x00000000076C0000-0x00000000077E2000-memory.dmp	family_stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 3892 created 3484	3892	rstxdhuj.exe	56
PID 5684 created 3484	5684	Waters.pif	56
PID 5684 created 3484	5684	Waters.pif	56
PID 7408 created 3484	7408	Thermal.pif	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be7da0c89b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fb4c9a74e3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e731f96cac.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6c6b9fe6e7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	53bb5484ab.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
6260	powershell.exe
5960	powershell.exe
5920	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e731f96cac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e731f96cac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be7da0c89b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	53bb5484ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	53bb5484ab.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6c6b9fe6e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6c6b9fe6e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fb4c9a74e3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be7da0c89b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fb4c9a74e3.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	fb4c9a74e3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	splwow64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	PkContent.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	context.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	12dsvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Waters.pif
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Nework.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	skotes.exe

Drops startup file 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url	cmd.exe

Executes dropped EXE 39 IoCs

pid	Process
212	axplong.exe
3712	gold.exe
4492	12dsvc.exe
2760	EzLcuMxgF5.exe
1504	jHuFRYRN7w.exe
3700	Nework.exe
4012	Hkbsse.exe
4028	stealc_default2.exe
4408	needmoney.exe
1412	penis.exe
3156	crypted.exe
5052	LummaC222222.exe
856	svchost015.exe
2796	newbundle2.exe
3892	rstxdhuj.exe
6120	e731f96cac.exe
6096	javumar2.exe
388	javumar2.tmp
5184	javtestnoreport.exe
5832	fb4c9a74e3.exe
2236	lummetc.exe
5392	skotes.exe
1708	processclass.exe
2032	splwow64.exe
5764	be7da0c89b.exe
920	PkContent.exe
6068	skotes.exe
4848	Hkbsse.exe
5420	axplong.exe
5172	6c6b9fe6e7.exe
7068	53bb5484ab.exe
6416	context.exe
5684	Waters.pif
7408	Thermal.pif
7592	Waters.pif
7976	RegAsm.exe
6880	Hkbsse.exe
1600	skotes.exe
6560	axplong.exe

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	6c6b9fe6e7.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	e731f96cac.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	fb4c9a74e3.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	be7da0c89b.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Software\Wine	53bb5484ab.exe

Loads dropped DLL 4 IoCs

pid	Process
4028	stealc_default2.exe
4028	stealc_default2.exe
388	javumar2.tmp
388	javumar2.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ylrdnrwcx = "C:\\Users\\Admin\\AppData\\Roaming\\Ylrdnrwcx.exe"	rstxdhuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e731f96cac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000354001\\e731f96cac.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fb4c9a74e3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000355001\\fb4c9a74e3.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\be7da0c89b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000023001\\be7da0c89b.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6c6b9fe6e7.exe = "C:\\Users\\Admin\\1000026002\\6c6b9fe6e7.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
6492	tasklist.exe
7392	tasklist.exe
7572	tasklist.exe
6344	tasklist.exe
2956	tasklist.exe
7000	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
212	axplong.exe
6120	e731f96cac.exe
5832	fb4c9a74e3.exe
5392	skotes.exe
5764	be7da0c89b.exe
6068	skotes.exe
5420	axplong.exe
5172	6c6b9fe6e7.exe
7068	53bb5484ab.exe
1600	skotes.exe
6560	axplong.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3712 set thread context of 1216	3712	gold.exe	85
PID 3156 set thread context of 4608	3156	crypted.exe	104
PID 4408 set thread context of 856	4408	needmoney.exe	109
PID 3892 set thread context of 3272	3892	rstxdhuj.exe	117

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	fb4c9a74e3.exe
File opened for modification	C:\Windows\BrandonBlind	splwow64.exe
File opened for modification	C:\Windows\PgJune	PkContent.exe
File opened for modification	C:\Windows\IpaqArthur	context.exe
File created	C:\Windows\Tasks\axplong.job	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
File opened for modification	C:\Windows\ReceptorsTeeth	PkContent.exe
File opened for modification	C:\Windows\FirewireBros	PkContent.exe
File opened for modification	C:\Windows\BrandonBlind	context.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe
File opened for modification	C:\Windows\HardlyAircraft	splwow64.exe
File opened for modification	C:\Windows\ViewpictureKingdom	splwow64.exe
File opened for modification	C:\Windows\PorcelainExhaust	PkContent.exe
File opened for modification	C:\Windows\ViewpictureKingdom	context.exe
File opened for modification	C:\Windows\IpaqArthur	splwow64.exe
File opened for modification	C:\Windows\MonsterRaymond	PkContent.exe
File opened for modification	C:\Windows\PortugalCharges	PkContent.exe
File opened for modification	C:\Windows\HardlyAircraft	context.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4316	5052	WerFault.exe	107
5268	2236	WerFault.exe	125
7800	7976	WerFault.exe	244

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12dsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javumar2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb4c9a74e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lummetc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Waters.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c6b9fe6e7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javumar2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rstxdhuj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53bb5484ab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newbundle2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e731f96cac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC222222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PkContent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Thermal.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be7da0c89b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5220	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5972	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133719617497208575"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
7544	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3272	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
212	axplong.exe
212	axplong.exe
4028	stealc_default2.exe
4028	stealc_default2.exe
2760	EzLcuMxgF5.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1504	jHuFRYRN7w.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1216	RegAsm.exe
1412	penis.exe
1412	penis.exe
4028	stealc_default2.exe
4028	stealc_default2.exe
3892	rstxdhuj.exe
3892	rstxdhuj.exe
6120	e731f96cac.exe
6120	e731f96cac.exe
5184	javtestnoreport.exe
5184	javtestnoreport.exe
4608	RegAsm.exe
4608	RegAsm.exe
4608	RegAsm.exe
4608	RegAsm.exe
2796	newbundle2.exe
2796	newbundle2.exe
2796	newbundle2.exe
2796	newbundle2.exe
5832	fb4c9a74e3.exe
5832	fb4c9a74e3.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
2796	newbundle2.exe
2796	newbundle2.exe
5392	skotes.exe
5392	skotes.exe
4608	RegAsm.exe
4608	RegAsm.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
3060	msedge.exe
3060	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5764	be7da0c89b.exe
5764	be7da0c89b.exe
6068	skotes.exe
6068	skotes.exe
5420	axplong.exe
5420	axplong.exe
3272	InstallUtil.exe
3272	InstallUtil.exe
5172	6c6b9fe6e7.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2760	EzLcuMxgF5.exe
Token: SeBackupPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeSecurityPrivilege	2760	EzLcuMxgF5.exe
Token: SeDebugPrivilege	1504	jHuFRYRN7w.exe
Token: SeDebugPrivilege	1412	penis.exe
Token: SeBackupPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeSecurityPrivilege	1412	penis.exe
Token: SeDebugPrivilege	1216	RegAsm.exe
Token: SeDebugPrivilege	3892	rstxdhuj.exe
Token: SeDebugPrivilege	3892	rstxdhuj.exe
Token: SeDebugPrivilege	3272	InstallUtil.exe
Token: SeDebugPrivilege	5960	powershell.exe
Token: SeDebugPrivilege	2796	newbundle2.exe
Token: SeDebugPrivilege	4608	RegAsm.exe
Token: SeDebugPrivilege	5920	powershell.exe
Token: SeDebugPrivilege	3272	InstallUtil.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	6260	powershell.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	1708	processclass.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	6344	tasklist.exe
Token: SeDebugPrivilege	2956	tasklist.exe
Token: SeDebugPrivilege	7000	tasklist.exe
Token: SeDebugPrivilege	6492	tasklist.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	7392	tasklist.exe
Token: SeDebugPrivilege	7572	tasklist.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
5832	fb4c9a74e3.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6972	chrmstp.exe
5684	Waters.pif
5684	Waters.pif
5684	Waters.pif
7408	Thermal.pif
7408	Thermal.pif
7408	Thermal.pif
7592	Waters.pif
7592	Waters.pif
7592	Waters.pif

