Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://temp.sh/whzOx...

windows7-x64

10

http://temp.sh/whzOx...

windows10-2004-x64

10

http://temp.sh/whzOx...

windows10-ltsc 2021-x64

10

http://temp.sh/whzOx...

windows11-21h2-x64

10

Analysis

  • max time kernel
    308s
  • max time network
    836s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 21:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://temp.sh/whzOx/trash_malware.zip

Score
10/10
jigsawbootkitdefense_evasiondiscoveryexploitpersistenceprivilege_escalationransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Jigsaw family
    jigsaw
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Renames multiple (2014) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 16 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 53 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 9 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 8 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://temp.sh/whzOx/trash_malware.zip"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://temp.sh/whzOx/trash_malware.zip
      2⤵
      • Checks processor information in registry
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1780
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.0.310416399\338728642" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3dd0408-ebb5-4641-abbb-d097b29386ab} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 1304 f6b9d58 gpu
        3⤵
          PID:2756
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.1.1433014091\1127469202" -parentBuildID 20221007134813 -prefsHandle 1492 -prefMapHandle 1488 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3c6d54b-3d24-4d99-bc68-16ae1b5d6297} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 1520 e72858 socket
          3⤵
          • Checks processor information in registry
          PID:2568
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.2.526913828\2107644002" -childID 1 -isForBrowser -prefsHandle 1128 -prefMapHandle 1124 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {01113230-a777-498e-8613-73470aa3a80a} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 1788 e64458 tab
          3⤵
            PID:1308
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.3.695208731\998900422" -childID 2 -isForBrowser -prefsHandle 2776 -prefMapHandle 2768 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f1f4a1e-72f7-402b-9a6c-2de9164f169d} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 2788 1cc22d58 tab
            3⤵
              PID:2800
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.4.183833262\1930895622" -childID 3 -isForBrowser -prefsHandle 3592 -prefMapHandle 3644 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b4130b7-7535-4c4d-9366-60a5d0b4486e} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 3596 1ec29258 tab
              3⤵
                PID:3044
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.5.1222569465\1281838615" -childID 4 -isForBrowser -prefsHandle 3892 -prefMapHandle 3828 -prefsLen 26432 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {233a804b-a836-471c-a2f5-f407cdd1a2b2} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 3904 1ea0eb58 tab
                3⤵
                  PID:2284
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.6.1916544062\1141306212" -childID 5 -isForBrowser -prefsHandle 4008 -prefMapHandle 4016 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6339a95d-01be-4b49-85bd-947d1e83e000} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 3996 e5b558 tab
                  3⤵
                    PID:580
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1780.7.1550557504\1582466854" -childID 6 -isForBrowser -prefsHandle 4244 -prefMapHandle 4248 -prefsLen 26607 -prefMapSize 233444 -jsInitHandle 744 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24e903a5-2f45-4b6f-9dcd-8758e612ee43} 1780 "\\.\pipe\gecko-crash-server-pipe.1780" 4232 1f5b7e58 tab
                    3⤵
                      PID:2000
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  1⤵
                    PID:1100
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x5e8
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2928
                  • C:\Program Files\7-Zip\7zG.exe
                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\trash_malware\" -spe -an -ai#7zMap5378:88:7zEvent24391
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:2260
                  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
                    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde
                    1⤵
                    • System Location Discovery: System Language Discovery
                    • Enumerates system info in registry
                    • Suspicious behavior: AddClipboardFormatListener
                    • Suspicious use of SetWindowsHookEx
                    PID:2336
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\Downloads\trash_malware\trash malware\stupidy fuckity malware.bat" "
                    1⤵
                    • Loads dropped DLL
                    • Suspicious use of FindShellTrayWindow
                    PID:1784
                    • C:\Windows\system32\msg.exe
                      msg * you did a mistake...
                      2⤵
                        PID:1608
                      • C:\Users\Admin\Downloads\trash_malware\trash malware\Zika.exe
                        Zika.exe
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        • Suspicious use of AdjustPrivilegeToken
                        PID:924
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe" -extract C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2468
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.res
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:536
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe" -extract C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:940
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.res
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2356
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe" -addoverwrite C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe", "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.res, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2056
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe" -extract C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2064
                        • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.rc, C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\icons.res
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1748
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs"
                        2⤵
                          PID:2000
                          • C:\Windows\System32\wscript.exe
                            "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs" /elevated
                            3⤵
                            • Drops file in Windows directory
                            • Modifies Control Panel
                            • Suspicious use of FindShellTrayWindow
                            • System policy modification
                            PID:2680
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\IconDance.exe
                          IconDance.exe
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          • Suspicious behavior: GetForegroundWindowSpam
                          PID:920
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\Illerka.C.exe
                          Illerka.C.exe
                          2⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:1692
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\FreeYoutubeDownloader.exe
                          FreeYoutubeDownloader.exe
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          PID:1776
                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                            "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2132
                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                              4⤵
                              • Server Software Component: Terminal Services DLL
                              • Executes dropped EXE
                              • Maps connected drives based on registry
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Event Triggered Execution: Netsh Helper DLL
                              • System Location Discovery: System Language Discovery
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Modifies Control Panel
                              • Modifies Internet Explorer settings
                              • Modifies data under HKEY_USERS
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:848
                              • C:\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_99931ad927972550\AppLaunch.exe
                                "C:\Windows\winsxs\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_6.1.7601.17514_none_99931ad927972550\AppLaunch.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3124
