hxxp://blackhost[.]xyz

Analysis

max time kernel
1278s
max time network
1217s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://blackhost.xyz

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
2964	winrar-x64-701.exe
1188	Process not Found
1164	uninstall.exe
328	WinRAR.exe
1524	WinRAR.exe
1460	File Crypter.exe
1840	WinRAR.exe
712	WinRAR.exe
2460	Virus Maker.exe
2864	The Matrix Green.exe
2272	Virus Maker.exe
2432	Hacker.exe
1476	Hacker.exe
2624	Hacker.exe
1132	Hacker.exe
2024	Hacker.exe
2616	Hacker.exe
2592	Hacker.exe
940	Hacker.exe
1248	Hacker.exe
2360	Hacker.exe
3696	Hacker.exe
3352	Hacker.exe
3176	Hacker.exe
4060	Hacker.exe
3504	Hacker.exe
3516	Hacker.exe
3832	Hacker.exe
4536	Hacker.exe
4120	Hacker.exe
4916	Hacker.exe
4792	Hacker.exe
4816	Hacker.exe
4260	Hacker.exe
4520	Hacker.exe
5012	Hacker.exe
5588	Hacker.exe
5196	Hacker.exe
6040	Hacker.exe
5948	Hacker.exe
6080	Hacker.exe
5732	Hacker.exe
5636	Hacker.exe
6428	Hacker.exe
7064	Hacker.exe
6760	Hacker.exe
6612	Hacker.exe
6656	Hacker.exe
7060	Hacker.exe
6268	Hacker.exe
6904	Hacker.exe
7720	Hacker.exe
7340	Hacker.exe
8172	Hacker.exe
8000	Hacker.exe
7304	Hacker.exe
7948	Hacker.exe
6736	Hacker.exe
4344	Hacker.exe
7612	Hacker.exe
8756	Hacker.exe
8376	Hacker.exe
9160	Hacker.exe
9132	Hacker.exe

Loads dropped DLL 17 IoCs

pid	Process
2700	iexplore.exe
2964	winrar-x64-701.exe
1188	Process not Found
1164	uninstall.exe
1164	uninstall.exe
1188	Process not Found
2700	iexplore.exe
2700	iexplore.exe
1188	Process not Found
1188	Process not Found
1188	Process not Found
2700	iexplore.exe
1188	Process not Found
1460	File Crypter.exe
2148	iexplore.exe
1188	Process not Found
684	iexplore.exe

Modifies system executable filetype association 2 TTPs 8 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\WinRAR\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\setup.bat"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 60 IoCs

description	ioc	Process
File created	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt32.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\rarnew.dat	uninstall.exe
File created	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.chm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-48.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\__tmp_rar_sfx_access_check_259611232	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WinCon.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\7zxa.dll	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Zip32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExtPackage.msix	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Rar.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\WhatsNew.txt	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExt.dll	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-64.png	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinCon32.SFX	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarExtInstaller.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\zipnew.dat	uninstall.exe
File opened for modification	C:\Program Files\WinRAR\Descript.ion	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Resources.pri	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Order.htm	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Uninstall.exe	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\UnRAR.exe	winrar-x64-701.exe
File opened for modification	C:\Program Files\WinRAR\Default32.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\Zip.SFX	winrar-x64-701.exe
File created	C:\Program Files\WinRAR\RarFiles.lst	winrar-x64-701.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Virus Maker.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Virus Maker.exe
File created	C:\Windows\setup.bat	cmd.exe
File opened for modification	C:\Windows\setup.bat	cmd.exe
File opened for modification	C:\Windows\win.ini	cmd.exe
File opened for modification	C:\Windows\system.ini	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hacker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = b0ec8fe94e13db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000f4bb662fcf54cccaea8b89601095a1c0d7ad06763c541aad6720f9b438059a73000000000e800000000200002000000003772927e6bb7046d11b878c5dd05975304cb8e851a9c6d217fbaf40a6aff8fcf00000009d0d745552ed2aac4af45469d489e2ffe7e97fbeb9180ac6052f497734c274ad5e7f3b89b21516596aee782c92bea3369ab8a098077dc1cd390b23e10bb05d0d0ea2573e58a66fd29c6a41d29a9d1ce17ac8cb94cc8901d4f5a60e9beefad672c80873a8dfc8107bb041c8a4c8f3defbc82c6b7c6f3fb5e50e275d1a788a20379cd9be84cb01a82fe3317cb5a1032be2ecc85aaa83b8f9f442ab3cd3377007bb0a3ff5830e832c340f6afabb09ba6362cf07ab9ba1aecd03e54dfbc44028ae392545ebfda90c7a0aec866fa8146c5f122974f6388174013ca9ae843834553901e76b4e26d9c6e7ae287e2c21d57941b540000000f1b56e51dc516d3ad28a7eb41691355b92f1f6f1bd29982ff6eac853841b699e61f7da4b0e27a142563e27442b91b66ad07b80c1d28c670781b17fffa7b627eb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	winrar-x64-701.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EC4E3461-7F42-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "4"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url6 = "https://twitter.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url6 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	WinRAR.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000fe4ccb5f1b294565f970c96962dc263ea748d05d30f1a6164eab62ca33695525000000000e80000000020000200000005cf302cd2f6a1b74002321bca6f6b5cee14ff868cfa014a1c4470c2363464b4920000000b6a70c2fb58e188b82b604f69cd1d0bbc856a3392b8f9205f3bab4352c503e03400000005b83a4324c3b6fabd91eb1639764a2bd171b7e497b95162d2177ed0532af0d006d91da4e102eebcdabd2e3fba25cbc963ad8732e16d4d958c6e90d469bf24312	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url2 = 0000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D90F67D1-7F41-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = a07a68794f13db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003d000000900300001d020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000036c33d4fecfe979b2a796d10380fa7ee4dc4eba58382ef2e72c364d48a529adb000000000e80000000020000200000000e8c7353451048e8a835f223353aafdc3d5d75ec729e2b4c431afec20a375c9f200000002e6fdcf6c62d6e039ef651a9e3fae1e4de414e5cb32d62d58f91c3bdd30efd6740000000b62c1b551a0824b71e94e2807d1ee08a4640e2b6485914864875460540999a74efd1c5a593d86adebb18c37f3d3ec660487ed56e30ccc77acc47e3ae11760395	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url4 = 0000000000000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLsTime\url5 = 0000000000000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	WinRAR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url4 = "https://signin.ebay.com/ws/ebayisapi.dll"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://blackhost.xyz/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url3 = "https://login.aliexpress.com/"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TypedURLs\url5 = "https://login.live.com/"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	File Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.ZIP\ = "WinRAR ZIP archive"	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Virus Maker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command	uninstall.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	File Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rev	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	File Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Virus Maker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\ = "WinRAR archive"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,0"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	File Crypter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Virus Maker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B41DB860-64E4-11D2-9906-E49FADC173CA}\InProcServer32\ = "C:\\Program Files\\WinRAR\\rarext.dll"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shellex\DropHandler\ = "{B41DB860-64E4-11D2-9906-E49FADC173CA}"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.7z	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\shell\open\command	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000400000000000000050000000200000003000000ffffffff	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zipx	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\LogicalViewMode = "2"	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\MRUListEx = ffffffff	File Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	File Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\FFlags = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	File Crypter.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WinRAR32\ = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.uue\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.txz	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR\shell\open\command\ = "\"C:\\Program Files\\WinRAR\\WinRAR.exe\" \"%1\""	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinRAR.REV\DefaultIcon\ = "C:\\Program Files\\WinRAR\\WinRAR.exe,1"	uninstall.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}\IconSize = "48"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	File Crypter.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{C4D98F09-6124-4FE0-9942-826416082DA9}	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 19002f433a5c000000000000000000000000000000000000000000	File Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	File Crypter.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	File Crypter.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\17\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.taz\ = "WinRAR"	uninstall.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	File Crypter.exe

Modifies registry key 1 TTPs 64 IoCs

Modify Registry

T1112

pid	Process
17652	Process not Found
3192	reg.exe
25424	Process not Found
3016	reg.exe
13808	reg.exe
15900	reg.exe
23464	Process not Found
24016	Process not Found
23324	Process not Found
5572	reg.exe
6044	reg.exe
6524	reg.exe
8780	reg.exe
16064	reg.exe
17768	Process not Found
5796	reg.exe
17640	Process not Found
17456	Process not Found
5540	Process not Found
12484	reg.exe
18152	Process not Found
4700	reg.exe
13708	reg.exe
6820	reg.exe
13992	Process not Found
13624	Process not Found
12372	reg.exe
18200	Process not Found
14424	Process not Found
28284	Process not Found
6688	reg.exe
21040	Process not Found
27088	Process not Found
1124	Process not Found
11352	Process not Found
6332	reg.exe
11200	reg.exe
11724	reg.exe
11744	Process not Found
14532	Process not Found
26200	Process not Found
27000	Process not Found
15280	Process not Found
17956	Process not Found
12340	Process not Found
10168	Process not Found
5384	Process not Found
21924	Process not Found
27972	Process not Found
3348	reg.exe
20240	Process not Found
20504	Process not Found
12468	Process not Found
7796	reg.exe
16120	Process not Found
16476	Process not Found
25704	Process not Found
5064	reg.exe
7448	reg.exe
8636	reg.exe
14172	reg.exe
9872	Process not Found
11812	Process not Found
3516	reg.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 64 IoCs

pid	Process
2432	Hacker.exe
1476	Hacker.exe
2624	Hacker.exe
1132	Hacker.exe
2024	Hacker.exe
2616	Hacker.exe
2592	Hacker.exe
940	Hacker.exe
1248	Hacker.exe
2360	Hacker.exe
3696	Hacker.exe
3352	Hacker.exe
3176	Hacker.exe
4060	Hacker.exe
3504	Hacker.exe
3516	Hacker.exe
3832	Hacker.exe
4536	Hacker.exe
4120	Hacker.exe
4916	Hacker.exe
4792	Hacker.exe
4816	Hacker.exe
4260	Hacker.exe
4520	Hacker.exe
5012	Hacker.exe
5588	Hacker.exe
5196	Hacker.exe
6040	Hacker.exe
5948	Hacker.exe
6080	Hacker.exe
5732	Hacker.exe
5636	Hacker.exe
6428	Hacker.exe
7064	Hacker.exe
6760	Hacker.exe
6612	Hacker.exe
6656	Hacker.exe
7060	Hacker.exe
6268	Hacker.exe
6904	Hacker.exe
7720	Hacker.exe
7340	Hacker.exe
8172	Hacker.exe
8000	Hacker.exe
7304	Hacker.exe
7948	Hacker.exe
6736	Hacker.exe
4344	Hacker.exe
7612	Hacker.exe
8756	Hacker.exe
8376	Hacker.exe
9160	Hacker.exe
9132	Hacker.exe
8364	Hacker.exe
9208	Hacker.exe
8944	Hacker.exe
9516	Hacker.exe
10152	Hacker.exe
9912	Hacker.exe
9812	Hacker.exe
9364	Hacker.exe
9976	Hacker.exe
10916	Hacker.exe
10796	Hacker.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
2700	iexplore.exe
1460	File Crypter.exe
1840	WinRAR.exe
712	WinRAR.exe
2460	Virus Maker.exe
2272	Virus Maker.exe
1448	cmd.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: 33	2356	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2356	AUDIODG.EXE
Token: 33	2356	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2356	AUDIODG.EXE
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeShutdownPrivilege	2092	chrome.exe
Token: SeDebugPrivilege	2460	Virus Maker.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2700	iexplore.exe
328	WinRAR.exe
328	WinRAR.exe
328	WinRAR.exe
328	WinRAR.exe
328	WinRAR.exe
2700	iexplore.exe
1524	WinRAR.exe
1524	WinRAR.exe
1524	WinRAR.exe
1524	WinRAR.exe
1524	WinRAR.exe
1524	WinRAR.exe
1460	File Crypter.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2148	iexplore.exe
2092	chrome.exe
2148	iexplore.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe
1840	WinRAR.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe
2092	chrome.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2700	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2700	iexplore.exe
2700	iexplore.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2964	winrar-x64-701.exe
2964	winrar-x64-701.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
328	WinRAR.exe
328	WinRAR.exe
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
2376	IEXPLORE.EXE
1460	File Crypter.exe
2148	iexplore.exe
2148	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
2148	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
684	iexplore.exe
684	iexplore.exe
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2668	2700	iexplore.exe	31
PID 2700 wrote to memory of 2668	2700	iexplore.exe	31
PID 2700 wrote to memory of 2668	2700	iexplore.exe	31
PID 2700 wrote to memory of 2668	2700	iexplore.exe	31
PID 2700 wrote to memory of 2376	2700	iexplore.exe	33
PID 2700 wrote to memory of 2376	2700	iexplore.exe	33
PID 2700 wrote to memory of 2376	2700	iexplore.exe	33
PID 2700 wrote to memory of 2376	2700	iexplore.exe	33
PID 2700 wrote to memory of 2964	2700	iexplore.exe	35
PID 2700 wrote to memory of 2964	2700	iexplore.exe	35
PID 2700 wrote to memory of 2964	2700	iexplore.exe	35
PID 2964 wrote to memory of 1164	2964	winrar-x64-701.exe	36
PID 2964 wrote to memory of 1164	2964	winrar-x64-701.exe	36
PID 2964 wrote to memory of 1164	2964	winrar-x64-701.exe	36
PID 2700 wrote to memory of 328	2700	iexplore.exe	37
PID 2700 wrote to memory of 328	2700	iexplore.exe	37
PID 2700 wrote to memory of 328	2700	iexplore.exe	37
PID 2700 wrote to memory of 1524	2700	iexplore.exe	39
PID 2700 wrote to memory of 1524	2700	iexplore.exe	39
PID 2700 wrote to memory of 1524	2700	iexplore.exe	39
PID 2092 wrote to memory of 444	2092	chrome.exe	48
PID 2092 wrote to memory of 444	2092	chrome.exe	48
PID 2092 wrote to memory of 444	2092	chrome.exe	48
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2368	2092	chrome.exe	50
PID 2092 wrote to memory of 2536	2092	chrome.exe	51
PID 2092 wrote to memory of 2536	2092	chrome.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://blackhost.xyz
1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:996402 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2376
- C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\winrar-x64-701.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\winrar-x64-701.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files\WinRAR\uninstall.exe
    "C:\Program Files\WinRAR\uninstall.exe" /setup
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Modifies registry class
    PID:1164
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\File Crypter.rar"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:328
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\Email Bomber.zip"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:1524