Suspicious use of SendNotifyMessage 33 IoCs

pid	Process
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
4140	msedge.exe
5684	Waters.pif
5684	Waters.pif
5684	Waters.pif
7408	Thermal.pif
7408	Thermal.pif
7408	Thermal.pif
7592	Waters.pif
7592	Waters.pif
7592	Waters.pif

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3272	InstallUtil.exe
7976	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 2928 wrote to memory of 212	2928	c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe	82
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 212 wrote to memory of 3712	212	axplong.exe	83
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 3712 wrote to memory of 1216	3712	gold.exe	85
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 212 wrote to memory of 4492	212	axplong.exe	86
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 2760	4492	12dsvc.exe	87
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 4492 wrote to memory of 1504	4492	12dsvc.exe	89
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 212 wrote to memory of 3700	212	axplong.exe	90
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 3700 wrote to memory of 4012	3700	Nework.exe	92
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4028	212	axplong.exe	93
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 4408	212	axplong.exe	98
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 1412	212	axplong.exe	100
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 212 wrote to memory of 3156	212	axplong.exe	102
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 3156 wrote to memory of 4608	3156	crypted.exe	104
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 212 wrote to memory of 5052	212	axplong.exe	107
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 4408 wrote to memory of 856	4408	needmoney.exe	109
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 2796	212	axplong.exe	110
PID 212 wrote to memory of 3892	212	axplong.exe	113

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3484
- C:\Users\Admin\AppData\Local\Temp\c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe
  "C:\Users\Admin\AppData\Local\Temp\c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
      "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe
        
        "C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2760
    - - C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe
        
        "C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
      "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp" /SL5="$80290,12434628,845824,C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
      "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
      "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
      "C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5052
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 1256
        5⤵
        Program crash
        
        PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yoodrabodoln.beget.app/Px5rcr?&se_referrer=&default_keyword=&
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4140
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd7c7746f8,0x7ffd7c774708,0x7ffd7c774718
        6⤵
        
        PID:5516
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
        6⤵
        
        PID:1292
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
        6⤵
        
        PID:3548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3436 /prefetch:8
        6⤵
        
        PID:4812
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
        6⤵
        
        PID:6052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
        6⤵
        
        PID:1216
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        6⤵
        
        PID:5784
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
        6⤵
        
        PID:3276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
        6⤵
        
        PID:5332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        6⤵
        
        PID:3568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,89091964822193001,6593056839988385292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
        6⤵
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
      "C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe
      "C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe
      "C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\1000023001\be7da0c89b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000023001\be7da0c89b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5764
      - C:\Users\Admin\1000026002\6c6b9fe6e7.exe
        
        "C:\Users\Admin\1000026002\6c6b9fe6e7.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5172
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000032042\ko.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
        7⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd795fcc40,0x7ffd795fcc4c,0x7ffd795fcc58
        8⤵
        
        PID:6136
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1648,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:2
        8⤵
        
        PID:4328
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=1884,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:3
        8⤵
        
        PID:4408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=2200,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
        8⤵
        
        PID:5180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:1
        8⤵
        
        PID:6120
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3156,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
        8⤵
        
        PID:2000
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3344,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        8⤵
        
        PID:5024
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4440,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:2
        8⤵
        
        PID:3052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4640,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:2
        8⤵
        
        PID:5668
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4880,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        8⤵
        
        PID:6320
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3964,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
        8⤵
        
        PID:6668
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4444,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:1
        8⤵
        
        PID:6676
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5452,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
        8⤵
        
        PID:6788
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=4940,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
        8⤵
        
        PID:7116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4984,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
        8⤵
        
        PID:5512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5012,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
        8⤵
        
        PID:5300
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3968,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:1
        8⤵
        
        PID:6476
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6064,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
        8⤵
        
        PID:6528
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        8⤵
        Drops file in Program Files directory
        
        PID:6556
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff61b214698,0x7ff61b2146a4,0x7ff61b2146b0
        9⤵
        Drops file in Program Files directory
        
        PID:6656
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        9⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:6972
        
        C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff61b214698,0x7ff61b2146a4,0x7ff61b2146b0
        10⤵
        Drops file in Program Files directory
        
        PID:6988
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6204,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
        8⤵
        
        PID:6560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5972,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
        8⤵
        
        PID:6548
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6304,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
        8⤵
        
        PID:6400
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6700,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
        8⤵
        
        PID:6212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=3224,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
        8⤵
        
        PID:4360
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=5556,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
        8⤵
        
        PID:6452
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --no-appcompat-clear --field-trial-handle=6828,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        8⤵
        
        PID:6512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User" --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3292,i,12516948115800931060,17896637437891161681,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:2
        8⤵
        
        PID:3936
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\1000033142\so.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6260
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --kiosk --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data
        7⤵
        
        PID:6592
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7ffd795fcc40,0x7ffd795fcc4c,0x7ffd795fcc58
        8⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
      "C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2236
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 1280
        5⤵
        Program crash
        
        PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
      "C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1708
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c start context.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7392
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7572
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7592
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:2032
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3836
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2956
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6376
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7000
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 607698
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "MaskBathroomCompositionInjection" Participants
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Navy + ..\Temperature + ..\Streaming + ..\Ashley + ..\Ensures + ..\Language + ..\Viruses + ..\Bet + ..\Fla + ..\Asbestos + ..\Width Q
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\607698\Waters.pif
        
        Waters.pif Q
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5684
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "Waters.pif" && timeout 1 && del Waters.pif && Exit"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "Waters.pif"
        8⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:5972
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5220
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe
      "C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:920
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:6344
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:6492
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        
        PID:6264
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 724598
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6344
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "WowLiberalCalOfficer" Weight
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
        
        Thermal.pif y
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\724598\RegAsm.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7976 -s 2472
        8⤵
        Program crash
        
        PID:7800
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3272
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'InstallUtil.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5920
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Tuition" /tr "wscript //B 'C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7544
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & echo URL="C:\Users\Admin\AppData\Local\QuantumDynamics Lab\QuantumFlow.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumFlow.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:7512
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\Admin\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:7620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5052 -ip 5052
1⤵
PID:852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2236 -ip 2236
1⤵
PID:5336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6068

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:4848

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5420

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6868

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:6880

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6560

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7976 -ip 7976
1⤵
PID:7772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0008c97c-66c6-400f-ae19-769430631996.tmp

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\0008c97c-66c6-400f-ae19-769430631996.tmp
Size 520B
SHA256 db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
MD5 d7bdecbddac6262e516e22a4d6f24f0b
SHA1 1a633ee43641fa78fbe959d13fa18654fd4a90be
SHA512 1e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
MD5 SHA1 SHA512