                              • C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe
                                "C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe"
                                5⤵
                                  PID:3080
                                  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                    dw20.exe -x -s 468
                                    6⤵
                                      PID:3712
                                  • C:\Windows\SysWOW64\wevtutil.exe
                                    "C:\Windows\System32\wevtutil.exe"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3084
                                  • C:\Windows\winsxs\x86_installutil_b03f5f7f11d50a3a_6.1.7601.17514_none_4fd3f543ddc446fa\InstallUtil.exe
                                    "C:\Windows\winsxs\x86_installutil_b03f5f7f11d50a3a_6.1.7601.17514_none_4fd3f543ddc446fa\InstallUtil.exe"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3004
                                  • C:\Windows\SysWOW64\RMActivate.exe
                                    "C:\Windows\SysWOW64\RMActivate.exe"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3652
                                  • C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe
                                    "C:\Windows\winsxs\x86_microsoft-windows-winrsplugins_31bf3856ad364e35_6.1.7600.16385_none_160ccc8a92fae520\winrs.exe"
                                    5⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3144
                                  • C:\Windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_e8657d02cbf5e4c1\schtasks.exe
                                    "C:\Windows\winsxs\amd64_microsoft-windows-sctasks_31bf3856ad364e35_6.1.7601.17514_none_e8657d02cbf5e4c1\schtasks.exe"
                                    5⤵
                                      PID:1764
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2572
                                    • C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe
                                      "C:\Windows\SysWOW64\IME\IMETC10\IMTCPROP.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1988
                                    • C:\Windows\SysWOW64\upnpcont.exe
                                      "C:\Windows\SysWOW64\upnpcont.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:3548
                                    • C:\Windows\SysWOW64\gpupdate.exe
                                      "C:\Windows\SysWOW64\gpupdate.exe"
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1080
                                    • C:\Windows\winsxs\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_d9c7c4a2e721da7e\dpapimig.exe
                                      "C:\Windows\winsxs\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_6.1.7600.16385_none_d9c7c4a2e721da7e\dpapimig.exe"
                                      5⤵
                                        PID:3412
                                      • C:\Windows\SysWOW64\wermgr.exe
                                        "C:\Windows\System32\wermgr.exe"
                                        5⤵
                                          PID:3488
                                        • C:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe
                                          "C:\Windows\winsxs\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_6.1.7600.16385_none_5ec90957e1a8fe95\shutdown.exe"
                                          5⤵
                                            PID:2268
                                          • C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_12c5b5b81f2d2f1d\evntwin.exe
                                            "C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin_31bf3856ad364e35_6.1.7600.16385_none_12c5b5b81f2d2f1d\evntwin.exe"
                                            5⤵
                                              PID:536
                                            • C:\Windows\SysWOW64\openfiles.exe
                                              "C:\Windows\System32\openfiles.exe"
                                              5⤵
                                                PID:1644
                                              • C:\Windows\SysWOW64\credwiz.exe
                                                "C:\Windows\SysWOW64\credwiz.exe"
                                                5⤵
                                                  PID:764
                                                • C:\Windows\winsxs\amd64_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_dcb42ec76404494f\aspnet_regsql.exe
                                                  "C:\Windows\winsxs\amd64_aspnet_regsql_b03f5f7f11d50a3a_6.1.7600.16385_none_dcb42ec76404494f\aspnet_regsql.exe"
                                                  5⤵
                                                    PID:2704
                                                  • C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Journal.exe
                                                    "C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-journal_31bf3856ad364e35_6.1.7601.17514_none_75d78dc0bb37c026\Journal.exe"
                                                    5⤵
                                                      PID:2176
                                                      • C:\Windows\SYSTEM32\WISPTIS.EXE
                                                        "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
                                                        6⤵
                                                          PID:1804
                                                        • C:\Windows\SYSTEM32\WISPTIS.EXE
                                                          "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
                                                          6⤵
                                                            PID:3644
                                                        • C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe
                                                          "C:\Windows\winsxs\x86_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_6.1.7600.16385_none_7cf343cac8a829ec\find.exe"
                                                          5⤵
                                                            PID:3672
                                                          • C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe
                                                            "C:\Windows\winsxs\x86_microsoft-windows-driverquery_31bf3856ad364e35_6.1.7600.16385_none_95f92198f65d354d\driverquery.exe"
                                                            5⤵
                                                              PID:3188
                                                            • C:\Windows\SysWOW64\wininit.exe
                                                              "C:\Windows\System32\wininit.exe"
                                                              5⤵
                                                                PID:3756
                                                              • C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE
                                                                "C:\Windows\winsxs\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_6.1.7601.17514_none_90ecf919657dacf4\MRINFO.EXE"
                                                                5⤵
                                                                  PID:3732
                                                                • C:\Windows\winsxs\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_bfa748753634ba48\SystemPropertiesProtection.exe
                                                                  "C:\Windows\winsxs\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_6.1.7600.16385_none_bfa748753634ba48\SystemPropertiesProtection.exe"
                                                                  5⤵
                                                                    PID:2468
                                                                  • C:\Windows\SysWOW64\SyncHost.exe
                                                                    "C:\Windows\System32\SyncHost.exe"
                                                                    5⤵
                                                                      PID:3096
                                                                    • C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spinstall.exe
                                                                      "C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spinstall.exe"
                                                                      5⤵