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Users\Admin\Downloads\File Crypter\File Crypter.exe
"C:\Users\Admin\Downloads\File Crypter\File Crypter.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1600

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef56b9758,0x7fef56b9768,0x7fef56b9778
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1532 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1568 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:8
  2⤵
  PID:840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:1
  2⤵
  PID:808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1284 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1280 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3472 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:8
  2⤵
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3564 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3180 --field-trial-handle=1260,i,12564849486256292930,4190493866748270287,131072 /prefetch:8
  2⤵
  PID:3032

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2444

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\virusmakersource.zip"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:684 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\Virus Maker.rar"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:712

C:\Users\Admin\Desktop\Virus Maker.exe
"C:\Users\Admin\Desktop\Virus Maker.exe"
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3056

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:1252

C:\Users\Admin\Desktop\The Matrix Green.exe
"C:\Users\Admin\Desktop\The Matrix Green.exe"
1⤵
- Executes dropped EXE
PID:2864

C:\Users\Admin\Desktop\Virus Maker.exe
"C:\Users\Admin\Desktop\Virus Maker.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\z4pny4wf\z4pny4wf.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2392
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6D1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc418BA10CE2E84AD9B5C7ACFDB74CE718.TMP"
    3⤵
    PID:1856

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:1064

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\setup.bat" "
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1448
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2348
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2856
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2120
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1260
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2432
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2860
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2472
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1620
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2584
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:1908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:600
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2944
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2460
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2896
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:576
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2036
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2732
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:1364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3008
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2740
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2436
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2716
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1640
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2608
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2884
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:604
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1608
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1480
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2768
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1928
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1788
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2324
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2216
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2564
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2688
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2264
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2532
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2052
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2236
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3068
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:940
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3048
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2616
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:776
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3044
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1864
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2120
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1588
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1896
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1776
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1472
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2108
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:2320
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2964
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1892
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2460
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2248
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1376
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:2500
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:408
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:940
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1888
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2488
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2276
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2996
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1920
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2040
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1248
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2536
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1704
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2984
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:2212
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3016
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:2488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3016
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3144
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:3192
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3368
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3384
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3448
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3468
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:3516
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3524
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3676
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3696
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3776
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3808
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4004
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4080
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3140
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3164
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3340
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3436
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3516
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3800
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3872
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3900
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3960
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3192
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3288
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:3308
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3560
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3688
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3672
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3832
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3808
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4036
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3216
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3348
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3296
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3716
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3900
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3952
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4088
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4020
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3396
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3504
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3728
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3828
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:3928
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3312
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3280
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3620
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3864
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3304
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3864
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4024
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4040
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:3220
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3668
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:3908
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3552
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:3468
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:3832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3692
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3272
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4220
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4296
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4316
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:4376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4528
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4612
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4652
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4660
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4848
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4856
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4940
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4948
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4112
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4120
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4204
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4260
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4504
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4512
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4640
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4648
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:4700
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4712
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4908
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5028
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:5064
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4248
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4252
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4376
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4420
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2876
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4904
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4996
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4196
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:2420
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4408
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4368
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4828
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5076
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4108
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:4136
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4544
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4556
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4700
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4764
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4760
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:4836
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2380
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4260
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4468
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4752
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4168
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4356
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4656
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4704
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4896
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4380
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4520
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5020
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4360
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:4488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5072
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4136
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5008
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:4992
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5252
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5264
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5328
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5340
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5400
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5408
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5560
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5588
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5668
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5728
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5888
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5908
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5964
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5984
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6036
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:6044
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5160
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5196
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5288
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5576
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5632
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5728
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5752
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:5796
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:5804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5956
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6116
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5144
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5180
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5452
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5436
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5624
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5556
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5708
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5732
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5896
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6092
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5156
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5140
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5476
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5496
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5568
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5796
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5804
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6076
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5224
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5404
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5472
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5680
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5868
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5876
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6024
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6068
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5708
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5732
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5916
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6052
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5920
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5816
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5212
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:5348
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5456
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5848
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:5636
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6100
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5520
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5976
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5284
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6176
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6184
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6248
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6256
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6408
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6428
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6492
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:6524
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6544
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6736
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:6748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6812
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6832
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:6880
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7044
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7064
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7128
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7164
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6352
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:6360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6416
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6456
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6524
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6720
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6760
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6868
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6912
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7160
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7136
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6248
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6256
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6328
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:6332
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6604
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6732
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:6820
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7100
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7124
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6272
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6252
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6388
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6652
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6836
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6784
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6388
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:6440
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6472
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6500
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6600
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6680
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7140
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6348
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6476
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7056
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6240
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6520
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:6688
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7008
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6268
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6712
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:7012
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6152
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:6880
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6444
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:6792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6828
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6744
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7204
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7232
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7392
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7472
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7480
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7540
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7700
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7776
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:7796
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8020
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8032
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8100
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8108
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8176
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7316
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7340
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7412
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7436
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7712
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7812
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7800
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7920
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7932
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8116
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7184
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7248
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7264
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7584
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7616
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7680
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7728
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7764
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7772
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7988
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8000
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6728
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7208
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7268
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7660
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7804
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7800
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7968
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7972
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7256
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7304
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7408
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:7576
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8092
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8120
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8048
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7180
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:7448
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7368
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7800
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8096
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:6824
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7248
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7900
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7996
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7960
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7908
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6856
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:6736
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6124
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7936
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:5572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8076
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5644
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4224
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7800
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7640
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:7952
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:4344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7624
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7792
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:5820
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:6896
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7656
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7788
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7768
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7668
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5820
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:7612
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8216
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8256
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8416
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8432
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8492
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8512
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8576
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8584
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8736
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8820
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8856
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8868
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9044
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9072
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9136
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9144
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9212
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7772
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8356
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8376
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8464
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8504
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8800
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8808
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8768
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8856
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8892
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8948
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9152
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9160
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8248
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7596
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8240
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8628
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8632
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8712
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8788
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:8780
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9096
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9132
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5448
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8004
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8340
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8692
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8668
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8892
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8944
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9032
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9016
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8404
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8604
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8648
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8224
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7844
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8408
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8500
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:8636
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9120
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9208
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8500
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8608
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8648
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8380
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9068
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:8228
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8440
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8608
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:8944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:8504
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8440
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8636
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8440
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9004
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9264
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9284
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9336
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9496
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9572
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9604
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9628
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9824
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9900
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9920
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9972
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9980
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10132
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:10152
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10220
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8676
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9452
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9512
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9544
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9556
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9656
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9868
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9912
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9984
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10008
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:10040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10172
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9380
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9404
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9504
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9788
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9812
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9924
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10000
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10080
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9444
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9676
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9696
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9744
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9820
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9324
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9492
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9604
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9672
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:1884
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9392
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:9672
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:9976
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9480
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9864
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:9976
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10244
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10292
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:10328
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10528
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:10548
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10632
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10668
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:10736
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:10744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10908
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:10916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10992
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11024
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11040
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:9792
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:9476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10364
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10400
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10500
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10508
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10788
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:10796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10900
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:10884
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11260
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:11228
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:1912
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10516
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10776
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10784
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11152
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11180
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:10344
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3820
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:3108
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10340
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:10292
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3932
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:10776
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11220
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:10360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:10856
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:10400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:3116
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:11200
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:1436
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11368
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:11388
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11444
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:11456
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11540
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11572
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11736
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:11748
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11820
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:11872
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12124
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:12144
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12208
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12216
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:4028
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11456
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11536
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11668
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11684
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12052
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:12060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12152
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12156
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11300
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11316
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11672
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11816
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11780
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11396
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:11424
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11624
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:4480
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11804
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11796
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11324
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:4776
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4444
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:11724
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:11944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:11724
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:11944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11316
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12156
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12088
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:2900
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:11288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12304
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12336
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:12372
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12592
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:12600
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12676
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12708
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:12800
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12808
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12960
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:12968
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13044
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13068
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13128
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13300
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:12156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:4744
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12440
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:12484
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12528
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12796
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:12800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12880
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12912
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12924
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13188
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:13192
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:11420
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13268
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:12484
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12532
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5164
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:12832
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12868
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12996
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13056
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12536
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:12568
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:5724
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:12700
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12864
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12792
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:5800
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12864
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13172
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13248
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:12532
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:5280
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13040
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13164
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:12892
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13012
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:5856
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:13164
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13348
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13380
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13412
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13632
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:13652
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13712
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13732
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:13808
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13828
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14004
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14024
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14128
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:14164
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:14172
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13380
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:13480
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13516
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13540
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13640
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:13708
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13944
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:13952
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14036
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14104
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14160
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:13376
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:13344
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13540
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:13672
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13864
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13872
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14212
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14208
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:12560
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13368
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13360
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14020
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:14092
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:6300
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14276
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13504
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13520
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14220
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:14288
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:13852
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:13920
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:14060
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14200
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:13320
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7524
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14060
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7516
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8160
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14492
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:14516
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14612
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14680
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14692
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14908
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:14916
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14992
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15012
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15080
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15088
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15252
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:15272
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15344
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14364
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:7540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14656
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:7904
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14792
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14804
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14904
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14936
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15164
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:15180
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15224
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15296
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14352
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14712
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:14732
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14904
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:14964
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15128
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15140
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14400
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:14404
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14580
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14620
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14756
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14500
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:14592
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:7664
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:7576
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:14972
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:15176
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:14436
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:14440
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:14512
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:9184
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15216
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15380
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:15400
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15484
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15508
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15588
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15596
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15772
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15792
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15868
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:15900
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15952
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:16196
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:16208
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:16280
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16300
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Adds Run key to start application
  PID:16368
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15364
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15628
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:15648
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15732
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15784
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15820
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:16160
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:8476
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:16276
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:16240
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15376
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:8928
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15656
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:15744
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15896
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15988
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  - Modifies registry key
  PID:16064
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:8744
- C:\Windows\system32\notepad.exe
  notepad.exe
  2⤵
  PID:15596
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\msg.vbs"
  2⤵
  PID:15856
- C:\Windows\system32\rundll32.exe
  RUNDLL32 USER32.DLL,SwapMouseButton
  2⤵
  PID:15864
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:15996
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\setup.bat /f
  2⤵
  PID:16104
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\mail.vbs"
  2⤵
  PID:15612
- C:\Users\Admin\Desktop\Hacker.exe
  Hacker.exe
  2⤵
  PID:15716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19533229116117353141544800481-162228542-1976913722587396911-1633355687-698805634"
1⤵
PID:1480

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9628251401541415241198206291-1661828425-1956789227-15190650872038966198-757522361"
1⤵
PID:4948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "696481573-1322317458-419694010922775546-697418245-1374682463-153679455440236030"
1⤵
PID:4896

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1910948741-46407633-882273860616078541-3006025101286874119-583148496-347409811"
1⤵
PID:6044

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1739108296337497012198402671871314160656914164-211275674710437194871960715856"
1⤵
PID:5984

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "182809426-57643145120160259781488679596415045523-1025192847-1339922279851440511"
1⤵
PID:5140

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-937464980-20248431632135439654-1229530054342504045-1231876997-16933656521698336069"
1⤵
PID:7772

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "891493093-954657483-12941619071150727069-114979065-453253811-9353794431591212157"
1⤵
PID:10360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-947338427558770969957850779-1448882974-898132418712092531-12343387971782476425"
1⤵
PID:15820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\WinRAR\Rar.txt

Filesize
105KB

MD5
b954981a253f5e1ee25585037a0c5fee

SHA1
96566e5c591df1c740519371ee6953ac1dc6a13f

SHA256
59e40b34b09be2654b793576035639c459ad6e962f9f9cd000d556fa21b1c7cd

SHA512
6a7772c6b404cd7fee50110b894ff0c470e5813264e605852b8dcc06bfaeb62b8cc79adcb695b3da149e42d5372a0d730cc7e8ed893c0bd0edb015fc088b7531

Download Submit
C:\Program Files\WinRAR\WhatsNew.txt

Filesize
45KB

MD5
1c44c85fdab8e9c663405cd8e4c3dbbd

SHA1
74d44e9cb2bf6f4c152aadb61b2ffc6b6ccd1c88

SHA256
33108dd40b4e07d60e96e1bcfa4ad877eb4906de2cc55844e40360e5d4dafb5d

SHA512
46d3fb4f2d084d51b6fd01845823100abc81913ebd1b0bcfeb52ef18e8222199d282aa45cae452f0716e0e2bf5520f7a6a254363d22b65f7ab6c10f11292ee2d

Download Submit
C:\Program Files\WinRAR\WinRAR.chm

Filesize
316KB

MD5
6ca1bc8bfe8b929f448e1742dacb8e7f

SHA1
eca3e637db230fa179dcd6c6499bd7d616f211e8

SHA256
997184b6f08d36dedc2cd12ee8dc5afb5e6e4bf77f7ab10f7ade9eefdb163344

SHA512
d823f2c960a4d92129b9bda0f4f9195d32e64b929082b5efb9149546b5053021255d1dd03cb443f0a03106314554f76b94173e280a553a81e4ac2ac282877973

Download Submit
C:\Program Files\WinRAR\WinRAR.exe

Filesize
3.1MB

MD5
0d76233931dfa993fd9b546bd5229976

SHA1
ce8de59e2277e9003f3a9c96260ce099ca7cda6c

SHA256
648a5d7064cdf2a86f465ea6b318d0b1ceac905f77c438dac2778a001b50647c

SHA512
dd7b6bd5545c60e9ce21fbde35f20d8807bdaf9e4408321f7f709c9324c719f1a9f68648260cfeb7e5f94f4eabc631dd95e348e55d93b32ea12e899d030b91ee