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ko.ps1

Path C:\Users\Admin\1000032042\ko.ps1
Size 912B
SHA256 ac8a8901a5dd0728c8626015e509a856c257b2a0e5405d41f7cc0563c7ed28a5
MD5 fd20fbea11d956f653e48e57533f16b1
SHA1 a852c78bb32389fb4c5abd7d7e748e4ddc4a3695
SHA512 fbdae6b8dca3cd596afa8cb54846fb704a89033d34ba8cf7983dd6c288fa318120a09e12b244a1d8b43fa028873f036464fdac05e8f66bff1571d933bde94b53
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Crashpad\settings.dat
Size 40B
SHA256 caf2fd97129bead8490c81f7fe25f8c82adacc2b586115b50ad25d2f45a0ecf0
MD5 3b5f5d896eb76e2a67cbd04f7073ca21
SHA1 c1e570beaad51430794054997d706d7d7abad775
SHA512 d26f5b70578f11bc66ad48534f7dfb743d04c8e534d9a7e574084f3401ae8135ab8ab86ef7b12519cb3b4affd39858d1b73a500ab35071e7be2d8c884c387717
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 4bcb1c90d57662480bc1071a69137826b36ffdb694b8ce762d3f7337840d4c91
MD5 571be346748c851f3ed686a393935037
SHA1 6f7b32def9662df0d196e6def154369efda67901
SHA512 111d36a48d8bdadf50e0b75593259592800e75b205632571f16c412ed8c659551f9cfa14781b9caf0a7bc0d0586db6eb8b5230bd7ce969d5d01091c2e248d23d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 55ce8f1a0e1ef6f014425a10ff750e15e4fc5e099683fffeec0f380983cd5748
MD5 5fbc86b83a42bace2691956d4c9bde69
SHA1 b4ce5cec8cbfa160aa5551275511c548ae30f44b
SHA512 8723154914579b2f8a260ee1e7257048ee075f8b97ea030801b55aa87747fb37d2f7528f837838a77794c844b6250070a2aa5187c244287fde9d4f17289cef9e
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.82.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State
Size 2KB
SHA256 f149d79c268e14e8de33fd54bc57642a200262e5b67ea1a821200de6df2f8cd4
MD5 23a470172b144130f0e40c642bdb9039
SHA1 02083ed58b7b62120f8bb55b7795a41b7e2c9009
SHA512 1b1bd6a1b5473315cb3444a5e4729009f89c65ca8bb473e1860fc90777b297e29f29dc78fc648410a8ed92a9598f103c80cdbd8269b3514327820d6ecefebe4e
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe5935eb.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\Network Persistent State~RFe5935eb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 9KB
SHA256 e34577b6ecff11934e8f5737e908ec6446ea77c876ed54737f146a1b76798578
MD5 61b59026586a8ad1e807540e50994f2e
SHA1 81ec7414812dadb4848a933e82cf4c798fd51f56
SHA512 c92ff29e3d8c4a90b7c029e037218bbe6eb9f6c9a010cadb5718778494f5338f37e4f83755c9095220f4d543c461fdcf34090e0b5e45ed47c62adb9fe7273bf0
SSDEEP 192:rSJZlM8Fgds6hXV+F9Fu/Etl18r8y4Po6yIsnVdg4:rSJ6ds6hXG9I/EtMr8ys4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 8KB
SHA256 639da1936be6942db707be0fc330a6d59d3ecebbf668cb5a3de44037a1247ddc
MD5 c5102a2a9bdb288b78a8b7ad8b08c3b8
SHA1 d770e033dfbf146faaf5db0c48421f47f193d3b6
SHA512 08c695e2cee220479e6e03fb0e981e619446a6646f1cc0d43d2572c974674a5944f56f7e1058f42c7594a21ecb229b2e5da0af4c9016dbf41cd4f5f092d95627
SSDEEP 192:rSJdkFgds6hXV+F9Fu/EtE18r8yDPo6yIsnVdg4:rSJVds6hXG9I/EtZr8yh4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 9KB
SHA256 0b54e4753855ffba780e52ae5d75ddcc1aef7ce140396d557ce43f6fe46000f0
MD5 afc64ed87c53f19c1e9f47b4b620b8c2
SHA1 353060b71abe5a4c9addc07ba106249390fab126
SHA512 6ac81300e4c9b701209261815432576717448c46f61ea9e48ee717e21763d142a4c9ac1ba39c09e96f01852b2db825e5ce8827b9158ddad8d121c6ea2b126985
SSDEEP 192:rSJZlMlFgds6hXV+F9Fu/EtE18r8yDPo6yIsnVdg4:rSJJds6hXG9I/EtZr8yh4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences
Size 9KB
SHA256 4a4e2e4094a19d08f141728f7dbbf9b33d1f1355ba3fce665bb7eeb33bab465d
MD5 362c509d527c08b2603594669339c185
SHA1 daad2109d3df5a8dd07eb16f8aaec5d905e33ace
SHA512 561d5cf01631ccdfe4638ec3f4ee31f24e4ce054c83f7b20aedfaf228e66959f55de232b6499ea3b398bb100993415f288654d5f0918f061f2a8485d5bbd36aa
SSDEEP 192:rSJZlM7Fgds6hXV+F9Fu/Etl18r8y4Po6yIsnVdg4:rSJrds6hXG9I/EtMr8ys4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences~RFe58414a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Preferences~RFe58414a.TMP
Size 1KB
SHA256 f43fde6f54ef360492c2f86144e14fc7da2a0793464876b0db7d794b14a6d9dd
MD5 23bb023b6adac4f5f18c89712847c051
SHA1 1024fc50d254d66a2db93c8aba065e240357976a
SHA512 186f7c9f0048704cfbf27bcb37d312ed960f2b2509bab9d4e577b0927f415e9fc9aaa6a7d325c8231628fa7f043192a636438f1805481977a22d7ed0b2f336e4
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences
Size 13KB
SHA256 987dd8da43cb8167aec8006d2197e6d30520d8032ce6866241b061d738b31f29
MD5 69d28688f05219284cd49e7faa0c1850
SHA1 441c5dd72354a200ad8ca22d0e20705cc6f21aa0
SHA512 d844d6e55c4c85809d1a1a5435a83a2f9028406378f59a1543524c38b6095f5481ec83c4af58d05b4afc905ddad8305bd5e303df80b7ffeffeca46d4c2ed3dd9
SSDEEP 384:8EPP7pLhLcGQ0tX/v1kXqKf/pUZNCgVLH2HfSUVrUAv9Tr8yk:8SP7pLhLLNJ/v1kXqKf/pUZNCgVLH2Hm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences~RFe5868c7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Secure Preferences~RFe5868c7.TMP
Size 10KB
SHA256 a4564597b4004053c84f04086a15418de30a84344a20c6f525ae27fb5f9f1392
MD5 e6c5015b42dad7bad369a926b8961b67
SHA1 c475035ae9e86d4f4ac6c0306b72d46fba7ec61c
SHA512 413ec858fea0efe0faf0a8dacd05be4411f6c57121c2524c0135eff23dae728de76655bcaa92dc1c22f429e83267d8ac49410df6225159d52fbc573e31bed0ab
SSDEEP 192:8E4m9tXzzv1kXqK4I40pUZNCgVLHrKHfF8UVrUXQ81dmNAw9Tr8yDgV:8EBtX/v1kXqKf/pUZNCgVLH2HfSUVrU3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 87770b794ba6a0314decb5aefecbae1806bed907db68c146b12ca1a1d3150926
MD5 caaf293a258b7ea4023895f02d5942c8
SHA1 a93d3cdf7348c8517f5bc72b2f79badaaf960ebe
SHA512 2895c2a10f7177737dc1a6ad3604db8f9aa837947e278369ca54c84517ba4549bf52d9e320263f1724068462031feafafa0c81e695786654c13ea96918724676
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe589258.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589258.TMP
Size 72B
SHA256 439299c4b7bb09f1b865d1ea4e4d6f1d6a8cc3215bb9ed540c21d6b9785bcb37
MD5 9a135483e1f1992a687132f1c18056ad
SHA1 69a21b35bf325ffcc0398db0f4b9558f9c0abfe8
SHA512 d6b92f105b3810cfea08e06a58a82ef48a7cce4edc22df9b85c40f3774d4600d41f1047851a89d7756ebe675e5aa3e1171ef2effffd857cab584ca052c2a3161
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 91289705a496311822aa52d067f2a029025293f1c22779f3a8bc483e211ce1d8
MD5 40c4ea664da063cccf37a00d0dea5f88
SHA1 f524c4c8544d5e8b7d5a29ba74fbe865c0fa303b
SHA512 bbe182958560fa196423bc1b50575b078e4a3b2b170427074442a42a3f21ae7d91d3115e75f38335c778070142d2d1bc929bfa22bf0fb2ae644c0478f6d58d51
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 102aeb88e02ce1cd5c91ce4ab3c5880be33b6a440ee7f24c9e38741e79b46273
MD5 9e1a6c45e7a5b26e6dfcb060fe4ec411
SHA1 8895839baaf4a6ce1189fd8c5572c3c8298ddcc0
SHA512 323180dbdb0ebed3f398d5e7233f681ec85bd0815ef463d8351e17e99ee6f9f47badc9bdd9ab197249fe85e2c0d2457760f7bb7550c9c55110f333d13bfbe8fb
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 dc78a4be5b92c40c32dbbd4bcc3c65057105db062c088fadcf835a5e161095a1
MD5 65e00211feede352e87ff869cd3d1b1e
SHA1 2ede8e165651f24a165f31bd2b4591d124d5fdde
SHA512 1fec808d0591868de3e27863e095ded619cfb825239eb05aab61f9ddb09bca28534e5a1a6f0d39a47affb7a3371d07cca9701b8dabcd297ff2fd116c9123fe61
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png
Size 1024B
SHA256 3d7283090cf1a87baae4032266e4d144f7ec2ea465e7b2bf02728aa394c678f0
MD5 ca6289a7d8f9ecc17f8de717faf1af27
SHA1 4ccf3c6a9291f0a8a3090c22aca6f1872c860073
SHA512 100fb108d3eb74eea016af82a5a6758f22173b3d9a60c5237e9a570aa14549397b224d9d4234661855ffec47930a33536d05c0eb56ac61c551184fa89b18697c
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png
Size 1KB
SHA256 6e21221baad8ccd2b71542f9d3194dc5868c0f424fea640cd4915fbdb32f4804
MD5 06c47df56a44e6ec6ed68a0c1b13fcf1
SHA1 d081069ab4c69925e2c5a8e7bb9a683f620dadb2
SHA512 e23731119c43850604eaa83c7fc17cff43681890ba3e144cc0b97cc8b33dc3f90a5370c7ae599c5469e33fcffed6492308451a0f3699bca51df665a70329a569
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png
Size 1KB
SHA256 2a8f1a1cfac4fbe96a6cb69e9e621201875cc45b2e60bc75b08ea193c759e346
MD5 fa9b6bd6c167dc772018d4105b7f3afd
SHA1 5a8b1a8bec14f864d559667c79683735508a8036
SHA512 db8b36ed049e357346a6c249dacf54a78bf7395ab8a3c8f8d2aa8d575193f59959cddfc7e1ec18b32a029aa1cfd42ffe30149d74de56d88baa0583a6c00d9a9f
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 36670568a87c7b3cd1a4448ffe5bde9b6fd3d65b58e6dca38cc4ea2e9e8c11b3
MD5 cfd1c4fa219ea739c219d4fb8c9ccf8d
SHA1 1bd9c4a0c08a594966efe48802af8cdd46aa724c
SHA512 59918179057447aa18668abbdaacd11ee3f5e83c25a93f916a050a559ea1457d6ab61abd3db9def22b5214a1767911e9cf9fa8e638852032cca3696424c6a903
MD5 SHA1 SHA512