                                                                        PID:720
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
                                                                        5⤵
                                                                          PID:1076
                                                                        • C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe
                                                                          "C:\Windows\winsxs\x86_microsoft-windows-w..ion-twaincomponents_31bf3856ad364e35_6.1.7601.17514_none_8b399e33ba72bed9\twunk_32.exe"
                                                                          5⤵
                                                                            PID:2656
                                                                          • C:\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_e83a110af77d5aa7\isoburn.exe
                                                                            "C:\Windows\winsxs\x86_microsoft-windows-isoburn_31bf3856ad364e35_6.1.7601.17514_none_e83a110af77d5aa7\isoburn.exe"
                                                                            5⤵
                                                                              PID:1484
                                                                            • C:\Windows\SysWOW64\Utilman.exe
                                                                              "C:\Windows\SysWOW64\Utilman.exe"
                                                                              5⤵
                                                                                PID:1532
                                                                              • C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qappsrv.exe
                                                                                "C:\Windows\winsxs\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_6.1.7601.17514_none_42d65ed50fa3c682\qappsrv.exe"
                                                                                5⤵
                                                                                  PID:3620
                                                                                • C:\Windows\winsxs\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_0adc1fc1cb6f944b\SecEdit.exe
                                                                                  "C:\Windows\winsxs\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_6.1.7600.16385_none_0adc1fc1cb6f944b\SecEdit.exe"
                                                                                  5⤵
                                                                                    PID:2384
                                                                                  • C:\Windows\SysWOW64\tcmsetup.exe
                                                                                    "C:\Windows\System32\tcmsetup.exe"
                                                                                    5⤵
                                                                                      PID:3596
                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                      "C:\Windows\SysWOW64\cscript.exe"
                                                                                      5⤵
                                                                                        PID:2060
                                                                                      • C:\Windows\SysWOW64\chkntfs.exe
                                                                                        "C:\Windows\SysWOW64\chkntfs.exe"
                                                                                        5⤵
                                                                                          PID:832
                                                                                        • C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe
                                                                                          "C:\Windows\winsxs\x86_microsoft-windows-where_31bf3856ad364e35_6.1.7600.16385_none_5da98f433f7e2878\where.exe"
                                                                                          5⤵
                                                                                            PID:2508
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                                                                                            5⤵
                                                                                              PID:3892
                                                                                            • C:\Windows\winsxs\amd64_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_2df6395b9cf7e9a5\AdapterTroubleshooter.exe
                                                                                              "C:\Windows\winsxs\amd64_microsoft-windows-adaptertroubleshooter_31bf3856ad364e35_6.1.7600.16385_none_2df6395b9cf7e9a5\AdapterTroubleshooter.exe"
                                                                                              5⤵
                                                                                                PID:3104
                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                              4⤵
                                                                                                PID:3720
                                                                                              • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                4⤵
                                                                                                  PID:448
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe
                                                                                              XPAntivirus2008.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Adds Run key to start application
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:1176
                                                                                              • C:\Windows\SysWOW64\wscript.exe
                                                                                                wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:1708
                                                                                              • C:\Windows\SysWOW64\wscript.exe
                                                                                                wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Register Antivirus XP 2008.lnk"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:928
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /c kedj.bat "C:\Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2232
                                                                                              • C:\Program Files (x86)\rhcnklj0engs\rhcnklj0engs.exe
                                                                                                "C:\Program Files (x86)\rhcnklj0engs\rhcnklj0engs.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2916
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 252
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • Program crash
                                                                                                  PID:2060
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPro2017.exe
                                                                                              AntivirusPro2017.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              • Enumerates connected drives
                                                                                              • Writes to the Master Boot Record (MBR)
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1632
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\HappyAntivirus.exe
                                                                                              HappyAntivirus.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                              • Suspicious use of SendNotifyMessage
                                                                                              PID:2772
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPlatinum.exe
                                                                                              AntivirusPlatinum.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:1992
                                                                                              • C:\WINDOWS\302746537.exe
                                                                                                "C:\WINDOWS\302746537.exe"
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2112
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\BB82.tmp\302746537.bat" "