Download Submit
C:\Program Files\WinRAR\rarext.dll

Filesize
636KB

MD5
1e86c3bfcc0688bdbe629ed007b184b0

SHA1
793fada637d0d462e3511af3ffaec26c33248fac

SHA256
7b08daee81a32f72dbc10c5163b4d10eb48da8bb7920e9253be296774029f4ef

SHA512
4f8ae58bbf55acb13600217ed0eef09fa5f124682cedd2bfc489d83d921f609b66b0294d8450acb1a85d838adb0e8394dadf5282817dba576571e730704f43ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

Filesize
579B

MD5
f55da450a5fb287e1e0f0dcc965756ca

SHA1
7e04de896a3e666d00e687d33ffad93be83d349e

SHA256
31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

SHA512
19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
55e73171df1738ad0f176fd9ee7bbd27

SHA1
f763054cad5d4ad0af7c8c1650f604c37d8e8fbf

SHA256
58937ce8eca2857668bb09e5ff79cf60f6a17aecff5b95b1065e1d465caa7314

SHA512
e4e208b8ad3ada25186d0a00d321c6dde7301900b23b366fa246a09007d75a9d8090ef0c9a95c88cf9d437a2b302db9a5e2856b99bdd4e7b35cd32fd66ff7d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

Filesize
252B

MD5
ba4210c91c738ce7307c1b2cd8ae684d

SHA1
f3756e4c3dffc1da14e6d34b7cb01f689b34769a

SHA256
949052d1cf25e15ae8a2337e20f1cc34563a5ebf10dba8ebe4617f1d1810a39d

SHA512
25fd519ca7f73033ad3bc9ac34c87e1f105076c71a3c2f10e64ed513271855ff4272bc7f83afd3a0ab6b9e11bf792c3b6bd23e2048e6d708df6f8aff06c42498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e396cd1b758eed9931c1f299163e941f

SHA1
5928d98ce19b7f56fa1861a5244bd7353c494b9e

SHA256
9c612a4bafa8fbd285a6bd3e8a3d31af4795a895f53fd06962a23d087006f2f6

SHA512
0b3138ada10707ca2d94aa150a38574eecf1579de87c7f05eb3bde6f90451deee535ff564bcd699d5929e8f7c796f55e7b3474f417a4cd20729ffecd8696ac0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c260f0f0a27afe98ee25b15d6e72642

SHA1
b2fad3929f7092b42429438fe20cef4089bccf73

SHA256
1884ebb353b4e88b64138cae893a40abc0761f72c704f74f63b4deca268330bb

SHA512
82c73288c90bc496fd0e9ba2a8a872f85b8b6ed38d3fb6f28dde388d6b09bb60dac131cfc4d6074a6909af93a28ae3af45da636dd0157056f9ebfd5e842a5f52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
032ab754ce1fae0d70962c667431a80e

SHA1
c0a7ef200f83133503439fa82f83f8ea9b1c46c5

SHA256
dd396fe063072035bc962369865675ce748533d22b03d529d1cc55e9c7b32509

SHA512
c9bbbe902b39b098deab52ee934b5565e096626a6c78c54bf8eabd3f72e0fb008a5fe56a617a6fbacafa89a6c8ef4eb3d066d6c16e0193c259f18b0cf7591cb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6da43a7b439ff0d8a09925c473278160

SHA1
fdbfa7aea000ea3e1510e599ff740df02839724c

SHA256
bc5f77d21097ba00d9a8817e87551dbc88d0e48226e7d4904b22a66533cbd7e0

SHA512
152597b8fc16e6a27dfa64a7dce7a9956273ccb25f44534446d09acce2772bb6ccc928eda40ca3d3507372d65a0a0b40825c67d735f81863daf89bd5f3caebec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdcd934e5421cd873ebcd5c27f274991

SHA1
ac387ebfa9af9e3599c1009d638ae7d6728af4b8

SHA256
b03d59c18428679158cffa9f4c90c81a53c3bbda8cfc961be35bee8f2f45c7bf

SHA512
ccfb18fe2864bf158feb542594b63f3dcee0aad40a2740b26ac993ec23cfe553ddb5ea0f4e281514a78243332bccc96239251ebbef0e90c9c930653545b012bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4ffd5a4ce387958b05bf749d9eaceeb

SHA1
42c33d96f784046dae9c47ba9acd569cde4f1527

SHA256
40060812c368c5edf60a9e2d00503af484681616cedcbbb5255784cb405d0b5d

SHA512
0156869950c36a819e888ef25b7b262009e72cc80174153d9b30df014eb830c0a72e5474b958c2d53faeb9da4f249c0b3947a0b31d06d780db09238038910d7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4315eaed5bb9c583d4d9954da7fb543

SHA1
7abe39760b3ca13b08737ddc2b0139df1f13b8bb

SHA256
b78ebf7134cb920b699bfd55413e64474e35aef1d10957d2b41af92c44689c9e

SHA512
054d015efff304e5aaa9426f442536d321211f90d306ae7a059b17d65d542f20b379f7c04a98bc962e5d9e9a27ecf2fd94f6897a99582d180bc14801eb9535e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a761ca6158fc6686bfeb0747aa5c55d3

SHA1
f4edef1b71d204e7243a16ed84a6252dfe600cc7

SHA256
1f383efcc1b5408e9e688aa41391de3c422d78da429b42b7667482c5b45c900c

SHA512
af268c8d20c33b9f033666c67a5b4c0411aa7e9dd73fb49f2350d5afc57b5b0a803336dbcae950cd71010750b214e48ab5ff3a6fbb837ae422c8c5933790b4ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4af75dd8937db8600ec6c0f9c0a906fe

SHA1
c1692fd934791161884a69f824b4bcb88a623aa3

SHA256
7dfac161fc7b67f8aa0f575b11cec4262c7dfb1a342a8f59b2cca75dc2776b10

SHA512
ac301d757dffcb31bbdf507f2e5d5e6d263bacc8c37019b7897b428e4ff194b3d92bf8022ef7a2140abde02108b76cb297cdc95b0df9e9175b39088375f1e638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb6c181a624553b98641e01f2592247

SHA1
10861f39ce6aa3f0473901a3847864a0c7d241b2

SHA256
514321b8d087a228d9a154f1d475850a33ba9f4e37c62cfac6fe30fd646e638b

SHA512
2f306d8836e43b57f81ba6a892cbec4b30d86ee46feaa45d5d60b528f9cd6f2c2181c449267242c224c72a6484257b11c82e9ee40cebb838f6d6ea57c0b595ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f21daf91581310e37e52777d117d78d0

SHA1
30f8a6e15a52aaae80bc82f307ae6864e362640a

SHA256
e6586bd67b0a011fc48247d922f16ee12d19872abac77577b1c6e4bee3ed1d34

SHA512
2c07f0df57c2b034707811667a5f405cc7fe9feacac1d1b5660d984627bc328814edcaad2f23c334fd9758ad0be0af308b8c3959dd6020fcd76b7b18504ef47c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c20626ea2571d66ee940c419e4a6555

SHA1
7c26ca6c60cddc162d6dac0ba4a24512c4fbe54b

SHA256
55c9dcce590d7f6f445af19ac6452a7bf954e1c6035100554a0011500866cf76

SHA512
827f7f1346a73059ccd383e52df581437b3badad7a4c51084f8f3e5df681a2100427b2aa461868cba9e94be670885169ce8ec82b940c9cda6cdab51c7c93e358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e660ed24013253808d50cb2ebab54c

SHA1
a1773bf102a70c6dfb4a4d467a778eecd2b94d7d

SHA256
a8a5ba2606b0b7f8309730c731b2fc45ead03882d04968f9b8d853d5a4a26e67

SHA512
fdcf029e15645ee4e5a88364a8af0cfdd61e52977fe53e311d382610e6a7c024fadea35a6dac6a99f7f32c847f9883b70b51e45e882f97c3128795be9313e111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec73f1e2d8b85d71cde007c1ca44bd30

SHA1
77590b18845eead2426c8b422e359355f7af18f3

SHA256
03eb259a628d1d789769827b4a53d1a152e9e0f8ae61bf14e763f9f27ee00919

SHA512
888c98b2758538302eddcdcadca34b0742dfb4f464f39babcd43926e0d580ac59ec0556cb686460af435d7e626d16dd692a4401d57d8b572e5508c2d06951f75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcceb2eab633393256bebc619ce4024b

SHA1
745dcf77d60b9ff5f1b725406e84b263ff1dca2c

SHA256
9db40aff2d84642373b3730c87172e4e0a933165aa9e0d9c01d7e9fcbe5d33e1

SHA512
53a8d880ed7637eec54042e7abe40d66cd16938648e875a718da1db62d5d4fae73b463039d1eda17d76d9f29fe871e83109c3db41b3d1977b0ebab81d03f79ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c404d4bfd599aaffb973321380f5d40

SHA1
643bc44652cdab33144100320a4bb7d03f673d9e

SHA256
abed8664229b4b9795ebaf96cedcb3fb206be2d4ebe90844f4117be9a74cd4c4

SHA512
1970292f6123e15237e342c48dbb0b8aa163b65ea1aed13af7bfcf18733fcffe717876df446ed1f339a4273cbd53ceeea1ea8cb3cb4fd4fb5248d543b269da4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e111b0fa845387d329e31d555b70ac68

SHA1
cba3aad777e990103568ed1e9805cf655bf1865c

SHA256
6ee1b7708d5369ef65e636aea0a69906db08998b72b180dfea54c1943ecd6517

SHA512
7722360573049211b16dc85aa7cec332e8f8d5f6ebc24af46d53a15485285a99c186539ffc2e28adc6bb6d83de54747c0803055f064c6eb3e8dc0102b03afdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
202f5c14d94b828afdd6771ff7355210

SHA1
057cb5290edd1a4070bb412d3f5030f2385566b7

SHA256
2df31fbc13eb530ce524a2d3ded30237f1292f3d1998d3c92584c460a0cc81d2

SHA512
c8116ed2ce30e2bc6d8f7e5848a4ae07e2736cebb9ef79ef3fc79608875f7a0a33e2d3b4cfa8a4ba50e8e4cfaef25471b41fbefa9fd50b6311b78c30b32ad3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac49b5f042adfc81acab947363d679f3

SHA1
c061de7a1f4fec051ebf924a7e47c903837779cd

SHA256
6ae320ff2b25e80a061ce9226b141e6dfa1f43a7c816c34ae67e931bdb220e78

SHA512
9ccd320dbe3c7f1b0fda02c8cdc536cc187e05d2fd7991e53c831fdb5c0db4b3b2c187af05feaa4b686aa371c665384c9b5dd352b41fe7836e2b808431b3afd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1856c74ff95093e34dc26817cc7ca62

SHA1
39665adb243050ad1848f10bed5323bd667d06ec

SHA256
d83d147d62e647c526907b132d0e86527e42aa1aec0727df7b0ae1976844d555

SHA512
b023c9c6a239d7689ad12a963b2dafb30ccba8379f2bc91fc6069e928242d8ee1f2627379a5b152210d04d12e64ee16eef4c1e363939d3521dbf00d06905e700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed373c5e82e941d5c9f8a62d445fd46

SHA1
258ae9d8d7b7938a94cf9517f7bc2652511a9fdf

SHA256
522546927aa3d803efe84276ad18946423c96b1d226e3f5185b547f0f9fbb65b

SHA512
a814688cdb11f24cb73a348c828fa63ee9bc696d101cb6064b8338c79f93d2832bdc827122a57cab3559c789d1027caef40fcc661b53174e0a383522cbe87caf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fd46819c48ba0bf01b3bd5b70f6ca4e

SHA1
4ca4359f81305e5c53e79ebf4d4fcd5874b95f91

SHA256
644a314e95f53575d351e79428354cf63e418154b7a36ab1efde064a2ee14c00

SHA512
909e6b748682bbb69992aa415a2d8311f5dc29bdd0b95c69ebb9f592f5b459030bebb2ba1c368c4bfbee1ee04f3b1f4474bf2bb243878b6cd917dfc77136ef7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50624cc81f95264b3864669a2f6d4c23

SHA1
6d0b27b9cd06f776f253a9a21eeb10403869ddf4

SHA256
2a2c2552037723610f67cdd04f0510f9aee8c6eea82c6d9b1d09ee8e2ff4ca44

SHA512
4ffbb3770576d4aa24b7658774b9acc4f428e2c29755bea510277a07593cdbfb8c297d91d7d66b99e758c41d6631f04f061e32e99ac00cd42359d8bd011f7a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfcfb4f9204a3ef301f221fcc92e0062

SHA1
4c70bbc13c9323e752aff1035f14f71e1436ad68

SHA256
d8ed6395e7b70980fe375a8322114ee0f1617d694b12aafdcbe1c53e8607daf8

SHA512
bcca6746d306a51256283967a3a243d326b203960f389955ff2bde97ce6516bb9d0e0bf6e6ddc2cd97b5d35daad4c6f19331639b0577194221c0bd96682fa316

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
388266ee3213771ffd0e3c7baceb13f8

SHA1
4577ceec5d96dbad00b2fff780da7cfba18282a1

SHA256
83a73648b8bb5fb2d051f53e6084aa43edd2a2ab7826a234f5481ed5afae32bd

SHA512
b12c553fc941f143ca44286e403f86f3552554abce9c7e83c73273150bbb80bf2dda0bdd6751f4b1e6fe5c10a6f05296c28b7cf3753112bcca51f212824233f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce5efe5c9547ae48078dd824fc0a4f92

SHA1
d2cd9c3702febe6c91eb89bef3d7a337a5d504a2

SHA256
cef79110b0fce0e6da88cfe0651d114a26b69831471ffe75fc697bd86ec52f16

SHA512
02f7f9416d25e26d1760ea7ee38a4e2a925ca41ce3a540eed0fd6de3d62132e984003294fadbc7a6e11d352b6f8014176c61612bbfe98f836bfb119f4bfefe9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f10946a1318b367b51ae53668b19de

SHA1
1fb6a37cb9c7c47e9d6ab4043a85ab57ccbfacd2

SHA256
d256bc7190858699e58c222f8ee883f216a89f7c7ac95c3b8b08a7436a4e6dd7

SHA512
61e0b1158b92c38cb8d180f9992ce190c7936e2c03ed8b39089614b06eb445acceb9a7cdb9c22867780e5172a56fb549910edd1161d11d021db803fa3cf63ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97fa871abcbf0dcb2ca580a6f31ee57a