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 fa58e3209e408e4f0d60a7ed330d6f62884ccf9b593e37cde03e7916c116dd1f
MD5 f484337ddad3b425b5788e5ce7082bc8
SHA1 79c7e4c0202a06ef3a287cc76ea498fcf26009c2
SHA512 518a8e3d53fe86dc714a59cc70f8f0c44396d7569d25837c1cfe6212a10204080e0c4d19c43729f1815093af9f075693decbb9496700a2f00bd57dd3ed0b0a3c
MD5 SHA1 SHA512

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 2KB
SHA256 80c1e2f4d89d5266f82dc0295f232eda894812820c5c625a036adf980536e5a8
MD5 9ca95e4d4941acee74cd1bef23eaba35
SHA1 1717e5136bf97a89b5dca5178f4d4d320b21fb48
SHA512 9fb11e36e626b0d9eb43548ba0e90cda27e70d027361c52437f01287e94f07d07da01a385ee2466963e305516f56e37020644ce03d1132322d7e796440c633b5
MD5 SHA1 SHA512

Submit Download

128.png

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Default\Web Applications\Temp\scoped_dir6116_1244472094\Icons\128.png
Size 5KB
SHA256 8a9434f0ede8c6edf65f8d5750852be574847a62a4534e1b6b372078463b6d04
MD5 c592b8809b071c071577fff963bd1ad5
SHA1 f628a6edd48da4aebdfdc05ee3ce852b27706cee
SHA512 418f074fe6b91e4393bc670a75d26db28ddfa370e3b33c17db2a402dd008175be910c3fe9714051d55c13fb28d3901fc6e7e81f73587144d053d8b25bf9c8c90
SSDEEP 96:xl0NgAMSinf795k4ITgiEAyaD39SOOcqS+e60qq/zsB:X0Ngpf795k4CwG9ST3S0wzsB
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 116KB
SHA256 481bcce9052426a1986a132c83960d60022017316582f3efd7f4f3f2248d81bc
MD5 26bc6855c89b496cc400551466796726
SHA1 7ad11057cb765dc85f532ae9e61f506652c4ee4a
SHA512 a79d53af499c337e17803e72f64548fc0ab9eb75b73cd1d74d292d95ad992cd12f8666946e86af79b3b6d6020a06ca5ad86d7650baa358d4dab304562e145c78
SSDEEP 3072:IBLd5RuKHDNqZthmCTEvWGybQxkgZGOUWDwAOAHjWz:Ihd5RuKHBqseEOXbQHZGOlDwAxCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State
Size 116KB
SHA256 e6b70fe2890ecd78ca8a95745fdbc89532873fb20da8746f67441d8343b24126
MD5 b401785cacd79de77f57609668cba40b
SHA1 90d675a74d414588124cd8ce5e2bf7fdcc66aa94
SHA512 b586942a4efdffbbaa43a0bcf4475dbbb765bbfaae1b387b131e0802b8c644794dcff4120627bb97291b4a360829b04787dbc135a8c16123f1ca32f8fe379a2c
SSDEEP 3072:nBLd5RuKHDNqZthmCTEvWGybQxkgZGOUWDwAOAHjWz:nhd5RuKHBqseEOXbQHZGOlDwAxCz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State~RFe58414a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User\Local State~RFe58414a.TMP
Size 932B
SHA256 e2355400e32a52d33352e6761fa1e5bcb67c1cc7582c7764d6f33775a364945b
MD5 89f78f343da3b828b16b5da50b218ea4
SHA1 7d19d60a08319c9dea4de11d91d371fadca744b2
SHA512 178cb7c962c5f22bd0fa5d78fb8f2ef736fc5c8122203bb8352b3e0ddeb72499c636ee19b21b729e67602233e4ded2db85a1a2f948fe158adc1788eea8f9b53c
MD5 SHA1 SHA512