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2000
                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                    regsvr32 /s c:\windows\comctl32.ocx
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry class
                                                                                                    PID:2264
                                                                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                    regsvr32 /s c:\windows\mscomctl.ocx
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry class
                                                                                                    PID:1980
                                                                                                  • \??\c:\windows\antivirus-platinum.exe
                                                                                                    c:\windows\antivirus-platinum.exe
                                                                                                    5⤵
                                                                                                    • Windows security bypass
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Windows security modification
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies Internet Explorer settings
                                                                                                    • Modifies Internet Explorer start page
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • System policy modification
                                                                                                    PID:2636
                                                                                                  • C:\Windows\SysWOW64\attrib.exe
                                                                                                    attrib +h c:\windows\antivirus-platinum.exe
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Views/modifies file attributes
                                                                                                    PID:2556
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\icons.exe
                                                                                              icons.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              PID:1880
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Bonzify.exe
                                                                                              Bonzify.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:2980
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2936
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  taskkill /f /im AgentSvr.exe
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Kills process with taskkill
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1736
                                                                                                • C:\Windows\SysWOW64\takeown.exe
                                                                                                  takeown /r /d y /f C:\Windows\MsAgent
                                                                                                  4⤵
                                                                                                  • Possible privilege escalation attempt
                                                                                                  • Modifies file permissions
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:3052
                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                  icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
                                                                                                  4⤵
                                                                                                  • Possible privilege escalation attempt
                                                                                                  • Modifies file permissions
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1576
                                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                INSTALLER.exe /q
                                                                                                3⤵
                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2468
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:2216
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1528
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:940
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:536
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1968
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1660
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:2296
                                                                                                • C:\Windows\msagent\AgentSvr.exe
                                                                                                  "C:\Windows\msagent\AgentSvr.exe" /regserver
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:156
                                                                                                • C:\Windows\SysWOW64\grpconv.exe
                                                                                                  grpconv.exe -o
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1588
                                                                                              • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                                                                INSTALLER.exe /q
                                                                                                3⤵
                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Adds Run key to start application
                                                                                                • Drops file in System32 directory
                                                                                                • Drops file in Windows directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2336
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2820
                                                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                                                  regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
                                                                                                  4⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2316
                                                                                                • C:\Windows\SysWOW64\grpconv.exe
                                                                                                  grpconv.exe -o
                                                                                                  4⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:776
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Jigsaw.exe
                                                                                              Jigsaw.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              • Adds Run key to start application
                                                                                              PID:2816
                                                                                              • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                                                                "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\trash_malware\trash?malware\Jigsaw.exe
                                                                                                3⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:2148
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\gaben64.exe
                                                                                              gaben64.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2756
                                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\sweeney64.exe
                                                                                              sweeney64.exe
                                                                                              2⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2648
                                                                                          • C:\Windows\msagent\AgentSvr.exe
                                                                                            C:\Windows\msagent\AgentSvr.exe -Embedding
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            PID:2764
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            • Suspicious use of SendNotifyMessage
                                                                                            PID:1712