SHA1
de68f46fb8ae5fad7048c28ae9eaeedcf28460e7

SHA256
fa5c442db84f3d8c83d69728dde45dea6c4a914f3ad958e9a19ed4753e0bf94d

SHA512
e46c13e620f254f854713ef92d362734f5e57ff350834ebd3c8cf71d53bd438cc36fb57b8536d54c2ac457590402326cb5446267a959e980046ab65a28956502

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e011b981c2e52258f457d21cd69ade00

SHA1
1418b7a45249e86595bb304884e6e8a2ed33ef29

SHA256
982a7e17f494163abe09081dd17e6490612bfa7fdb8ab75d6c066af503c0d0f8

SHA512
0216db124ec65e663cd818592052e1ff09c82ece1326cd4c73cec932b5b8693ef091f3f42f6f2acd79992e3fd08a7ab5dbbb9bed673085a05a698b38e56ce3d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ecad366ec8a11a7254d4a674ba56f4

SHA1
b4bc53156baef779df681a1ec9db355a9a8d080f

SHA256
3d6a0ffa83c5e5144765913788491f65a375ac598128836f669df9cd703aebd6

SHA512
67db641b06d6b546f6164236e67adac3a70fa6653680890d55c539569d25c2e2fbd904d29623e85089b2b2b8de77563a87fdac9f2c23d3d4624d2f2a5647cba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac180d04eeb5e11ddb6dbd53e4bf5dc1

SHA1
9a10741b58c7be49993ca2b5df13278bb72bd96a

SHA256
f5deddfa680b1c898f24a449207c087c0def115a44b908e5b820f3233cd839f7

SHA512
7a0c1a678b8a7b050ce4deddbd525eeb65ef2beba373769dc744c0890b2bdd552843ffbe1b6683d221330c44c95129fa0ee1abe552a43560f424826299e42d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ae232bacf9a402f9a29079ab7210c5c

SHA1
2e24aa2d79ecf8737e2101123a856d608f4c1c49

SHA256
c6652f9d1fc9a40148ff4d9d1460f1cdcace38d6db48da95ea334eea3e86488e

SHA512
792c67ea6aaf7e6f6a3a5343e59d4bf37f89a2b4792153305b89bfa27a46cebe9e30643a72c896fced236164c925d3442ab77d27099cff737004b379e43b0395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0689ef37731c8930df2f488e0902138

SHA1
20d820dd9b7bd98ee7300d1773d7470f11726a93

SHA256
7a07ffe497ed0823e3b014cd93c2205d9f0d975fcb4a576049296402f42e826f

SHA512
2be2f07035081203fef1b7feddd746f55dfb1a97e7b912f9287d4205b75d179778fe70d15e9b5236441eb1b92188dec8b1cb0d577ff1b37e189efbdb04a5f5a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0734c67b5a03eb85fb87c6dfc37bc56

SHA1
acf96e83adddd780f03af81d7948ca5fbd07d733

SHA256
f10672a61badf49e0756e6f634c30f859f3c4eebb6d0fe2ba52b870f0f52a57b

SHA512
2c81c4a1653738e6db48b7f2d5cb4c1acd472e3244bb86b5bd4e5f5ca39e5353e9865c41855f5983bf65592d6983857a86cee89730f9624003ee13bcab76e76f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29d8cd05bf370c909262dfa582422a13

SHA1
5e598a3999bda0d92d52e53a8285eaac737e3351

SHA256
577cf6024ed335d5722615299b585882ceacdd74bbbef470dcb0754e6aa98695

SHA512
404a1502054ae34ab8dc6a8498bff7f26f550ddada4e4d761d9861b82963eae49d4a5f054fddd5365505f94ee850d859e4dd3934a0e20acdae296462f9fb4511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec5797b637a0f611dacbeb9a1d57c91f

SHA1
b56142e3bc4965302993f01243431267519e7268

SHA256
ff1e7a9e52246140c5ada06e7a7ef5fd3089e449c6da4d52051278f4d4905db5

SHA512
2e7063d90cf02f56b79f4443c7f7cf1f80ae96877bcaf28f29f7ea7d2d8a945344e71a1f8e8f53705e174868bb87b4c68e67043ff0351c3e7dd1ae6eaae8ed99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d6a005cd9e974c9f7010871ca259146

SHA1
9be182c399b0a057a4f3d3b83fe7ea4e304a3fcb

SHA256
17c55f8953cfe5176ea2cbaf61443130a655ebded06a66ffd79e30c1c34040cc

SHA512
0783fc71e88b59d3870367b86401b5593ae0a83cc9a88bcf55cb31d2056d6589fba92bedd00104a69afbc490aae8f28871c4f1d9f8fc98b8a32589a73c19a579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bcfd223e88c3632e17462db07b3fa8f

SHA1
b19d45fd9518168fc401488f9c4a38613631465c

SHA256
5d356c14a0c3d8d44e28a1ee27eab612e4434740ea26ec5b96c56e485cba6dea

SHA512
2049863ae812c702baf417413bcdf02a19aa051dd99c85eb3cf88998ec2a3f11c0f24d133547fa6ac61600a8a03f2d88b8b1e42f1305f938172c74682db5f237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da58f71968acc4694fb9133520c19460

SHA1
9fbdb241fc9f42637288ff2b7aa89b6765348b3f

SHA256
d65ce4d885537e40d742bfb1a0d80c1f26fe3fbd77c26f35505c0f21eda53070

SHA512
c3b7c7ea6da445c49ded1fdb5f51ba0d3ec9726a9a2189043483b3f73641460706cf8020b3fa4e04b7467ea806221317108b236cb67faba65f404ef4cc5a2fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0112938339ae7bdf807e60f59fabc5dd

SHA1
1d60b112231cf5f77cfbaa0d9206710ccf1ed1fa

SHA256
f67be3112f76f245c7dab62dc8156317d792c93df5daffee85b5a772e53dc96b

SHA512
70b6a1b1df56eeef234b3506c1fe305b7822f93301cf26cc6ab65b288d97f58409fd041e06a57531be357f12690c0917422efdc6f08413fa082712295be06266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5dc28d6fc4551a7bb7d946feef2c1fd

SHA1
8238192b4d78ba4267a389781b710a494ad3b68d

SHA256
01a3659d364f03ea7407c1988879f280983e0054c1705cfbcc4f25306e59b6eb

SHA512
82fb0844f28b3d2a73fd23f6ae4f242419aa750f46dd56403196f79111451ac531515936ea9cb6799f1f4e32e74373b729c5a68e7479716f21616de545f6e539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d0049cc24b7edda214983b2cfc3797f

SHA1
c618802f15f3a7acb52e91b87bc54134e1acbda7

SHA256
57401296f46cc6b9954ef30057b2884dc13ffe1e7f3f5eef9588ed8257eabc6d

SHA512
1944c2f9328fed5fa2bb6f9fa7a62015c7be2f7867fe0793d21e884ad59f765d7962bbc1c60620e9fb8d4e327e485edd57c387f339dca10bf3f0b8d773569045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afb878b1493f46749147eecc1c291fb9

SHA1
987222449229990cb410afa2f0aecaab92838347

SHA256
ae32e655ccaff2bd1cbc5d930e1e5a8a6ce84298435efa8cfb98b3c523d85a4b

SHA512
77e6531dd78cbf66f4dca9e14249bce1f1dbe0399db15b6e79c6cf12c96eea381c7af502bda449802cd0fd7b85142de2f97690b4f3155c077889e0030088bb66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63212273441939c1227b44dd9ee4e2e

SHA1
3391d06dc0b65ac9c7167e04c413f7227cc57e86

SHA256
57cfef81f56fec853516fd980050f0c5abcce084fcc9c0c50577f0d0507ccb44

SHA512
c3ccce807b782643ee5d975afee533baa50e61e86f64cb1599a265ce698c852460c83e4e60d69209d44f1b265c4d2bc31d58e4a0e8d020faed64874e208e91bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02e93a4705f72a9740c61b974d867c9

SHA1
70d51c8699e10150385b1f14ffeadddd067eac13

SHA256
00d3118f88e90962f1ef79c74c4b31f2c6ea5090d6cfd60d70e4a2a4b9cda916

SHA512
cd5df7a954b3638f66bc133baafbe86024e507764e696c68c4888dec49cf470aebceca0b549e586fc83b4d2ff4c7ee7e1b6cfa1bb469ca7abc2cef4c357c17cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf44450885c96212fad00e40c2eaecf4

SHA1
c26f0d3a3e7f9df3741958df59806047de56e14a

SHA256
9d38395d41348e9326f0926f14992dcf8c245d0f1a40cb23866d95b1bd72bbb8

SHA512
59792be6918e1b90acd382a3547ac1a41845dfd1d575edd2e90ec934ee0091a9586f1f1cbf7f448ca8ef3d08b0b84df7d4125884f91be3dcfabd4dc985113c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c91ad5306ed598bcdd4e4e05f98245c4

SHA1
70a0bde317d6ff85e361089e7e8461ee39dc9cf7

SHA256
828249e27a04d4b7120f06d3861fb645c6d74cc5ea12323b4318d3dda044ac98

SHA512
1abcbd9f47d2e1790413f75266b92e0583fa451ed10b0ce724b435fe0f486a0850826e63bda002a69470ae34b557d0dcd01dd0240189b2b45104f8377a769486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa54104d034afba63b1a67932678fd9e

SHA1
745553dcb9c0efc7492447f997cb0f466462f1aa

SHA256
45e85edd3cfabbe2de89d90cafa2092fcd9dd3aaefbbf9a6f2fa1161f72cbf20

SHA512
865d387128e5905ebbb8c0625186df71dad818124713e936c3b86c693ac9d587c606464a17681079ad94e91f813cecb291f63efd35212e917e5f5aa7a37090e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b4d52de0a0257630f73bdce2061942b

SHA1
5e1da1dc3b6c8df8ff6aaa46af3b1a51e5a9e30b

SHA256
a9ba82abadc23d6621f6a38abdc90c60adebd081e570e8bb68149970e9beddb0

SHA512
1852aaea3505ab327cc5ca0d7f4f9202e110e96da1e492b6c22d0df725d58d5e79c375f0da0dc78d7f9b288ae78ccfc2aa9e1e903c9b76a65874a13480172847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297a3c95bb987c74c094cedaa20950ca

SHA1
359182a66792690b44fed87b71f2269f74480880

SHA256
fca97f7c4d377e894b001edd67bff156a7f93aa7edca91c3951caedf49b17bbb

SHA512
4ad3ee2259dad558be96727193e474861819ac10397fbd70d13b93732e32001d50a024c08cefc7b4d21e1463cc237fbfeb88e28f0e7f425a0e14cc9ce427d2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ef4786ec457581a8f4a05dd56e48e9

SHA1
4774c54165d3c40f991672475b62402e301c4a1a

SHA256
37b643091da14c5a5b623d6c9c1d10f85904794cdec3d1f2198178514c598f90

SHA512
102350d30a7026c3df2b2b1f885aba5755c121173471f3580dcb024ea84ee4685348e753fa2379bd7e03dc463b4f699f3445e030461b8b8817e530a8f07759d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ae0d816a983b8458aea58dc79bd16ee

SHA1
95f45400188af8e0120337254b076877e734cee6

SHA256
97d5a98127254748eec811138b6a09880611fc8697f0294d17a772f6ddb4f4a6

SHA512
97509aa273ba2e5c1f92f3b9b30dfb548fb5d9c912c0976952d8b97386b43b00fc0d47571c5b622acc0b3cbfc5cae619b9f874d5cd1426d99d49eec8cef72eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f92c086efc4d96293d6db946ecb3379

SHA1
bc6d84e4aac08984e056492e08b2ed3b925f3ef7

SHA256
97df0671c09ca14d5e2307132abee8981723d61496752446e7ffc11119fe3f92

SHA512
ae38270d380355c119def6e42ca3951e5c60fe09b78a247fda74556138c1f955678f229957fc62097e45b4e74270c6ad6a95273793b70797f1dbb6ebb17c7717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c64af9fedb416080cbe136b6078e23f

SHA1
724fdbc43d83f67d802a00c0bb9b4081b95f3da4

SHA256
2ad30b2562bcf8e1ade3eb7fab85fa5be4ae0fc2d7a12c8b7f9593f8f017a645

SHA512
c909e8fa9cb4c4446e8974d0a799f2b6fab8018b5a652f7892fa92817ba238370e3981c63b0cb0d332304d88032333feb5dfb1eb0b6eb312efae8e0cecfd3a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9d8776080232a57ef4879a6ad448fd1

SHA1
a9033852ac90eb37b33ba8e6f9e892c80904c40a

SHA256
7349f376dbb59254bd7fb6e33c21d697eee05f0b1b89b36380cdd1e13ab0dac5

SHA512
019644d854fe79d23a4f143ba9e76235e3178273c6127a7f54fb9599cd7b3efc74ccb6b787d46f283be22c1fbbbf6d668101e40e193225a06dd1b3a540f23245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e77c128778d828ef84d37a3e001ffc

SHA1
6584bb5236d1f159d17f82e7410f7cc7a83a5347

SHA256
76fbe7d289799dcaaa15721d05eaa943e92c72ef4a7e897b3af928a12ad59f50

SHA512
b0041846d5d7defc02adf59687a39f586162feb152165f89eb3a328de9b709ed373c4014a75afbcfe79f978424151eabf6757ff4e0062de2c2faa69e309663e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
fdb88cfa40f4f6e1b15a662f303fa46c

SHA1
6a7b3c4343e836a796e7b55ba47b0af688606bf1

SHA256
4fb19eb98f8062861e45a55b373b59aff77b80a7c1c02fb67ca39d633d40d38c

SHA512
d9ebde44423e6fb5818e31f3338e6ed5942b97a8d79f1ce50f3bc834d1f3000a6cc6f85fb99e6d4ed7d5e898d376436d6902a1af8b9dba1ae05bdbe41c861b09