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Size 2KB
SHA256 2bc71ddd63acfb9d101892e29033c75b4023727e1cadc489ecb2421c1960eaa8
MD5 e34b053c93dcb4160094249280888117
SHA1 bd7cd93042c200c5fb012bccf3cd9f72d7e79cef
SHA512 f8753ec3f9f413e1fac84caa1905509a978dfc63211dcd0a889a4283840ae2e6e9101e1f7ee7d582acc5e0ae722fdab8f6047aa02cee28869a094b4f494897f2
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 311B
SHA256 aaa7a547737c57102e6795bdb0e0079d77265cf0b6ecf9f02a9c796ac45c7c02
MD5 f6f887439a6937f627ce546146328158
SHA1 e5e5f407d19a4ab14a7dc4aacb589cfbbc189702
SHA512 88d8d26541cae3724caec753906aff1be490cf9be923d9fb14bef4e23fd273874628b650ec8f5c7fee74180e029b5c2f871ab87c1d9d3ae04b7af3aa3cd2b89f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 02a908b337d32d895ba327f385f4f088e7cf57d6e7a2dc1b455914aa259381fe
MD5 64b91e3c8d249635ce71e1646d8207f4
SHA1 9c35b9d44cc03ba30f92faa9c87b0222db44603a
SHA512 9a3a7f5ce1962101c1eea9250d453283db9ddf04bf631580c823ec102f5e69822c8cb5c7dac8f1fb9a2ba5877c95b9bb3c57296af69cc517bd02cce724d0ac1e
SSDEEP 96:nokz2p13eQLSFhPwpvWMoiVmdeH/bOUWQyV+VDCziEwb:nokzOheRFhPGWMXKro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 98e762288c0cd64cff48fe768334c1d816bacc02e71026f16037846c0b1e1389
MD5 204fa74f07413fc5c3040bdae143ef8a
SHA1 93eb7aa5f194f657773b859c4a821a59cfaf1328
SHA512 5f3062de980b7aa4f8da8f6768775b1bf4fb2f0339b0884dcdb15d7d00be6f4436a5338501b36c20ea9e02e440e723cdb2a432384d2bc75601e56b7af6f8abfa
SSDEEP 96:nokzop13eQLSFhPwpvWMoiVmdeH/bOUWQyV+VD7AiEwb:nokzIheRFhPGWMXKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9b18d4dde887bd3c9f8f73ae68de93103d1bb37ee1217e3c9577f3e2eeae2c25
MD5 8b245d7cdf57dbb0d165828687262dbd
SHA1 eb48e4010b36ff4b1d0c2133d07f9796b00cfc2a
SHA512 d64ea32b301d750b3697189bfbbd712259818cacb2862fc96831d7b881333aea37fb4f84023335e3264869f697fee11ebecd3209008b2b73fe2875d9e4a879cc
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup7be2RU8xNWIcM/bo5ZxV:+9iIxuERzA83h09RZxY7LXfqZxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 816cdfcdc659bc4acba1715e95335b792c1a2934b8357fdc4f96b8ea9d2f2da0
MD5 7c5a89b056702550d0bcaf83366c9ea9
SHA1 d82f0869adeb3f480a352116b0ab09e20783253b
SHA512 cb3c37feb7301deb473781f9da11a399fe67a09b49c11db010cc5ed08c8d68a1425bf8c40186ff0485037a250e0abfe2b15859dce9c6b04428cd89659bc8cec1
SSDEEP 384:6sf+B09i+55lb6/BFr2QkQo9o2TVK6seYwME/F03SoZZfYSgojEDkSQ0gdMtkKhD:HfDD+/3rmlo2TVNfruSEW2ED/Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
Size 314KB
SHA256 d56a1a5602b5e72b8b9b2d6f2e0c5bc689682d0983f30b8c66dad9af093679b3
MD5 f2d385ddbb2edafacd070f103f7f1576
SHA1 5ee6cb80bc943476067c148e5c16738b7b062029
SHA512 e6ee00d15483ef29fb7e48ed28833ce5059f7bfada96b92c350246f6032f85d318571950bf6d2ee557e417e87d24d90965aa1523782416792fa7eb7354266df5
SSDEEP 6144:8KNfu572RY1YNfnlxThJDfeDp7B9wNjudYHpHNHqQtb4qNp28Rrm:82Gt2RhNfz/u1B9wNSd0UQF4t8pm
MD5 SHA1 SHA512 SSDEEP

Submit Download

12dsvc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000004001\12dsvc.exe
Size 1006KB
SHA256 799d10acbb0e2886c4d32c771964f4c2cb47f93c817cdc26a9acaefa3ba042cb
MD5 c005d4ffa3e28c22b41a9d222598260a
SHA1 57cc3a6540bc38c649ddfdd54fa4f3c8a2423677
SHA512 ce39903c46160deeee1c7b362000361a3f5a9243b2e180bbaafa5b8ab09cc09ca413ce32f4deb2074fa928110d25b3dae7465c849fc388a58ddf649a9caa3a68
SSDEEP 24576:WdZE+NmjQ5WymWeoSAj6YztpJF+6Xkb1rlNF:YZbAjQ5WZW2KNFNXmF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nework.exe

Path C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

53bb5484ab.exe

Path C:\Users\Admin\AppData\Local\Temp\1000034001\53bb5484ab.exe
Size 1.8MB
SHA256 bd9587f3695a5371e9cab7e1ee3195acf6cc87d61beaffa5cedeaab19a9eb08f
MD5 4fb2d57ca858e8992808938bb23eef46
SHA1 14559e576016904d880b7c950a31c0c3945b3d19
SHA512 5f63f350133f4fcfe983fb8432f331fd5e7f4431fa3689eae9008a7d966208d4ffdd2b1152cd016623c33291c90a031c8947e04ae9419558b13a8c0ba6454340
SSDEEP 24576:aTVlLgIkhGeCxydsPxWdXpdO2kzq22vvWMCgrHOZ62GqXQ79HVFMQyddhMr3nAR+:glA0edsZkC2WMnQ6dpH0JDqr3cGlS6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
Size 187KB
SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
MD5 7a02aa17200aeac25a375f290a4b4c95
SHA1 7cc94ca64268a9a9451fb6b682be42374afc22fd
SHA512 f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6
SSDEEP 3072:QJlVTFj5qDao8KaxfE54HnnGSail+bOX8bX60UFHJKa:QJP5j5Ka2aOanGSabY860UFpKa
MD5 SHA1 SHA512 SSDEEP

Submit Download

javumar2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000068001\javumar2.exe
Size 12.8MB
SHA256 ea8f9e43b89dd8c9ecd7d5413fe82ca75e5acd0d99ea00b9841117361676df0a
MD5 534704bd30b2d7af9e4537980a8474b1
SHA1 e4c78f68d7cb4e7c7ded41bf952044a9b5a8d8f0
SHA512 44e51dacdeffc57f968724cc10111499b6cad4a824393241daa4337e6d614ff097bd0b905e04edda7de9a066cc6b7b4994dd077e3c84db522270e0431f6ce989
SSDEEP 393216:l1lGKmvogvkdaIcCswqiNnEVkfvBF0jbRfOFYuRZAKmjpAdcum1kX:YogvkdaI+nm5jnC+dcmX
MD5 SHA1 SHA512 SSDEEP

Submit Download

javtestnoreport.exe

Path C:\Users\Admin\AppData\Local\Temp\1000070001\javtestnoreport.exe
Size 989KB
SHA256 8c3c459481bb940ad69a704a041516f42012775c60f288c731a394954e3eda3c
MD5 f0cb6a0555896e017b2f778a847b0196
SHA1 918e72af4ce78588f2d6fad65a91256ad69e1d8c
SHA512 af5ab34ba0faad80926c39bd97ae9e7521e1ae7a94ef7e71c20a837797cceaa01d728e186c8f75f754e535ff92a7c46e721aad43076fd6b855520971e4251e80
SSDEEP 24576:7NS52sMI17mQry3RBlcqSrRKx1S4u41o8QZFUIrGXLM6:7NS5717UbB1Hul84FaXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

needmoney.exe

Path C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
Size 4.1MB
SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
MD5 7fa5c660d124162c405984d14042506f
SHA1 69f0dff06ff1911b97a2a0aa4ca9046b722c6b2f
SHA512 d50848adbfe75f509414acc97096dad191ae4cef54752bdddcb227ffc0f59bfd2770561e7b3c2a14f4a1423215f05847206ad5c242c7fd5b0655edf513b22f6c
SSDEEP 98304:if7X0ZueTTPs6deIF+iHtcbBt2VSFjUCaZ:8bPeVdeIMiHmbeVS
MD5 SHA1 SHA512 SSDEEP

Submit Download

penis.exe

Path C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
Size 409KB
SHA256 87e639ecc7704cb5e29f1ebb1d8ade3ae863aaa2505a37b28f2d45121da500c6
MD5 a21700718c70ec5e787ad373cb72a757
SHA1 027554ab5ff3245e7617f3b83d6548bf7919f92e
SHA512 ea292a5442d9fe536e650a2bc5142dd3aef79c66930243897e0e87c57915f0a54e45e03e58daffb473f85fe10b963d4670050bff5ab3f91121d21d463e25659b
SSDEEP 6144:hVPD7/k5hjsld/TWx3EY9lwXtaW1G4kM0u0b2KrqBDW:hVPHXM31SC4kVu0rGB6
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypted.exe

Path C:\Users\Admin\AppData\Local\Temp\1000290001\crypted.exe
Size 314KB
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
SSDEEP 6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

LummaC222222.exe

Path C:\Users\Admin\AppData\Local\Temp\1000314001\LummaC222222.exe
Size 352KB
SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
MD5 2f1d09f64218fffe7243a8b44345b27e
SHA1 72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA512 5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909
SSDEEP 6144:yEIbJdhhk012D9kEsrwRdvwoShfvM4MH0RoeAcGho33vXvIKgI5TdFaA51TIrxLD:yEIbJvhk0azddWtyA51C09ssEN8mhGfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

newbundle2.exe

Path C:\Users\Admin\AppData\Local\Temp\1000322001\newbundle2.exe
Size 304KB
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP 3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rstxdhuj.exe