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Reconnaissance

                                                                                          Resource Development

                                                                                          Initial Access

                                                                                          Execution

                                                                                          Persistence

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Event Triggered Execution

                                                                                          3
                                                                                          T1546

                                                                                          Accessibility Features

                                                                                          1
                                                                                          T1546.008

                                                                                          AppInit DLLs

                                                                                          1
                                                                                          T1546.010

                                                                                          Netsh Helper DLL

                                                                                          1
                                                                                          T1546.007

                                                                                          Pre-OS Boot

                                                                                          1
                                                                                          T1542

                                                                                          Bootkit

                                                                                          1
                                                                                          T1542.003

                                                                                          Server Software Component

                                                                                          1
                                                                                          T1505

                                                                                          Terminal Services DLL

                                                                                          1
                                                                                          T1505.005

                                                                                          Privilege Escalation

                                                                                          Abuse Elevation Control Mechanism

                                                                                          1
                                                                                          T1548

                                                                                          Bypass User Account Control

                                                                                          1
                                                                                          T1548.002

                                                                                          Boot or Logon Autostart Execution

                                                                                          2
                                                                                          T1547

                                                                                          Active Setup

                                                                                          1
                                                                                          T1547.014

                                                                                          Registry Run Keys / Startup Folder

                                                                                          1
                                                                                          T1547.001

                                                                                          Event Triggered Execution

                                                                                          3
                                                                                          T1546

                                                                                          Accessibility Features

                                                                                          1
                                                                                          T1546.008

                                                                                          AppInit DLLs

                                                                                          1
                                                                                          T1546.010

                                                                                          Netsh Helper DLL

                                                                                          1
                                                                                          T1546.007

                                                                                          Defense Evasion

                                                                                          Abuse Elevation Control Mechanism

                                                                                          1
                                                                                          T1548

                                                                                          Bypass User Account Control

                                                                                          1
                                                                                          T1548.002

                                                                                          File and Directory Permissions Modification

                                                                                          1
                                                                                          T1222

                                                                                          Hide Artifacts

                                                                                          1
                                                                                          T1564

                                                                                          Hidden Files and Directories

                                                                                          1
                                                                                          T1564.001

                                                                                          Impair Defenses

                                                                                          3
                                                                                          T1562

                                                                                          Disable or Modify Tools

                                                                                          3
                                                                                          T1562.001

                                                                                          Modify Registry

                                                                                          8
                                                                                          T1112

                                                                                          Pre-OS Boot

                                                                                          1
                                                                                          T1542

                                                                                          Bootkit

                                                                                          1
                                                                                          T1542.003

                                                                                          Credential Access

                                                                                          Credentials from Password Stores

                                                                                          1
                                                                                          T1555

                                                                                          Credentials from Web Browsers

                                                                                          1
                                                                                          T1555.003

                                                                                          Unsecured Credentials

                                                                                          1
                                                                                          T1552

                                                                                          Credentials In Files

                                                                                          1
                                                                                          T1552.001

                                                                                          Discovery

                                                                                          Peripheral Device Discovery

                                                                                          2
                                                                                          T1120

                                                                                          Query Registry

                                                                                          6
                                                                                          T1012

                                                                                          System Information Discovery

                                                                                          6
                                                                                          T1082

                                                                                          System Location Discovery

                                                                                          1
                                                                                          T1614

                                                                                          System Language Discovery

                                                                                          1
                                                                                          T1614.001

                                                                                          Lateral Movement

                                                                                          Collection

                                                                                          Data from Local System

                                                                                          1
                                                                                          T1005

                                                                                          Command and Control

                                                                                          Exfiltration

                                                                                          Impact

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • C:\Program Files (x86)\rhcnklj0engs\Uninstall.exe
                                                                                            Filesize