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
341KB

MD5
37bc073b84c1d586bb0b1e36b883b6c6

SHA1
808ad94eb03ba6fc30cf8aac4b5456b5ed7229b0

SHA256
516302cd9d6d92e4cbf54d55f3c1345eef96dcd413748f218efd14c8028bc363

SHA512
5ad6bf45a54f972630b5c1befdd0af98dcdfffddd3ea247324343ef4c9837f064c5bfe49bc984e69929b0f2a9a03bc787ec70782d3f1867c3d7c402ca0257726

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fb370f2a-6baa-4790-8b57-e221ead31b4e.tmp

Filesize
341KB

MD5
82fa2453b04e997753a14a902fce3f38

SHA1
05555cea412eb7e35cc983c60250bf95e8b3eac2

SHA256
572c647f85b0ac46c0fa7e3b306a2c2b707110980d6e9ab0a79262639763d1c3

SHA512
f863243b6f042f694af966b571837c4d5d17303c2dce9cfb63bbc4f43f569a176a60d10f3a4ffdc18b7ac6870ed89e3b11d412433b0b32eff1f5b2cb5968cb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{D90F67D1-7F41-11EF-ADF1-527E38F5B48B}.dat

Filesize
6KB

MD5
94b9b27d4a1f097952eb1516da69ea60

SHA1
e76e61589b79f5ef64b94025fee84833a0c8966a

SHA256
e33d9c634f9d472440a05e1a5c1e20198c2e9bb5329b0e8531d052b1fe1c5827

SHA512
dda1701ca8cc60dee72953679f036a5ccae3d8a3ea1213d726a7000d1eff32d04ff71a581ace8021d6d116638d39e861711a44dc38d6d86283520cb3dc3baf2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
732KB

MD5
4080162839dfb63cea3afa7113073f52

SHA1
2d1ac84e46a4e63c302670bfff4776eda09b470b

SHA256
6a64f7329376ff0ed9cbc3e82d7fa0e0ea55f287de56d8319a78300ec9deb948

SHA512
ad68cecf50a4a67080d61a98be324b5a568dab0c72cd23c7c7d840a661b279b291b2dbe7f34e1183b31fbf37a6033ec757ad92b853157f8398109c9d8e91bc71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
362KB

MD5
0bbfab736974a7e86af31a3383de4bdc

SHA1
4586d836b22c519b69b42fdbdb558efa4a4904e7

SHA256
e6f33a441dfaedb1dd91f7de49ff43fdb4f05ce1417db3df86ea5e71fa811539

SHA512
e6502d359a806961ecee340d064ec3b1082f9e11a072742c2703f17f2743b37b45f9b76763c7cbd067da16103bc03408624dfe54de8cfdc833ca2505ce289549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
734KB

MD5
5998cf345291d809bb10ef40ec776933

SHA1
28b67541d09847f4f187d4c1641992ded7ebb210

SHA256
79e4d322dbf8fd4ad9b527873fdb1724acecd2f584103b97353297104f0b1fa1

SHA512
ef02c4b210989b6d356b84d5a87753c3a546afde7a3931da2670508f3d612da214fe360c86f40448f6c724c63dcbef5a782c7eb56cda418862f724271b239e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
735KB

MD5
f75911655cc3e16ff7072a85b30576ae

SHA1
45f8328a23209c68ec21bb0e0f2a410807eec000

SHA256
f2a4d591e36226824b74a521b10019393bde259f25aaaf36e6cf6323f8d5d6e1

SHA512
9874bab8ed6264cf1a5982e06b806af5606886d6999cf6cf94cd84c9798f485eac0bf3ce7cec8f9684e0097a1fcd21e7de548d3cbacb1dd33e5fef55010268d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\anyweax\imagestore.dat

Filesize
728KB

MD5
8abdc53a66213ab36dca81b974bc9646

SHA1
e2953af6852542e3658c20842a1a084b4503eda1

SHA256
304f33da039d2f538d875b2001edae76ece8e710a9cbddd88bf564f77f4f84d3

SHA512
b9017ba4b0c0f15ef2e1e17dcaefc06f2e0425e532675b48c36ecf792bcb2dc388f0dc4e8bd6e6f7ab321aa46e7d5fad4026755b89a599b40077f03365e5b845

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\0XXDLHQ8.htm

Filesize
7KB

MD5
03a8a5751c3405bec4d3f1fc0fc5658e

SHA1
cca14f7dd652f33839679c43082f59387b6ae62a

SHA256
694a2dd3542014500713c6d24aeed5d3641761555955789529576906297e9d3c

SHA512
9917469bbc9b941ec67648abd759085649ea8ab43d8d915b1e77ea23e818e161037a0105f30ec764ed61a8eaa7d02db4087bcda011cbbc3080477343fb1a3545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\6LONKL74.htm

Filesize
14KB

MD5
aae48bcc78e2ac1226631149ebbeb4a5

SHA1
ef06faa16873d568f7564aa43c0f8300dd1d6387

SHA256
ed20813f164d63e7f3bc296b3a248721fce97d3a8095647fc8518af6c23aa12c

SHA512
a34ad875e136492e21be5301d5ec7f9f6a89147f85550f03f7e6bfa6420db448b1ad8b28a5b49e5a2d5f3d94e2924821178993b1627c59e0411bf055dfdd8b2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\Q5B1I15S.htm

Filesize
21KB

MD5
82e2778bdc019453f9e09bfcbec21a35

SHA1
6ff4b2eb13970d96e6ade2ee264b7827eacb47ad

SHA256
3cf5354637b2a334ad11990a4201644072dd5b4e202ae77b39f019e2e2c1e38d

SHA512
19b958bb1d59d29cfc227764d59ded203cb46be148a4c2c880a06642c8c6d9897f47cb6770de61547798ba983d66fa6fe7962be27e5668e477c4d7ef7a5c79ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\SEV1AD9U.htm

Filesize
10KB

MD5
faee3b0f91956d28d9c615a917730e72

SHA1
d887db2862dd4e64961bf1c7beba383a1da37b9c

SHA256
aae049e93de6caa70d8be1a9d12cb94270cf6f9d0a7958cc7848f9d7520846ba

SHA512
10e01cfe08c5f5006d893f00cf4b75e4b62823310e320d8b56249bf5617acb2a392f2572be1513075e2f0656e9d7ca69eb9472d0e6bb3a1ebea7ff3037e1014b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\Virus%20Maker[1].rar

Filesize
82KB

MD5
d1f61793e7898df4b27e3345764ceca8

SHA1
f03b91146aeaf753b565620a022a238830ed56d4

SHA256
d32f3a860b863d38f117c2e7efcaa6909583d418f8578b526a7ed0153529644b

SHA512
6491767f6db68886d000b173306377f3b0bf2d6db765ce4c14139c9ad09fa44e6cb75489f3858e45c4000333d2ad517721f81cc48e94de25c75c17cac36bb617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\favicon-trans-bg-000-mg[1].ico

Filesize
4KB

MD5
5879b2763fc53367a29f1e64721976db

SHA1
edee687feb0438fbb4fdf6e0b9bc941f2a0c464d

SHA256
b5f794efdee46f6e8759441cfb2bdc36640f50e47cad9f11cea18bed48e6c43b

SHA512
6b04809dad6d927b7c9fe0d674b8e14c9bb374ea069558e53468e33da76be44c8de6221f90f719462bcea90bec1a90ece58a706e440229ec78d81ba9063ad0f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[1].xml

Filesize
478B

MD5
05dac0901a1dd7622439b622ad68f37a

SHA1
265721e24e77bc86b278af781252aa7847484e2c

SHA256
0f2c4abe993c7c00307fe5958e430c9e0d92856377fbbd5cb93ee5e0c0e8fb5c

SHA512
ea4c4d2e831da0fa88c0b681b1292a0688252c1b9cddefbadf1e578554e0a14f18117e893db4ed3e342225cea22a37c49f6072f8d513e433358476f18d03180b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[1].xml

Filesize
472B

MD5
f5ab286ac89d6cf4edaec0138b65ec44

SHA1
a383d97844e4bdbff152ddf0e84e4e4b93833ebe

SHA256
445e942793cd295702f52fe9d301cd9af6dcc6dab8ff2f5ada43b54faee53311

SHA512
9f0d96fa591d8fb22288b416ba1af50196dc1f5ec6c8b81bf1daa495dcff97eaded70fdbe8e642d006c3ee93176c66b5160523e834673423c3180ae46dbbedac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[2].xml

Filesize
215B

MD5
6e5d3e2ac9bb5417a01497c98891acd5

SHA1
ce2984ef184648145696f313d17e5acea2a852ea

SHA256
2d170158b857ef2d411f2354568a704f35c57dd481af76e5445968d3d5f0a77e

SHA512
76f2c70e3339405de21162295563c46e2775a82698aa7801bed023e9558ae5b6ef75b6d805992e74063c799d85df6fef3bd1362b2e2d5c01473d59360b9148ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[2].xml

Filesize
488B

MD5
6a445075e26a1a6c1a49dd1eb7765242

SHA1
df7aebf14928dc57158bd7f423bbc943a5bed99a

SHA256
b147329cb4e273e801df5fe85d40c47caa5756651ebfb1e649e97572e438ada3

SHA512
7d87a648ea2de868ff8447f53b01ecff284374b4df86c53a71cd21dcf1e61886ad4bff86f6a062a3cabe130a35c7c4ba849757336aa6463053936bb0568c7e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[3].xml

Filesize
216B

MD5
856133f19bb7704181a08e02640d48c6

SHA1
6510d0d4aa5d1dfa8b0434af0999b8721e8b5b89

SHA256
528a4804ea45bfb4aac26371c304a389cd21a4cb7679fabf753d1e794f96c89a

SHA512
b24c3ec6baa84d282f0456dab0b3c890cd8af48110bac5c4830fbdb75b1cfaf859af23fb9e0bffda1c9242e790afab4eaf4d3441d942d457159052f533d78bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\qsml[4].xml

Filesize
217B

MD5
9c4422bb6da5b4c64e04cdc41d542c2c

SHA1
aebdd1c78e53d5039b25a8d1f3f431ae516eb36a

SHA256
bb8e30346e3c1e293fc3274aa1a66c84e60c13aa76027f1dc7406691f918e26a

SHA512
97b7d01f3a69f875b707aeaa552a41cb5a3ce2b5465a2db79e5c1aebf7c2887e04da6acd78df98f61da7487c496b8cc709942f286f64265289127c83c5341fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\virusmakersource[1].zip

Filesize
1.5MB

MD5
5f80837463c08177865a2165b0ddcb3d

SHA1
9a831df118c228bee59b0af1567c6c5fd13cbbbe

SHA256
473f5432be4bf1e36f0b2f7f33324924318ec6fb424b701619d00b9c28c1477e

SHA512
c23dd81f3ab3790d350d2f0135f527fbf4e7b72b41474cfcb859f0187d2d9c8cd724c661b57c250feb8274db267443169208db65ed6c284f1a9aefde07dd022c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\Email Bomber.zip.19w42bt.partial

Filesize
60KB

MD5
8059eb7aa725a52bec307f1ff4830783

SHA1
4c5dbf8f804a1aecfa1a7db49de086e265f5220e

SHA256
ffd27f894818a5503c7cbf9bb2d9a5aa551de7144e8ed8c5dd1fbbd74e57bf84

SHA512
6919ea7a9738d3ebbf7cf2829a735ab4ef0da8e2ecab579d1de409332acf20a5db8b99a0b03075169f8d0c9a6b16398dab4b597478b52a11b24258671758186c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\File%20Crypter[1].rar

Filesize
47KB

MD5
54f7d70f50e05a57e6a841e889c5a1da

SHA1
b4c82e1fc38373b11a561d4695c5f3bf83506954

SHA256
0f1250243544eaecd61edfe7bc3d1df8f6f4cfc00a4128dbb34747b4c58f8cd7

SHA512
0a121a0a2830ea6d4431f4e10cb6626d7b3c342a6b6c209b5b61e2e8d73dcad0bf880afb85d33737ae2a2e7c7622ce832d58552d114364e2dd7a2ea0ffd543f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[1].xml

Filesize
245B

MD5
f9cb258857c50fde4f7d7a0ff54d1e19

SHA1
0626a844c8fd5b80da15d67fc86671c278a69752

SHA256
5ce0bf8ed10d21a0e5ecc587721796615eaf6bfe6b98ba1d7cbd0349c22cdf5d

SHA512
726bd46731137059f3703cc258afeba9d4b75daac4c6c83a89ec710a4c8eb8f3c985f3ce7d91a030de57f2cb0c60df3d88447ddba10568cbe34285d26d03d448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[2].xml

Filesize
218B

MD5
b7a4bd4c9617f6dd4826f98f8685b7d6

SHA1
c46724d47f4e72ad1f4147fa088322bb326d8e91

SHA256
f9c0a1a82aa96dec16c080e9804bff2069dad523ed1ebdb82260ae806576957b

SHA512
50657b050213f06920c6a782e02dde51f398a1e0e9296d309529b823b3e15820e83591fd393cf4431cb3010fa1cf7d7c6da2d3b168b7d9ecbeda72061a669944

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[3].xml

Filesize
217B

MD5
4ad4501b4313cf24e8877972c6fccdb7

SHA1
58bb3ba9691e88d0d23e5bc82e931305e90aeda1

SHA256
82a99f09da0f3329ede5b7b0e4d54e2798a9898797fd68fd288ec5382332b53e

SHA512
c3ea5b0cffe1450bc22b24158506241666724cc0f9e8cfebe8626f291e3bcdccd5a3a10bd8a0ecdc0bbaa3ed6f958285a3873628155a571b40142c19b1cfc1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[4].xml

Filesize
216B

MD5
c782373b629242072fcbf9786fc5770e

SHA1
c13b91eaac947045db3768ab17b4c100fef75ca6

SHA256
fb1a65f674f5470a701eba08cccab9fc45b51087a6e9062b520f6bd82a85b84f

SHA512
d2a196b1ff615052884c98d56484793a9a9158cb1b974b28f46022c2e457d6b1ec26f99db21199ea740a557371e792838259a242ceaa95f6bed6fb1f29af77d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[5].xml