Path C:\Users\Admin\AppData\Local\Temp\1000342001\rstxdhuj.exe
Size 963KB
SHA256 0cced5b50789fca3ad4b2c151b798363d712da04c377bd704dcef4898e66b2b4
MD5 1ef39c8bc5799aa381fe093a1f2d532a
SHA1 57eabb02a7c43c9682988227dd470734cc75edb2
SHA512 13a9c267c4ceb2bd176f1339faa035ffeb08936deeeb4e38252ea43cfe487ea1c1876e4cc2a965548e767af02805a1da62885e6538da056be0c6fae33b637682
SSDEEP 24576:6MGVJ/Oap+Bh45LEwaV1QghDHm5GQTSmGg:6NJ/jpi5waVhjm5GQ2m7
MD5 SHA1 SHA512 SSDEEP

Submit Download

e731f96cac.exe

Path C:\Users\Admin\AppData\Local\Temp\1000354001\e731f96cac.exe
Size 1.8MB
SHA256 b99711aa1ee5a0ca9cfcc53dff0ffcab9f2800afad74a0633b1488fe2afa47b7
MD5 e904093ef887cb372b3fe7ab75e6c6c7
SHA1 aece57bd3cbb0bc1818fe026100f30783a6e3f55
SHA512 6876fa64ce5fc0f7a2b80368d2128b96262cf2dc9889bb2f5d3068c20dfd04f37fecd3095e941535cbc1de9be996411b3f617062f7364bf2ad28b404843dfd2d
SSDEEP 49152:cusYocs8XFCmtRatofH5UIcOKO6KSRcIleAuFdJ:ck9s8XAuRy4H5CR9WoeAu
MD5 SHA1 SHA512 SSDEEP

Submit Download

fb4c9a74e3.exe

Path C:\Users\Admin\AppData\Local\Temp\1000355001\fb4c9a74e3.exe
Size 1.8MB
SHA256 c194ede82aef96a80956563d18eef70e2a13d68d544f740f0c5ea058e7f2e029
MD5 2f8c50a4814ec4de08e5db7de9c21f7e
SHA1 7bbb4f3e09eabfa9db6763832ab6a1223d3854fe
SHA512 3ce6312c0d7505412f2701e83601cff924413e4ed32ce094b727353edd3634d3933415fbe2ca6b0d45fff746d71b8204a92f1346f785acc116c4c64a074788ff
SSDEEP 49152:nU7phLgl7xzLwkQvSq4j93ZsXiDgQEDpuKd:n8h47JENKqm9yybBKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lummetc.exe

Path C:\Users\Admin\AppData\Local\Temp\1000365001\lummetc.exe
Size 352KB
SHA256 13167320a0e8266a56694be70a9560c83e2c645d6eeaa147b9ae585c2960ebb2
MD5 2fe92adf3fe6c95c045d07f3d2ecd2ed
SHA1 42d1d4b670b60ff3f27c3cc5b8134b67e9c4a138
SHA512 0af7b4a3ce3981707ca450b90829a4a8e933ea3cd3affbce738265a1a0647e96323117db325d0e5e3884f67f36b21b8c955b6c3c6dda21d9b01212e28ef88d65
SSDEEP 6144:hgyBZvU9zGoDa09h6Dp9LCFWmx7OeCZ3Uhj3lRnx:myBQKoDTP6F9Lw9kCjz
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\AppData\Local\Temp\1000367001\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64.exe

Path C:\Users\Admin\AppData\Local\Temp\1000368001\splwow64.exe
Size 1.3MB
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455
SSDEEP 24576:b9yEBs1ZKaxv6rRVO9VdLCjJehm4v2TeLUzguXpdQhgRQ7SoYafkW:bxqZK66rb4V0cxtQzv5dQhgRQ7SxID
MD5 SHA1 SHA512 SSDEEP

Submit Download

PkContent.exe

Path C:\Users\Admin\AppData\Local\Temp\1000370001\PkContent.exe
Size 810KB
SHA256 b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c
MD5 87c051a77edc0cc77a4d791ef72367d1
SHA1 5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5
SHA512 259a3f823d5051fcc9e87ceacf25557ab17f5d26ff4f0c17801d9ef83a23d2a51261a73e5ba9c3caf1ca2feb18a569458f17a2a5d56b542b86d6a124a42d4c2c
SSDEEP 12288:FCxMe2dk7YgL+OsQdFGHjaRYf9bquEZ68ufU3wqB2ydPsW/w0bvf:FsMe2KYIDpSO5vZ68FwqB2aPsW3
MD5 SHA1 SHA512 SSDEEP

Submit Download

1fd46f3f-face-45be-8c19-7fcb2e08d167.tmp

Path C:\Users\Admin\AppData\Local\Temp\1fd46f3f-face-45be-8c19-7fcb2e08d167.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

axplong.exe

Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
Size 1.9MB
SHA256 c438ad0f0d3f595677bfd83cfbab377224cdcc7275f7954639c113e767e8ddf5
MD5 b8fc8a5801e3c0172a199430c7dba1d6
SHA1 2a53f4961410bea07de2259fd7875b30ae6a7856
SHA512 b6a2e23babec64712408dbf0e1a9ce5720a4aff14c6de3e90a756c00ec97d01f394a18608de1cb2a90f87ce6c6fa8b4829ca57f77b8c110462b65af10e9ba3ec
SSDEEP 49152:Pfxsg8rRSzxCa2w6G/fSrvYMSdkhNebdu:HxaVo0w6oKbYXdkhuc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\607698\Q
Size 794KB
SHA256 361e9c3b62719b79bc280420b5f710e160fd55f2250bf605911ded7162483db4
MD5 7b5632dcd418bcbae2a9009dbaf85f37
SHA1 32aaf06166854718f0bcbb2f7173c2732cfb4d33
SHA512 c834e90ccf2d35529c294319b8e9a49db7a7d67d0567e0739131d5af51170db32076d68147dc101f8047a75cb5b2275b25a9c8346a99a146a6798b9764316838
SSDEEP 12288:LtQJu7osksZQ7FuV65iFeG1bdMpX+rLvW6hwpos+s5E/RjyGF3tgO85c1XLwaMBO:LtOHrFuhF31iWB4zuNtIuXLuY9v1Pd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Thermal.pif

Path C:\Users\Admin\AppData\Local\Temp\724598\Thermal.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

862842986254

Path C:\Users\Admin\AppData\Local\Temp\862842986254
Size 81KB
SHA256 e43d8e716df518091e91b2d6edce993d7ccf2a7b448cdabf3fb9e8eb99b753d7
MD5 9add9d09ddf9608863526d8d7045d6b5
SHA1 9db417169d41724373d03ac5448c447452882723
SHA512 3876377af541349f709b827e6e8e0545de340d3ee98f7c17b348d14bd2d347af95f127d953f6859423776093ccb70e968439e259a1b857a71a912699f0405d75
SSDEEP 1536:s1tBlUqSCgwVgb7nCkBR+PTEp6aVhB4J1colYzZy6Fj41gzNDgoRnFgT:G3Uugk47Ck0PThmhBvo8y6F0azxtna
MD5 SHA1 SHA512 SSDEEP