                                                                                            75KB

                                                                                            MD5

                                                                                            373ab9f3666e444d538dab8e35d56730

                                                                                            SHA1

                                                                                            e5498ad390b38983a887e850e48c6235b4be3249

                                                                                            SHA256

                                                                                            8536a124573aee7b65d87e6d7d7bbc480a3084bef0ea75c1e82816a64817a451

                                                                                            SHA512

                                                                                            f18112b60ac9ad4b563fec2b895e82be08d776d99a613855c646e1160923c16ca377cc66f7190ce603b2e32b21832d5eb0335daa4f6057ee47cb79110db9bc07

                                                                                            Download Submit

                                                                                          • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\invalid32x32.gif.fun
                                                                                            Filesize

                                                                                            160B

                                                                                            MD5

                                                                                            580ee0344b7da2786da6a433a1e84893

                                                                                            SHA1

                                                                                            60f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e

                                                                                            SHA256

                                                                                            98b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513

                                                                                            SHA512

                                                                                            356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba

                                                                                            Download Submit

                                                                                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            b61c903c022c8d79b56ef30345a0379e

                                                                                            SHA1

                                                                                            6578ee0c693b78490af899c180d9addfe1e3f0b8

                                                                                            SHA256

                                                                                            25866f33cf4d11920dc4ad2513e036b16fa903e913b90d60946e3a8820e1e6b4

                                                                                            SHA512

                                                                                            568bfd5800df74c788f9aec912764970ef31e878a4d8ed9f174102b28c70e7126e9dfab9320e91096a051408bc6deba96bff03907c8780ebb44a7c80a52b73ef

                                                                                            Download Submit

                                                                                          • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            85377a2fef7d11ce831b061c0926da95

                                                                                            SHA1

                                                                                            d5d667816a6b21716a54fcb5671f36c7a45ca5c2

                                                                                            SHA256

                                                                                            d7079c86718f93d2af732b1e9d6631ce0223564ca4f0361086c76f44d0081a5b

                                                                                            SHA512

                                                                                            cedd44b0dad5be01b001934ab93135946f376596b7fe31aa68f038e3092bb05aa361a38b8614741aa07a3f8042934204ecb4e41cb7d00d9ddf736231ff0eea9b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Journal\Cache\msnb.dat
                                                                                            Filesize

                                                                                            2B

                                                                                            MD5

                                                                                            f3b25701fe362ec84616a93a45ce9998

                                                                                            SHA1

                                                                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                            SHA256

                                                                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                            SHA512

                                                                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp
                                                                                            Filesize

                                                                                            25KB

                                                                                            MD5

                                                                                            02a8ff77ef975446c753e23069d516b0

                                                                                            SHA1

                                                                                            b80517430f252e05cba7029e30c4384dc9807e63

                                                                                            SHA256

                                                                                            4c6e2114f4a260881d7f89eae736f8cacac89365b1dc550cf6a872726074ba51

                                                                                            SHA512

                                                                                            9c751a0bcbc85ae934769725f82484352e9f52254fed8a5d3430c857abd971a22c50d74536c62fbc60e1b29972cb90ef30975bbc5937df6396c55d8628eee65c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                            Filesize

                                                                                            15KB

                                                                                            MD5

                                                                                            96c542dec016d9ec1ecc4dddfcbaac66

                                                                                            SHA1

                                                                                            6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                            SHA256

                                                                                            7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                            SHA512

                                                                                            cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.exe
                                                                                            Filesize

                                                                                            4.1MB

                                                                                            MD5

                                                                                            c6391727ae405fb9812a8ad2a7729402

                                                                                            SHA1

                                                                                            83693dc297392c6a28f7f16d23414c6d62921711

                                                                                            SHA256

                                                                                            d98fbfca17f194400d19111e4813340e6666b254b99f833739b661a4d2d0217c

                                                                                            SHA512

                                                                                            7a4e2ff93d853415d433f5e90b36959c78b77590aa1fa00753831eb4d01cb1a972bb9e39eb8dee5b216005e7709eacda51c0c410aacfe37fcdb163603fd36570