Filesize
215B

MD5
ed3737035bb161787a94a2ca96559daa

SHA1
d9f5e17cbcbba6271c4ced82065d1f45f75fe11b

SHA256
ff45ceda004787d902642010d5a08d6010d94492fc1997855c2c0c9d3fe0fa1a

SHA512
dcd9f926d7296717f6023fb2255c0df0b97ca83ae9c3ece31c81e2af07b84fe589065f77d4afd799dc053383c4bff031648006dc27883d115dfa23e2dcdea403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\qsml[6].xml

Filesize
214B

MD5
73cf153fb856a8a25457ccba4fb31e16

SHA1
0fd8e02f315b0737a61277b6870c4c72f72fff3f

SHA256
91ffb6dc35bcbc5dfaa221ece606d75d1e4cf0871cc0010a6d0beca8574b06fd

SHA512
37a51744b0a4e3c9057e4cc688cbb324a7a3fb9b2f10b8d8384f53d969f0b6094a372bb9e8b258bd0d693be42e9df512c327cf4ea188adb32eeb899a07c7fdd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q4648X1K\winrar-x64-701[1].exe

Filesize
3.7MB

MD5
3a2f16a044d8f6d2f9443dff6bd1c7d4

SHA1
48c6c0450af803b72a0caa7d5e3863c3f0240ef1

SHA256
31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

SHA512
61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\favicon[2].ico

Filesize
2KB

MD5
faf4ee72a7239c094490a9a4863b697b

SHA1
e4b64ad013bc9d733e8b5b6f98c5c25606175792

SHA256
7aec4a643d6846610958cd1796b6c8ed6c120bff4c3a507a8f2ed5a73e9ec6d7

SHA512
bff0920c06a33497f23e0daf3651a69cc17e9bf7aaa5c8b4f059560a8396e2a97659f62d8866684512afdfe0be615ba9fcbb4cf10d8f5fceb7c667ff368543ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\virusmakersource\Virus Maker\Virus Maker\Form10.resx

Filesize
552KB

MD5
46e8af63413445b9ddf99d9d04b6ccb0

SHA1
8da9dcaa3290fff7326821fd33112f05f2454338

SHA256
ced2cce60d25271c22520cdd2d52a3d0f5763898b4518fc9956f0665fb00ea34

SHA512
a5a2dd9908c2b323b67cdcb537bfec9b70097531414afdccc92b896fd3a2d113f8dd4a5aa5eb580b743ba63f4d9d400803a6b2ce5dfff5dd3ffa59648061f022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\virusmakersource\Virus Maker\Virus Maker\bin\Debug\Virus Maker.vshost.exe.config

Filesize
186B

MD5
72a9c8b79a6577721302be0a9a75f53a

SHA1
b98675b937dabac285d37ed8dbf4d3755fb76777

SHA256
87451e21db5e08cdbd746570d3b2e61e9e7dddf3db87420dd751b23777f6b910

SHA512
b3bf9709bf210c431598bad84a5f8b8a53c41374e1c27e70459e0c5805a9fe480fab2e6ad6c1c4e190e7b36df1830ae68e12f8b2756c6f54c4b0977c830b0797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\virusmakersource\Virus Maker\Virus Maker\obj\Debug\Virus Maker.application

Filesize
1KB

MD5
0081cbde5ee180fb181e7e408a002d21

SHA1
4197b6a93965553b9b326b6d514d379a2eabd3d0

SHA256
8ae66c6abff9fea7fff3cedd32cec25236723359d88bb749256bdf0f0d1c628d

SHA512
bb3d908ab759561775a821994cf582d935c9def6936961ecc692fec066dd88e0f62ad5bf3da28759b92efc2c6e8ef39553bfb595794ea418f7da922f37f5edd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROLMKJ86\virusmakersource\Virus Maker\Virus Maker\obj\Debug\Virus_Maker.Form3.resources

Filesize
361KB

MD5
458567bc1e4e7a27a916ea220e5d4aac

SHA1
4e740b5e8829bbf369aa5a109ef4be9d00db3924

SHA256
3d0a66e9c3f0d8a776667599f39b39628222d1d6f3cc85c56e7a4f332fca7cab

SHA512
37c78165ade2a12fce2131c91768e4d20e5af489b0355ff94af4d9e2a2be1961f6a19d2fc5863f9c9889bb46bb0e2c23de66f94e3d94a2dbf596b6017abe2a12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\PH7SBE5R.htm

Filesize
16KB

MD5
b011d0a5db3bc0b6aa9c04368f2f3020

SHA1
67aca754134242323d6dde1abd2da415e48667c4

SHA256
0d985a855a6906a43b23c90e10654b520a70e92a91c9433fbcd5bf68db380baf

SHA512
b51c862268d78f60103c64cf9c016febf5112e700e5e01ceebfbbe03fb742f2ee53e21550a7c249f7627b5688df6889ecc05942c35f91941fe42bd38c2971dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8UFEBH5\favicon[1].ico

Filesize
361KB

MD5
dd93641f8ed77493e86a01fca33558cd

SHA1
a4aa666eae95568bc0c894b2bc6bdbd6a107e5fb

SHA256
3f3798785c0eba47ca077ba4a8d3fe6f2d6f586c7314278e318b345cc5866abf

SHA512
24566e9dfcae2b4988d4edf5857ebcb9853a5b89a67e3a7be525446563cd8b182979b435d596e4c8b4074a04b0aca0b868d6d2e7c55353a986ac6688988c62c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFEAC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DRb1840.37980.rartemp\Virus Maker\Virus Maker\bin\Debug\Virus Maker.exe.manifest

Filesize
4KB

MD5
b134c54ace089250480282275a5e82ee

SHA1
540377f9d78c6ff40017822c4b1ca1f907757aa9

SHA256
0cc18c44eae60a0c1ece6aef65cb04d7d00868ba92665dfaa86d02170901596d

SHA512
0e2be4880cb101ffc32e8579de7792827b7d6ce1afb8746988c30493742e32ff55a501b304188e2b66c6cad219105e61a046539cbe9397864c2c51be1ca66bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DRb1840.37980.rartemp\Virus Maker\Virus Maker\bin\Debug\Virus Maker.pdb

Filesize
115KB

MD5
9884832f103234de66c4e2322dee935a

SHA1
6beef574a9fd35b7c2a6b32ae0c94cd8fe165a52

SHA256
9b699ae023be96fec069996acc4f5fd8d3e86e7a869d792c0b13963c19b23ce5

SHA512
fa25563e464a4177b229996134160e4faefc168a5c6b135617e5cd3332092d558e58d2c0f9f4579bd68e2f838ccc89941d87475179655fcf63e75f00cf414232

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DRb1840.37980.rartemp\Virus Maker\Virus Maker\bin\Debug\Virus Maker.vshost.exe.manifest

Filesize
3KB

MD5
49a7f5d6b5b9847d889166286d9c528b

SHA1
432810b2a2ccf558fc5187a52b096a42d94f0cb6

SHA256
c5ac34c111ee44d2eead93fe951fbcc7e56a77ad479c9f00302421c4f5b38008

SHA512
f7b25b7754eb946dfdf0fc009ed89f3642a88744324b45b75f8336675f25984e5ea0c7c24703d232cd8ecc98a94284a0a1e30458dc0093c050c56a33519cd075

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rar$DRb1840.37980.rartemp\Virus Maker\Virus Maker\bin\Debug\Virus Maker.xml

Filesize
679B

MD5
858d0edeb2a8a9fbb269b749c87f74c0

SHA1
9f2ab5ca9abe599902bbeae603c39a7e673cffe0

SHA256
9fd441ea73a6a2618d054b60b940300540329f1945b9c467299224526e1392e1

SHA512
fe99bc1a6e63643c2ab48a21065025cdf3aac9fcc3c56d823bb25c139617618a0d75911495a86272886c79f4d2f246bd4bbdc325f17423f02bd070e9e6c7b048

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF5B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF7E95FE697DB55B93.TMP

Filesize
16KB

MD5
97312bf5b316a3c80e0af97f78c3ce88

SHA1
f0be69e940f38be6fcb5f801eb49de5cbd7f43c0

SHA256
9e1e72b4ecda6311865293c9fc8ce982a90782d1b7bdd1971da8408fe7b4348b

SHA512
d7f215a5ab88dd391d3857ff9e924d80616ec9835800238436f004366f670abd574cc6bb74a0f9cdb2fe980aa9a0f6f5ba4c06d3fce822449d7768dc0a5c8975

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4NNMU8SO.txt

Filesize
1KB

MD5
20ab55565ec20139c49bc6d1b9f1db96

SHA1
ffe72ebdab199450ab5f8cd3be309cb539e60741

SHA256
65630d60303e2bbd562e2050422e16407e12213fffa85c3e9c41143744e555dc

SHA512
b11590c7464b5dc88cf6cddff2788394515c1431916853f1bc6c754ed5ee19265c253e6453bc6902aff69da4b10a3ff5c97abcdf2029eff3c9c847a1806230ec

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ECRKUNE8.txt

Filesize
411B

MD5
50c331c387c988254a17c9df7277eecb

SHA1
f9746d358f09b6f0d8e5b2a1c7a05c6f0c03459f

SHA256
f8c642ee97a57e5960c49be1bbfaaad807a212a2e5401ef3ecb1a0cd1c1ad437

SHA512
5041f61b229e71583b1344d430840b93e3217cf901ae5be87ede4d767ea3838625f55763b33609b3c9c2ae1a0964d3820c54c9ccc72aac4663bd3f43a8405916

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IFKUSMTO.txt

Filesize
78B

MD5
587a48b1e5b6fbcd26a7ba56d938e74c

SHA1
0ce48c0989007b0b8e7ee36b2bcf033411b96fd7

SHA256
6db1ea4fe572b48709f4af5b0e171928507ae8bfa48ca7c3dbfc3ba1431ba767

SHA512
895afc5a272df3dc7681dfb861dfd58061e3d2bdbcaa541ab568ede3aad11918276cde99891da8e3f0836744cb82ea4aa4f4d56643391adc2f3e51721c59e5ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\STFU7Y3A.txt

Filesize
509B

MD5
77f356a3051136932046e56aefdcb611

SHA1
271d9d1fafaccac1aa33da06ce33dad9cb2c68c3

SHA256
acd1b47e5537d01a43cdfa923d6d50617cfee17272f5294655c18b9f7b1f88f9

SHA512
dd47ec97ca0109ecc08591610c0b34371c8a463d2f33e6bf54ebcd2ac597b1429abe2deccb3c0b8d34d3690d8c4e5ff6587d229389d295fbcadf271b5670fd47

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
20470dd2b3ff0a0ca318caee218dd18b

SHA1
e66db2fdb1cfbc74f176ea46db3e53346bf84595

SHA256
e7bd614fab8a56e7ec3477427b2aa3daac259b7418419dcec6d433dd982b5a5b

SHA512
cdd504981d295d1a822eb7678df9268fc5f57b3ecbf63a0320da591b5346e748b3cf360f9d71a825dcb2e536faff49b5b3a32ec4dbc979db5ae6b6187b048964

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\28c8b86deab549a1.customDestinations-ms

Filesize
3KB

MD5
fb998606ab47662fe01bc2473d37fc57

SHA1
5dffef6dc7ebe3ea152e56ef138163a1c39fea06

SHA256
bbf081a36c77a318a16bc1154e2a1a75cacdbb64609fe2a2a0091f38303c6e8b

SHA512
6a17c10458b3b4d1371d488f63daf0f21e92683a28eb914cd87e7918bd30fe0f1b95b97bc7f1f81ddd41ca7fa5aca2406c6617d31950c5c0070cdf0134dad34d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\87RI8WEXJNJM1GV66GO3.temp

Filesize
4KB

MD5
67350d0965b2e196b7a5b423a5f0437e

SHA1
3233921650130cb4b8cef6457a72b259d9d413ab

SHA256
7ab47c83ebefbd74bbc30f6b9bb905c3157f28605e522536903cd2d03bd7e07d

SHA512
207960daba009f0a3ff0d8e25c216f71837c27042904127ca144c109b9c46786bc692fad99aed1cd378dd48a70149eb2545185b0b6a645b034a93c95aeb73d88

Download Submit
C:\Users\Admin\AppData\Roaming\WinRAR\version.dat

Filesize
12B

MD5
34c638a1e21a9478c0edeafb5d9f46ba

SHA1
a6e3a6f02ea8e9f93af6d77fb81d9e412ac2da1f

SHA256
97fb4927f2919474785af0fd02748b5430f3119e946bac4e68a9345a10fe380a

SHA512
e17079dfa0aa9c2e2b28e33cd4b77ece03f4fe64cf0180ba735ffaa6e79b53ae723196e9f6ac54dfa16cf50568a23643d957e4429188ef20912bec33f72dc46e

Download Submit
C:\Users\Admin\Desktop\The Matrix Green.exe

Filesize
4.1MB

MD5
d33051e62b858d1f1b75797b080e1d8f

SHA1
2bcb1c7aa6f6eccbc97a45c0c495bd936a8e879f

SHA256
2cc325949e74ec94462a1441a0d35e13514740c7073065de1c79cafcb921431f

SHA512
29818209434eac84e192fa02b9a3f96585f171ecdae5c2878da9fd902de1e8e8bc9eabe46823d030ebb55ab9ca0f190957ecedcdc88ca81e06a72914584cc57f

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
73B

MD5
f0d8bdc0bf6d243d908539e01ae96400

SHA1
cc05c08e73acc7efd8925b92f6b297451958d12a

SHA256
87881c2eb7d4fce71b7f6c6b3a8d56cab8cae32659eed53b6bcb95b64a79beed

SHA512
3f4e26961aceeadff6c269de8631da50ce9091f075ff78aea400b0ee3a13fc07ccfc747377f6170a7d6097e1313672ca08ada6555fd7eedfcced62105a047c22

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
127B

MD5
5f8dddd5e873494b8f3120a10d3fb39f

SHA1
2c0c0a3f4d4944d68f721b12fe0c652cff93830b

SHA256
e0a52973915219f9064a12e595ab2fc88dcce6199c7126b53755a7e31aa841a9

SHA512
9159c2e95d7ede48daf86b0aa55ed43cbe0bc6efc041069cc3a477b57d8a73775d2d0bfdcb84483fe4c972bfc6029f9c6ce67cfca7997fb6d68a595ec1aa137d