Submit Download

Emotions

Path C:\Users\Admin\AppData\Local\Temp\Emotions
Size 19KB
SHA256 2bc28afb291ece550a7cd2d0c5c060730eb1981d1cf122558d6971526c637eb4
MD5 b98d78c3abe777a5474a60e970a674ad
SHA1 079e438485e46aff758e2dff4356fdd2c7575d78
SHA512 6218413866237bc1f6eada6554658a00c9fc55402e104576b33a2e8d4adf0fd952d8cc8d1ae3a02ebcfa030115fc388fc1a6f23b9d372f808e11e1b551064e5d
SSDEEP 384:vLaGlKPODYuBO3zViP3suELSs/APtOSFaOMJJj0xJUb+OeFB2l5UWiSiSK:vLaVWYn3isuELD/OtOHTCOcBS59isK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp9451.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9451.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_x3y124i3.ahs.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x3y124i3.ahs.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

c9f4ea81-cd58-40e9-a43c-e7ee6f5a3d9d.tmp

Path C:\Users\Admin\AppData\Local\Temp\c9f4ea81-cd58-40e9-a43c-e7ee6f5a3d9d.tmp
Size 132KB
SHA256 e59d727ad2f2ea2612506af5418a2ebf5974f16f7aaa9f7497bc92d75a451624
MD5 e2d2f826a2253da9da88faea320734db
SHA1 17b24a01c01485399600196b6aa68456f070942f
SHA512 ad0686dab396d77cbf6a39628aca8a712793257232eaf43e4cd27a27b32a7411fd2755bcbd92d3a9a7acf32b0e7974ac65fbc5b28615d91f48558acac7af767d
SSDEEP 3072:UkRVM2UmpEnnqpVaA7OtL8JsHWrq9p8y9VF2mcNG6NQBqB0hUVkFCPznHQiCg8Cm:TRVpvKMVuL8GIq9uy9S7G6NvmPFCjHKh
MD5 SHA1 SHA512 SSDEEP

Submit Download

javumar2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IEKS9.tmp\javumar2.tmp
Size 3.2MB
SHA256 37a2fe2fe9edf836698d72ba673bdcc648c09d75e7000be7fca7dda8b61f2be4
MD5 97dce6295efe4b54ef6cf3e7d344530d
SHA1 037df420c8dfb42cb7566f1435ba7d31c33ac0e9
SHA512 f4ab1e15f3334de9b499e475a2608bc0d864dccf2f40f7b92421b21cc9d368c2305ba0be8e06152bb42570d2adabdb96c76713cc9d1fe54b4d4c75843fdc6b20
SSDEEP 98304:nJYVM+LtVt3P/KuG2ONG9iqLRQE9333T:2VL/tnHGYiql5F
MD5 SHA1 SHA512 SSDEEP

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-IJB5F.tmp\_isetup\_isdecmp.dll
Size 28KB
SHA256 8287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
MD5 077cb4461a2767383b317eb0c50f5f13
SHA1 584e64f1d162398b7f377ce55a6b5740379c4282
SHA512 b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
SSDEEP 768:BD7FEAbd+EDsIOmF+OiR9rikW/F+M9OAriXiRQU:M07sIOYRiPWkWNl9WXil
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6116_1888033682\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

svchost015.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost015.exe
Size 2.9MB
SHA256 7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b
MD5 b826dd92d78ea2526e465a34324ebeea
SHA1 bf8a0093acfd2eb93c102e1a5745fb080575372e
SHA512 1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17
SSDEEP 49152:/INqIwJA7BYAzLOhHpB63X4oQaM35DhnSYf7bPZcYsO5+th1:wNqC7BZEHSQz5DhnSy7ujL
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5F7B.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp5F7B.tmp.dat
Size 114KB
SHA256 c3aa800492bc1e5ff4717db8c82d1f3772b24579cde51058bdd73a9cc9822dc7
MD5 f0b6304b7b1d85d077205e5df561164a
SHA1 186d8f4596689a9a614cf47fc85f90f0b8704ffe
SHA512 d672ea182ddf56a331d3209dcf7b9af8c3ffad0b787b224fe9e3e4c80205e474a66914358fa253c170c85a8366da2f2c3aa9d42e1f6f3291a9e6bdd9ba51fb0a
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cFqLVumf:I02m/lxhlnmhouHMVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5F91.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp5F91.tmp.dat
Size 5.0MB
SHA256 d1e83b9f571cdd8087d0ba5e2de31ad98ebf2c1156eea86de6ef8dea5fc2adcb
MD5 199d82d11c3c57b35976685dd2c6135f
SHA1 b95c80c6766745ca4049acd19d25e9e60d55871c
SHA512 972db73c22a683a2a68043f53a388978b72f20b2c1411bc69b662b1e66c31dbcb60f142748c6960242da7c58dcabac46b056f6c612612d062b54e38dbf44c14b
SSDEEP 192:28rJQaXoMXp0VW9FxWHMFmnQD9pnyYll31GJK:28r54w0VW3xWYmI
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp60AB.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp60AB.tmp.dat
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

EzLcuMxgF5.exe

Path C:\Users\Admin\AppData\Roaming\EzLcuMxgF5.exe
Size 490KB
SHA256 8707c03158ba6395a11bdfd8c1b11eeedc2e052d3b55d73d0a5c64417e5fbd3b
MD5 b473c40205c61dc4750bc49f779908dd
SHA1 88a0fc0962099f0ac2d827d2c4d691ed9cade251
SHA512 8fbaaa5bde30fe7c6e31a349c14e3bd710e92c4dbcca8cbdbaf34583887bc31e07e10a0223fc6c6c0d091787c296eba139ec91af44ec4ee6abbfb611493951d1
SSDEEP 6144:ChhuRs6j+uinO16pSuHugxyyyuf7CQHKCt/qXiZDo3xOxAAFQXNDHrg49/2CXfG:kuRR8YmpHug/7bXtiyZAcaAFyNR9Oqf
MD5 SHA1 SHA512 SSDEEP

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
Size 2KB
SHA256 484336adfdfd133c6336a221e6bffbaa613074f20172bb32695c9375dfcc6374
MD5 86d788b3e4aaa98f0d7a16dbcbd4b259
SHA1 9848195e062265188dc3a2e8e962daaef6f53ab2
SHA512 d851792eb34fcdba002550ed7a85bd50e6ee987c44de0baab23173144af3cfa9ccde8a00b0abf716d2536c3609f007870b03c25e8aa15913c3a24a63231223bb
MD5 SHA1 SHA512

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-786284298-625481688-3210388970-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1b74ca46-c49b-4c52-a57d-8cd1ff70c625
Size 2KB
SHA256 ab44c347cdb2075bf7d10e5d8fee60ab4ff0e5771db60357798d4d1e3176bf85
MD5 24f5958180f4a200364d3e928dc0e170
SHA1 c4bd6d4e5a3fc3280ccd69f589c464c2db6810ce
SHA512 f8cf846a4ca880c3c654d7ff69746564e542ca68df580dbb9b5f4af0311bab7ef90392ddb5580e8dd86d4f7c919870e871ca4036ec5057151192720529a3c06a
MD5 SHA1 SHA512

Submit Download

jHuFRYRN7w.exe

Path C:\Users\Admin\AppData\Roaming\jHuFRYRN7w.exe
Size 304KB
SHA256 5a00e3718afb5bfb18a6b1c824b680015733f0403af0d5663289a17ba8206cc3
MD5 65c058e4a90d2ec70b03211d768b6ecc
SHA1 bf5af6f650759e5e612d42d72145660056737164
SHA512 3d9114409f8096ce8a1d134a48235fbbad0c6c53f820707a951bac42c4f7ba6a38e98a50c9d929f049042263a7c0e24da8368d3aa4e934f5da79e9bda4a930aa
SSDEEP 3072:Vq6EgY6iYrUjxQMbwPP9ktwT9N3TAVtYSK6VcZqf7D34teqiOLibBOc:cqY6i/wPCKN3TAbYgVcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 a9d7cb990c537410262c28d8017bd8c2ffbdcc9850133a81bf3cc5100f090e4e
MD5 aa60d7755d5a23aaba15d7e1555aa410
SHA1 86161ac3fc74599ef77c21e6d4525d4d2407a330
SHA512 2e51315c3704d082686ee84b93ea15e623e785280051e6482e172ddd9fa76c0234303132dbdff4174972877c00b004c43289782e1b27417ab863d852c8ae35e2
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 efed14402dbda73ef60c40cde4d6095269dd87531980a735f3bb35ad4b598a89
MD5 fba612eeb015040e2746998f014d48bb
SHA1 6a0b6255fd631eeb7a3e5c8378e71410464608a6
SHA512 3370be0f65c58366664475d361be58253ad5eb8e8924f820c36b7f5a6980f420548152e2962efd4e2f20435b7e1003c896cc00f2df2185947edcb4ca6d34d1db
MD5 SHA1 SHA512