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
200B

MD5
faf41e0967934489c63dd68296cc73c0

SHA1
189660b357cc60e2b934beb8c9cfc7b23f2b160f

SHA256
d97b8e05c150151bc6a608bda9b476f48aabcc46bf330c903f9176e5303ca9f8

SHA512
37880ada988a6fb7d345358705f046b9040aed9f797dfcfe9d0f581fc1798a106887bd39c546b031fe7d361ad71d088476930d0cc104e281c74e036282777be7

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
254B

MD5
c8d967691eda5d215b0bdf65d4404821

SHA1
19a593bfff2700b2fee0dd6d988e0d2fe260a2df

SHA256
ec1cc7b20ed36c209a545d13e2825d2aa2c27eeeb8a820ab199171c93be29755

SHA512
66f396174017eeb0e15ee1fe67969c3440927f7bc2e4a6c848f6f5ff9c92efe48da46a79b6aeaa77cf386f02e1c71e6f89779fd2d7c49a06da89c3f3b7f83f11

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
327B

MD5
75d1b82bcdd428ca58c1dcda8e84f9ac

SHA1
b303863797606c0038a73a5f5d94b90fac18c5c2

SHA256
76f47b220acfb11f4efe7f7f6e0e77165f091154693fdefa937bbaa7b208fa66

SHA512
75d5e79274c699454ce8e379a2394885300f362ef079ad2ea08353f68b026ac48e8067be4d6682a8675032b5c9387a850727ba48f32e1667011dcd31450898a8

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
381B

MD5
1b1b34cbfe4b0799959287609bbdd752

SHA1
3b6187c482aa7ed54567f03965d3a2b790d85296

SHA256
a1726691726ef0e1caad48e7623a9064bf803c5b1b500add8722e7567db47df8

SHA512
8c793c89078c6659123b5116dfdda3f91120f7ed8b5b9d13dbfa11ab9cd1d53b59fd2ed25c9a9c2b98ce3ed9676ae84be9e86f866b874091bf4c3f9eed16d983

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
454B

MD5
7c8bd0926511f9be9c3948ebf801f2e5

SHA1
b85a47b9b2da5c4339d0dd3cf267c4b28550f3ad

SHA256
1d7c53b277c6d2bf82b21c876ffed2b545344c35a5f9f13be707cfc71f0633ad

SHA512
3b56207abe14622b57f676bb19e844fd913b2a9d5d56f78710cc2e9988ca8038300c81981ec26f65c5f73e8d4d3ad096d46e4aa88378e2909d87ec6e78d74da0

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
508B

MD5
ab342ceaa43af293176c35ecdeb62790

SHA1
9f11d3102516fc5b049c02a789ba52368caf3e10

SHA256
6591cb7f671c257a4225f308064c1a0f115f84c879e26e3ba19fef9ab92c9fd6

SHA512
956d68292f76955fa507036cd4be8f7564491aa26a24ab550eeebf3bc00b3568ed7760976afee55591d9e00cb828cc9f81c97aaadbb5f6671680656025b78300

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
581B

MD5
90b79d55c193ac92cb0ec2c3f5e53fa5

SHA1
3a43ad536ac6b64175dd4b955f4a7cfc96066145

SHA256
8c503e438d0a0c6e4d098f60c7cd867c12d2ad7aecf610530b7ab2a652a11bec

SHA512
a109385ae9c3703b5e395e0cdab1115c7eb6d339b8f59c905f74c20c483faf80e36724a4342dc884248afb8d3568cd1141591ee42eb81d0ecb34ecdfa5a62251

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
635B

MD5
e32a343ea9e2f0f824cff513d0a793e1

SHA1
d88f897385acfbef0d0805d50b35b48728e3a58d

SHA256
b19afd83c415ab16d14348b55d67b4636732944f3aec65832fab67ac4ea7051a

SHA512
e0da6f93177cdd9593f8f08bd215aae8ce5332f25aac0ae98d75c05d94781f31aeed4f495903514c485f8548dad1289e515c5974b66241563c03c23d8941e9b3

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
708B

MD5
b97589750b47366e3c5b6905522e78f9

SHA1
fefb2de67d3b423f2b1df350588558a348dd1e6b

SHA256
53e5d8ae099c0e1fd0988eaaa8d2d2a277d3bc9b2d845b77484a77d7dde95270

SHA512
ac253a1119b3ae7ad22bcf1eb415f86645ca2b0cc862144d935530984221a180279e2b37980d709512141bca66104a50baed0860622fc0d406357b8390a75715

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
762B

MD5
ddf331e633485dca7172c4dbc05a9864

SHA1
5fb00a0382c38477651cfc25241540116c22c5c6

SHA256
e14d3e3392ad28cf45a020b84e36d353d92ef376094a44c77f742ffd6e2a767d

SHA512
76f27bd152239eaca69d2f0aa2a59df4dec08dbbbefc6933a4041120c6affc6d07db13a8e47a538406608f7eebe8b13f6aad16541319b28080fcbf2b4f3c1832

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
835B

MD5
e31af5f391d32f4facfa6ffa9a832f37

SHA1
5cd3c0e682265c4215c14b124911d0e847ae4ce9

SHA256
4c061d34807eef32dbffd78b8c05048c56bbe981c358117e62345c2078d9918e

SHA512
98ff401c9b4a1590fe779f29bf7ab2e6238ccb25c66b1498e6b6a157aae7983349112b826c1ff1acdecff4b33542ffe4ed951fb46e4263a242e2577e2ff3430a

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
889B

MD5
806bd973e51180bb81fc946d962188f2

SHA1
094844135fd9f032cd574e3a6db387046d6da135

SHA256
41c95ab33586facebd648b7159d003b5bcb06ab048abdf35472fbce9207de9ac

SHA512
0d680f0d00018b180ccf38b795147553ba6f43c2681dde4652973b3a4c428d08883c5b70470352c933632a238f81e39c31e91ec5856137b911c3886082380be5

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1016B

MD5
8decefe0f2b06826f2875ad160d46ab9

SHA1
e87cd5972c36d2322707ad286aae4e08e2f1a6a1

SHA256
0f3651bfafa5c399f1d92c7d0d755bf3321ca988966c3e00090d1872426c9feb

SHA512
943925ca20d7dcf3632bd1f6c9521c5b05397d599b58b5d3ba34ddc71b2d92c8f6962e5b011bb20700dddf4798c870e49f4224abd9179a4ca5a09a7035fe6cb9

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
e5749af906f87c7d73e42b63460fbbc3

SHA1
6b98d4c076f0e3fc310e2560eca801754f02b25e

SHA256
6d063f72b12365ff6f90ec7b0da4f6078a1b991e8c595a285cb5c037761d11f9

SHA512
fe1032ca521d24acd1f389172de2de6cf378d1cc68b01ddd94e817f384f4d9121bc3ae46e1e658a9440c54fcbda6a60eefb95948cf6b83be5443431b32df2b0b

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
fe20c5d1c3a058b3922ea817a9114823

SHA1
5bf06e5f8e514ee1b1371c042e925013233faa5b

SHA256
d2180a2ed930845d191bdb9045367ca3444886d694457e8b25e3ec0c82c485e4

SHA512
10a586706b18179fcf415ad689b0b408177c09165b310b06a8f90cffc39d8c6e60203d39ba53d345109b1c70d8a60579d1fe98f3caa667b1544eda7fc68bfff6

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
d01681cf2b42c85dca7d4244d0a9d504

SHA1
0505914e0cf8f7d3b0e8a069e4f241a5467e926c

SHA256
a73eff403bbba22ea37f2c031671da570beea125f59c630d9a53998876509efa

SHA512
681351bc34caa4746ae3671d27f7e29361c7cce2d24d3d8d368a07f64c690c9c5af8428d985bb79a2728431216d3082147a3fe7e69b8eedfd152ac0ae809addc

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
5cfe34b24c97776961cd0346c72744f6

SHA1
b89f060da4f887cb06508194c82a6d6900cc61ab

SHA256
54818395352618a3660570a18c8100367981d6d64e21af690c7b52c747ee6fc5

SHA512
4bbaffeb5e8f6fd949f45aab7f9a12249c7578099646db5dc5c2d01a7822635e1fec23c3d2b593cb3f79bd66b9470d6b9449bc791a04dc761e873e3f1141e176

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
ce92245fd6ccdbf39df07c9625fa2dff

SHA1
83093f57d467f6fb15c7a514bf7d21759230813e

SHA256
3d6bd150428bf16285f27e41c756d52d6432678a78dfd15a4b691526a1186dc6

SHA512
3c108f3f77858a803a804830257c1fb63a8fd6cb62bc04e7d4f2fd2016ea22f26acaaaec10674edd92a39edb5af611a4640d59cecdfd8bf93a356c6009dbc346

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
1696207f90330332c4c3847ef0105798

SHA1
eedc99a3b7a8de643b4b19edcfd8548688931ebd

SHA256
6a4b93fe0c35fba75fa5f29344985e75b4564199f3fa71d538a9ff34117ea6ab

SHA512
70c2dfb24305a38c2890ab47ac12aa08ce4df6d9820479733f7269a994e1c8a36f87e309b0c4865e5dd921168a3ff472b516b459ed334110a21e4aa0df56af39

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
6723bd0edef8c801555b7d15b1998687

SHA1
44c8f4d16eb1d2bb9f4fafbc5bf5be2ee9d0aa3c

SHA256
72d380673e865d4c5aef62139a68def15ea17b51398ef23fe9a08d1f40cba9a5

SHA512
b74a36ed4d161526cca5d6bbe5716c382158837dcf923c32410b9d1a28e3fa731c9f67364fbf97a00ddf506814be28452ac8f261831831c95fcd480e465eaa85

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
5a440e58290e639e38248e92a96359f8

SHA1
81f194eb197ab092bfd8fc32f2dca20614c81fc9

SHA256
ff16b3d140c2f67e24e4bfb83c8c3a0651cae7e97b7deeb7de37d1935c456525

SHA512
23884d2505081b6942fbd384a951a316776032d7f6f6af109795a9378b7a6704792c1284e597bbe07a4228fecb433fc0408c091d19dbcc4387c3b89ffb7b78ce

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
fb041caa0f6e9d1524b16e24d59b1aa2

SHA1
a6e2996ff630985a221d4af321adffb9524efac1

SHA256
84c5b735cb936b90030ca4508aadc4a41bfb4f2e78f95ff3a8255018cd90ffe3

SHA512
65c8e93b194c676bc8cdf0b339387e1ae369e22ef6f444b083a343cdd05730c3757eda1dd1b75cf1ea7beeb5c91a00fb5194ec8043bb465ad3d097c4e3dd373b

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
33524cb5d687d5d71d4bcf052aae7369

SHA1
1bf25a800871a60d2343b0d398192150f3c8f99b

SHA256
f5035c44b0c1c10ee7bc8da7ae66398c88f82cafc6d55c7522a890446d86dddf

SHA512
b8cdf6b420bce2d4913eac97bd58a1199fd7ebbfa74c7b9a679d8130ec3b0c960e58f055a5bf4d4d2e3501ed89fe85b1397b401bdfcaa9a7caa510d302f17b35

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
1KB

MD5
a86e2b366406b6e3a60694a76d9b3ad9

SHA1
8525cd49889de7c7dfc170f2dbc348169f8eaa18

SHA256
2713c6bd372bbac82d513ea48b10fa490cb21f68b4d1e689c10b5c6332a2465f

SHA512
2e1768217648abe63a9a4f1fc9444fe688114794d7f367fe50b88a3a057e6930ff39ac172a4569d35830082f75b98aa92704ac86d0f0a3e7930c3b76a2326a57

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
88a5d825629ab1aa13f941789f1e2cfd

SHA1
5db678cd9d268c94424de673f1056f24fd5f0924

SHA256
6470bf39554f4aed99352210c0b6aa71c78a538c720feff33d128730d0ac061c

SHA512
743235a26c40079725ab2f7a88ccdbd6e9bcf3a1e187eb3dd9a6b7d283b3b4562b8dbb992dd00dc341e48bf186b4a94a321a2edfddf84a1437f00f1f7c498d9f

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
9414778742ccea901a0655875fe1c06f

SHA1
671030fd0177efcb746687688ddbcc81290e1d5c

SHA256
54c460cd47e11a7b667873f9fcfc5063194934449fbb8f8b7bba0734a2d3f127

SHA512
125e128237cb68951caebc791106ae72112ba88063fc9eb53fd80a68995cc40ed2dd30963d16bafa71c8206748e4b5599482d210b37b040332eda3f807c7a391

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
dedabce541da512825618d89c55bcac0

SHA1
0d6470ddaa535d77c40b6ff1fc8b4661e58439bf

SHA256
59bbab1101e0e1ec895a1c7cfbd4f847f3e7b341670e6315382fcc93343e7e99

SHA512
9880144ad7a98f71f571aa5beee35214b7e6869775135458d28cbe039bdfb6074ed39e178364e5be7143adc8f0011b5f3ce14199f63efe52aad4a9df114997dc

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
fe4359eba122a91515aa0cb078e8bd4d

SHA1
307042cc68c154b3aa155c22bd275b47f6d8abf7

SHA256
3068d4ac8b25cb810e1c2419ac49b9e0e8d52bdf97fa849c818546140cbca52a

SHA512
d4f47109dc23e20c40e5a6747c4d4eee99f859458ef36373ec454d475b713677710962afb0a4a8349fea2eb0b1741fc9157d944c465582dfac9c8899b87fd526

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
c3c43613908436ab7da0105d5cb72bf4

SHA1
fb7e105088de8b776315b03a4b6232e1405d3a70

SHA256
565a3ef6647f790286c481aeb2840fbdf29db2b8009d076aad4cb62b193670ce

SHA512
35a575bf8c76588d16852db41659fe459ea7a44994e05910f86cc48bb448836cb86e19d35fe31e405bd71d68ef249cba75987b5948b6880b703bae37edef27a6

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
ca46993b8aa03867bcda081a008a0a5c

SHA1
819ab01a89933b819507f7b205b1b3a9e12ee63c

SHA256
a322470e1e11bd8436846dafeb81684ecb889403326a05b76d64a9ff9582e98e

SHA512
735f94f3980887d0b4c7de9340d0d82e3118ebb27774b0173d27d226c1bba00e79ee9e48270d85a66ea0546035d7d4eed38b781c7fe79b84a030031003b95cad

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
676ce9d66e5987718f4e0222e7856dd1

SHA1
c0784b0d6a1aed50b44f7e91aa1d5223539c1e26

SHA256
54e6ab9152c371b9810333a6cd784aff5237422061433b1f6cb9fd7c72288a00

SHA512
b887caf29821ce0913ac525a0582b58f0099d5d92227f9ea222cc186622d8eebbc2bd7018c8b0caf4033ef3b7c8afb0a74a2f5fa3858ceffb1e46ca7161cef57

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
e178409493c4ac9d1d9bf1e06048decc

SHA1
23dc0b951d3b210cb44349c4d9a6754b631335de

SHA256
70c8def3e06fdc77a53e9a2f783bd076530b0636872a5d7648069229fc475e11

SHA512
1723898226cc999c77a93b660cca18d5dd5659b3830ec17348b55e9f37404433b45f463183f501ae27a35efd68fb93484daba24c120e9ae12b10c084abd0a8ea

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
9b009adf9032e78591c7c625ecfadbe3

SHA1
db9b72eb01c070d2e3016e5a52de771850962b89

SHA256
641231a4f0bd491551fb64809b1946ac4ddf75b0207cf4eea0f0184ec1d13e05

SHA512
c776f7c7260b96b345cf2e6fdfd56173b736047707fc300577a9d20f0d91a90730c9d70062963b7b0f4ac18263a93df27bea9a677fdc8818197c5ae5d4ac9fe8

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
2KB

MD5
d60a7e46a01baa52786054600aa2d402

SHA1
868117b721a46c9cef22539d93034616464e6411

SHA256
624be51cc6c0de7960c9e1c4e2585292353b632a9b0bb66f3f79f67e1290cb8d

SHA512
e11853ebda27e8d4da10110ee8a728c4754cf9f09f02c16a0670db4161e3d71f1dca0ab6d8376d53d087304d8983185e1825647bbfb2eedfe88b91b57f8846be

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
8516e4a5f95702a17ff5f1f065d801b6

SHA1
388f7ad808486ee1835ede017f00b0077cd47081

SHA256
236ea02043f64a394139003b1b2a6d6af6844dcc02769aaf75637d5178cdc382

SHA512
05b44dc54d966aa324a39dad5681518afcc6920959093a3f0b16daf5da8b2a05602e379f17064e1fa8e6e9c6fad96a00f29f8523af44af8f5d3a55451954ec49

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
0af3c6006728fd99e6b3033b5edac761

SHA1
13d366f74bdcd3af8852d22824ff762850b1ff8f

SHA256
7deb8edb63a13c69b681ba947458d54a73971fad5ceeeae026e7bbb734e77835

SHA512
33641edaa8b303cf9cd34d48c727922bf81b634b9c26503b521668851d359c49c1991bfeac1c88d6adb92b1bef2aa5b27d513f39ea8f34314efb7a43a4b72566

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
4e07d12dcacb81f09909d26af821e1b9

SHA1
2cc801cb589cfb944a469124f95d5b23f7d8368d

SHA256
51522dd1a96bac06ec551679f95fd8f232a2055965c572af1083bcb702735c1c

SHA512
4d50ec8f6de52280177d02f079d4a20b0921ddab79272ff7aeb1cee6d586a68321a0285008dd9985b6cca74fb633404a1185565f8fe89d95cfe284ba1a783d18

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
195a6a281f3c71e552fa01815a4b557a

SHA1
93b693c5968cbaba42d088ee21aa65e699d37fa4

SHA256
9092c0b1e2ce1c4024d4d0727d24a6b58987644348ac230b39893e693c1ce580

SHA512
51508b0b817a275e4640583755c29956a990dbdb9b8ebb44eba88859f95e06497117acdd0abd5683233307f16c0d8d7febeb1ffe24ca18d971def9c94fe9841c

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
6372cf98db60a0f75025fbe1d7d3a83c

SHA1
bb945d1ca308eca094848a54b70868f61ef5bd0c

SHA256
473927b795fb1c85385a82bd5da1dbace9dcea51a851fab7f167dec8b6412abd

SHA512
49a73119500bf229e6ce21cc4de8233b598b31e2bb0c7dc6735372cc11b1c34a893c106f35c8a5709348c7b789c89e3625bc83bffda33dbb45105a988d0106c2

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
d9bfdd0be65686aaee7e28f1d4a96595

SHA1
1c99e373b30ce5839f12a900c20c386f0144d25c

SHA256
526252d15afed375030745f78217ae4e27d404eda9d1052bfb47a1d3a010997e

SHA512
9a7308d0ec344e0c65e7a39ac5a1b2daf3f2a2e06842c204d13e32029ce9d1d05511313dda3d456295d7694b4f9228dc2b6e52f04680cb68880b7249dbc70c2f

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
dda87c2c819e32be46ff027b7cd0e604

SHA1
b20fda172cf5fcb973e892b278d6daea2743af77

SHA256
41c8ccf4957c8e4f01d0794837bdf671579b8372348e9eee40fe21ee4a6b5f1f

SHA512
2a12709d1a8ae37bfc355b13e342108251ff8383dfd6d2160956c323d17b0e50f27f12461c13b42306cf95286b8fe2911b32f3c4ca2f3362cf925c86f955fe65

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
2a57189e7e099e116fd9a5393000e671

SHA1
11a9c3a43bed7963fb948267402f786ff33bbab6

SHA256
2ab2434ed47df64d57c8ca64a81edc99b4c664387a825ccbd4a89078146c7271

SHA512
2444abda866b8a339f48731ad1cee8ca6944b5066c0c8ee788ff73bf477cfad330861a94fa7bae868099b5b53bd919efb6b44598f649796604a464704b143577

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
5f167681f3a6898e298c4b6223a01e7e

SHA1
e151ac8cf537e0bcc281d376a0a0d3995364a372

SHA256
c4096ea797c100e1adaf507412d1e6078e8deb3112b71b1fe1eb427d9c165d84

SHA512
f69b2cec67f663552da49cf3024ab9b90d241ef1f34b6f5db90222b3190f9c019ba4447b15bc9a468e282dc8e602b80e7c5cd94cc463ecdbd7dedd14659112fc

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
4ea00a46a90146b181b8dd731222b397

SHA1
34c70c372432513235a1476566628015ffdad3cf

SHA256
355a785faf4951db983396ce7dd1e111345153d14663deffe3a118cd0dd70402

SHA512
10e0e3373244501abe3185d3f91f337d70ec5c30fac027e298dd5c6b7c667ceb5c75687057c7825a60a78ee079599be0e0bbb5bd2ae207c04289bca8329f811e

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
c4cc1f338ada1d1b7b5e31ef20b58b70

SHA1
c23cbcbfbe4387879a761c7452ac77ed31ab5cc6

SHA256
657152baad3b56c67715832359b1ed021b537488cc474dd852e00ec4f2d7b048

SHA512
d9bf025b213a4e7b8cda476c8276f9e4814578d4c47b06e47718ad1289bce0421903c802d74f45b0e1319512fc38981102899f8c06b17712ebbff405a9de70fb

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
3KB

MD5
aa313f2aa4dc68e2063e003474b4d616

SHA1
837d575124e6ae354c2517e05d7d6b35b61be198

SHA256
9ac935c93ae8118a309d74ba5512bc16db8c8d7eb0014c33266c1231ff9b24ce

SHA512
d59ed6743040d3375edc756c5e692575cb4a853f836417db9cbe9e770993d519359dadf639bac0e851e29bf0b5b02679abbe834ed478310a39ae83417e69e5cf

Download Submit
C:\Users\Admin\Desktop\msg.vbs

Filesize
4KB

MD5
ea3e6e25796942c19c8ca1146031465c

SHA1
3417a9de3b06350973996c275b801779c0adc3b5

SHA256
83e81b032e43c3c017affb554b2fee741dbfed1f7e4de62f47119905f4b8d9d5

SHA512
aaef87c3c3a6f90d90f0e8bea0dfa66510acb15cd4dae3c1c33a6f617bcc6491c62800125754b77241bbbdd37f17990b6847490ed90310281e139f5a85eaa409

Download Submit
C:\Users\Admin\Downloads\File Crypter\File Crypter.exe

Filesize
777KB

MD5
b5f2d61e8fe486262d9b84f86f2b77e3

SHA1
4452f2a3bedf78edd6de8946cb81e6b8a9f83849

SHA256
3e001dddef3c6fe03f8d816cc8d1de291f3f28bd90e6734660968f4678c24cc5

SHA512
bdc4ba3702c96e2f839ad0f61325f40e914fc7b06e5df343026a1b51479315719088d1ae263e3099ec30c810eb26b319afd5e59ac9af1b3e13f3da8a735dd8b8

Download Submit
C:\Windows\setup.bat

Filesize
4KB

MD5
5443ef670453c7089af7f3c7f98f6ff1

SHA1
897a7d13e57494a595aebba5c3c119aa7bc1b90b

SHA256
d75751a8d39aac1b7c4fe2ef883c7897eafff3330959d692396203644cf3941e

SHA512
b4e63f4e2c6a797ccb13a54ad3daf7c1d4bdd22e4ef12864d733b5b08c005a0fa40ffb975f59293e93ae461ec77be9d5e45bed4fa05c7e0959a621a06f967d8e

Download Submit
C:\Windows\system.ini

Filesize
4KB

MD5
2c139842b297796f305a49ffbdb5ad53

SHA1
ae98efb0496ea73c4c52c5ca12d37d5416e9f305

SHA256
292988fcc899d6060fbfa296619168c52c2ca98830bfd4ddd21eaa646e49bce6

SHA512
9ba2f21087cc5b1a83fd702430b6467ecf8c9e78bc9eec2388ad4720f969f0e8b6939d38f0883178a3b8c25210d08ba74679960c539115eee8608f14c7a22608

Download Submit
C:\Windows\win.ini

Filesize
4KB

MD5
ff4258dcfcfeafcc8a5ef90663ee4909

SHA1
6031cf0ff699bed10e14ab1741752189c6c98cfc

SHA256
8ab83daab479e2ca65557fc423245f8e07877b1342a3d6ba223a0d828b5909ac

SHA512
53b65db2ded71bfc2e868ff44b37e5d49960e7e4f646c7a840e32c6e117c6e0c0db1fbf129cb58c23185c6cc9b1e355d0c585beb901c7fb5293c3f78a5edf49b

Download Submit
C:\mail.vbs

Filesize
2KB

MD5
17017cd76e208bfebd0ea1ad7e295b40

SHA1
02e3e82cee279b7593321bbc299d8439e72a2388

SHA256
dc74b0f21cae8e6050ceeeeca134b2698fefaad51f5cd4d57afd61aa62af6d0d

SHA512
52d294cef11c894b5f9a3351eb4e95fc5d63244f3f7b4c1ad877859576bcc0fe1c8d9b37929c90e21aa18a8ff163ceb075079e8f8fcac1ce867e429c4eaa2f68

Download Submit
C:\mail.vbs

Filesize
3KB

MD5
595398d4f98a735c43a6f317f330541c

SHA1
8dc70f8dea9ecf122a120ecf379ab2797656474a

SHA256
2748c83329e376134e6ab67e2911ebc413a359c9c988ad781f8e3b585632a72a

SHA512
42de5b6622c65e6ecc9d2236ac7eb46158048e3336d66fa3d3fe848437a9733d93a946941504ddcc51f36d6590f7791a263920e0bc1d2c032b911b0c25bc29f2

Download Submit
C:\mail.vbs

Filesize
3KB

MD5
fdf30e1e7095e1cb631930f9c88df441

SHA1
205f44daf350aedba9e3be254efde5bfbf6320d8

SHA256
57deed3cd0cd409c162991457b76eee474a8ad6e72ae7a66e422417fef51a5ac

SHA512
6a43a3c9fcb47b3a765361d01cc7dce508833f6edbffddcae9b115193d4b11442f12e9888abb7c0650ebe6a01781e7d8063781d89de5bc9c7af98fd2fb5613a2

Download Submit
C:\mail.vbs

Filesize
4KB

MD5
3ee0de8be4808efa499da7287cad1701

SHA1
d3fa1ab221faa24d6ed8b4ac0371ada47b8131ce

SHA256
6ddc30f3a32ca3a3deeaa760d2972c23fb17760c5ff42953fe1d69fe28e2fdf7

SHA512
ed473d3bc8eb4b8a9f71e20e2ce45718a4bee7c45b10d3942a64f0e912b5f39e0b406af0519b51c0b305a527a3fb20ea0489d55ed8ea830127acf838e008f7ab

Download Submit
\Program Files\WinRAR\Uninstall.exe

Filesize
477KB

MD5
d36be447f422abc82276af9cb2f2741b

SHA1
f3ba2f58a88086f1b420a7520a5439a9eb851b79

SHA256
82a495858708b726f26cb86e2fbab8df86b9008a671be4c1f6c4f24ed3013735

SHA512
b9f5ffe578185b2f112d0bba21fdd6677d64986445ff971e9f6e8aa87a4684c0722b97a473150aff2742929fcaa79f6e336bd05d462bbdce149d634eb2f2d3d0

Download Submit
memory/1460-2762-0x0000000008460000-0x0000000008462000-memory.dmp

Filesize
8KB

Download
memory/1460-2761-0x0000000000DF0000-0x0000000000EBA000-memory.dmp

Filesize
808KB

Download
memory/2272-3876-0x0000000008300000-0x0000000008302000-memory.dmp

Filesize
8KB

Download
memory/2272-3875-0x0000000001050000-0x00000000013FE000-memory.dmp

Filesize
3.7MB

Download
memory/2460-3872-0x0000000008B40000-0x0000000008B42000-memory.dmp

Filesize
8KB

Download
memory/2460-3870-0x00000000000F0000-0x000000000049E000-memory.dmp

Filesize
3.7MB

Download
memory/2864-3874-0x0000000000270000-0x0000000000698000-memory.dmp

Filesize
4.2MB

Download