Submit Download

memory/212-19-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-200-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-175-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-174-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-199-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-20-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-18-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/212-17-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/856-327-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/856-1550-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/856-330-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1216-63-0x0000000005700000-0x000000000570A000-memory.dmp

Download

memory/1216-139-0x0000000008F20000-0x0000000008F6C000-memory.dmp

Download

memory/1216-125-0x0000000008D50000-0x0000000008D62000-memory.dmp

Download

memory/1216-124-0x0000000008E10000-0x0000000008F1A000-memory.dmp

Download

memory/1216-203-0x0000000009900000-0x0000000009950000-memory.dmp

Download

memory/1216-119-0x0000000006C30000-0x0000000006C4E000-memory.dmp

Download

memory/1216-123-0x0000000007480000-0x0000000007A98000-memory.dmp

Download

memory/1216-57-0x0000000005770000-0x0000000005802000-memory.dmp

Download

memory/1216-42-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/1216-126-0x0000000008DB0000-0x0000000008DEC000-memory.dmp

Download

memory/1216-102-0x00000000065B0000-0x0000000006626000-memory.dmp

Download

memory/1216-52-0x0000000005C80000-0x0000000006224000-memory.dmp

Download

memory/1412-258-0x0000000000740000-0x00000000007AC000-memory.dmp

Download

memory/1504-84-0x00000000009A0000-0x00000000009F2000-memory.dmp

Download

memory/1600-2862-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/1600-2859-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/1708-1655-0x00000000006D0000-0x00000000006D8000-memory.dmp

Download

memory/2420-1859-0x0000000006A60000-0x0000000006A82000-memory.dmp

Download

memory/2420-1847-0x0000000005E50000-0x00000000061A4000-memory.dmp

Download

memory/2420-1857-0x0000000006AC0000-0x0000000006B0C000-memory.dmp

Download

memory/2760-179-0x00000000096B0000-0x0000000009872000-memory.dmp

Download

memory/2760-180-0x0000000009DB0000-0x000000000A2DC000-memory.dmp

Download

memory/2760-101-0x0000000000350000-0x00000000003D0000-memory.dmp

Download

memory/2760-178-0x0000000007F20000-0x0000000007F86000-memory.dmp

Download

memory/2796-350-0x00000000002C0000-0x0000000000312000-memory.dmp

Download

memory/2928-4-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Download

memory/2928-15-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Download

memory/2928-3-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Download

memory/2928-0-0x0000000000BE0000-0x00000000010B2000-memory.dmp

Download

memory/2928-2-0x0000000000BE1000-0x0000000000C0F000-memory.dmp

Download

memory/2928-1-0x0000000077AD4000-0x0000000077AD6000-memory.dmp

Download

memory/3156-280-0x0000000000E70000-0x0000000000EC4000-memory.dmp

Download

memory/3272-1543-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/3272-1545-0x0000000004F80000-0x000000000501C000-memory.dmp

Download

memory/3712-39-0x00000000736EE000-0x00000000736EF000-memory.dmp

Download

memory/3712-40-0x0000000000200000-0x0000000000254000-memory.dmp

Download

memory/3892-437-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-419-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-1536-0x00000000065B0000-0x0000000006604000-memory.dmp

Download

memory/3892-424-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-1521-0x0000000006560000-0x00000000065AC000-memory.dmp

Download

memory/3892-1520-0x00000000062A0000-0x0000000006308000-memory.dmp

Download

memory/3892-432-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-446-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-456-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-417-0x0000000000FB0000-0x00000000010A8000-memory.dmp

Download

memory/3892-418-0x0000000005D30000-0x0000000005E1E000-memory.dmp

Download

memory/3892-434-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-426-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-442-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-464-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-429-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-462-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-460-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-422-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-430-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-420-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-438-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-440-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-444-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-449-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-450-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-452-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-458-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/3892-454-0x0000000005D30000-0x0000000005E18000-memory.dmp

Download

memory/4028-632-0x0000000000DC0000-0x0000000001003000-memory.dmp

Download

memory/4028-207-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4028-173-0x0000000000DC0000-0x0000000001003000-memory.dmp

Download

memory/4408-331-0x0000000000400000-0x000000000081B000-memory.dmp

Download

memory/4608-282-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/5172-1836-0x0000000000030000-0x00000000006CA000-memory.dmp

Download

memory/5172-1819-0x0000000000030000-0x00000000006CA000-memory.dmp

Download

memory/5392-1636-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/5392-1834-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/5420-1812-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/5420-1801-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/5764-1798-0x00000000001C0000-0x000000000085A000-memory.dmp

Download

memory/5764-1775-0x00000000001C0000-0x000000000085A000-memory.dmp

Download

memory/5832-1591-0x00000000004C0000-0x000000000097C000-memory.dmp

Download

memory/5832-1635-0x00000000004C0000-0x000000000097C000-memory.dmp

Download

memory/5920-1771-0x00000000075B0000-0x0000000007653000-memory.dmp

Download

memory/5920-1817-0x00000000078C0000-0x00000000078D4000-memory.dmp

Download

memory/5920-1761-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Download

memory/5920-1796-0x0000000007880000-0x0000000007891000-memory.dmp

Download

memory/5960-1669-0x0000000007E80000-0x00000000084FA000-memory.dmp

Download

memory/5960-1679-0x0000000007B30000-0x0000000007B38000-memory.dmp

Download

memory/5960-1676-0x0000000007A40000-0x0000000007A4E000-memory.dmp

Download

memory/5960-1673-0x0000000007A90000-0x0000000007B26000-memory.dmp

Download

memory/5960-1593-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

Download

memory/5960-1671-0x0000000007880000-0x000000000788A000-memory.dmp

Download

memory/5960-1594-0x00000000055B0000-0x0000000005BD8000-memory.dmp

Download

memory/5960-1670-0x0000000007820000-0x000000000783A000-memory.dmp

Download

memory/5960-1668-0x0000000007750000-0x00000000077F3000-memory.dmp

Download

memory/5960-1667-0x0000000006A70000-0x0000000006A8E000-memory.dmp

Download

memory/5960-1657-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Download

memory/5960-1656-0x0000000006A30000-0x0000000006A62000-memory.dmp

Download

memory/5960-1677-0x0000000007A50000-0x0000000007A64000-memory.dmp

Download

memory/5960-1596-0x0000000005E00000-0x0000000005E66000-memory.dmp

Download

memory/5960-1678-0x0000000007B50000-0x0000000007B6A000-memory.dmp

Download

memory/5960-1674-0x0000000007A10000-0x0000000007A21000-memory.dmp

Download

memory/5960-1627-0x00000000064E0000-0x00000000064FE000-memory.dmp

Download

memory/5960-1595-0x0000000005D60000-0x0000000005D82000-memory.dmp

Download

memory/5960-1607-0x0000000006050000-0x00000000063A4000-memory.dmp

Download

memory/6068-1803-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/6068-1800-0x0000000000910000-0x0000000000DCC000-memory.dmp

Download

memory/6120-1535-0x0000000000D70000-0x000000000140A000-memory.dmp

Download

memory/6120-1576-0x0000000000D70000-0x000000000140A000-memory.dmp

Download

memory/6560-2864-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/6560-2860-0x0000000000770000-0x0000000000C42000-memory.dmp

Download

memory/7068-2052-0x0000000000CF0000-0x000000000119D000-memory.dmp

Download

memory/7068-2169-0x0000000000CF0000-0x000000000119D000-memory.dmp

Download

memory/7976-2792-0x0000000001190000-0x00000000011A8000-memory.dmp

Download

memory/7976-2917-0x00000000076C0000-0x00000000077E2000-memory.dmp

Download

memory/7976-2941-0x0000000007C00000-0x0000000007F54000-memory.dmp

Download

memory/7976-2942-0x00000000074B0000-0x00000000074FC000-memory.dmp

Download