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\taskhost.ini
                                                                                            Filesize

                                                                                            44B

                                                                                            MD5

                                                                                            dbfea325d1e00a904309a682051778ad

                                                                                            SHA1

                                                                                            525562934d0866f2ba90b3c25ea005c8c5f1e9fb

                                                                                            SHA256

                                                                                            15a3a3303b4a77272ddb04454333a4c06aa2a113f210ba4a03314026e0821e6d

                                                                                            SHA512

                                                                                            cd853c67c2b1a44c3f592ff42d207b2251e8b9bc1eb22fc12cd710329069ef75abffccd169418c4f9bd008a40f2fbbfc6904519f27fd658f316309f94b8ff59c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\BB82.tmp\302746537.bat
                                                                                            Filesize

                                                                                            348B

                                                                                            MD5

                                                                                            7d8beb22dfcfacbbc2609f88a41c1458

                                                                                            SHA1

                                                                                            52ec2b10489736b963d39a9f84b66bafbf15685f

                                                                                            SHA256

                                                                                            4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

                                                                                            SHA512

                                                                                            a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                                            Filesize

                                                                                            73KB

                                                                                            MD5

                                                                                            81e5c8596a7e4e98117f5c5143293020

                                                                                            SHA1

                                                                                            45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                                            SHA256

                                                                                            7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                                            SHA512

                                                                                            05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
                                                                                            Filesize

                                                                                            40KB

                                                                                            MD5

                                                                                            48c00a7493b28139cbf197ccc8d1f9ed

                                                                                            SHA1

                                                                                            a25243b06d4bb83f66b7cd738e79fccf9a02b33b

                                                                                            SHA256

                                                                                            905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

                                                                                            SHA512

                                                                                            c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
                                                                                            Filesize

                                                                                            160KB

                                                                                            MD5

                                                                                            237e13b95ab37d0141cf0bc585b8db94

                                                                                            SHA1

                                                                                            102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                                            SHA256

                                                                                            d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                                            SHA512

                                                                                            9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
                                                                                            Filesize

                                                                                            60KB

                                                                                            MD5

                                                                                            a334bbf5f5a19b3bdb5b7f1703363981

                                                                                            SHA1

                                                                                            6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                                            SHA256

                                                                                            c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                                            SHA512

                                                                                            1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
                                                                                            Filesize

                                                                                            64KB

                                                                                            MD5

                                                                                            7c5aefb11e797129c9e90f279fbdf71b

                                                                                            SHA1

                                                                                            cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                                            SHA256

                                                                                            394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                                            SHA512

                                                                                            df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
                                                                                            Filesize

                                                                                            60KB

                                                                                            MD5

                                                                                            4fbbaac42cf2ecb83543f262973d07c0

                                                                                            SHA1

                                                                                            ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                                            SHA256

                                                                                            6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                                            SHA512

                                                                                            4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
                                                                                            Filesize

                                                                                            36KB

                                                                                            MD5

                                                                                            b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                                            SHA1

                                                                                            d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                                            SHA256

                                                                                            8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                                            SHA512

                                                                                            2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
                                                                                            Filesize

                                                                                            60KB

                                                                                            MD5

                                                                                            9fafb9d0591f2be4c2a846f63d82d301

                                                                                            SHA1

                                                                                            1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                                            SHA256

                                                                                            e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                                            SHA512

                                                                                            ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
                                                                                            Filesize

                                                                                            268KB

                                                                                            MD5

                                                                                            5c91bf20fe3594b81052d131db798575

                                                                                            SHA1

                                                                                            eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                                            SHA256

                                                                                            e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                                            SHA512

                                                                                            face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
                                                                                            Filesize

                                                                                            28KB

                                                                                            MD5

                                                                                            0cbf0f4c9e54d12d34cd1a772ba799e1

                                                                                            SHA1

                                                                                            40e55eb54394d17d2d11ca0089b84e97c19634a7

                                                                                            SHA256

                                                                                            6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

                                                                                            SHA512

                                                                                            bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
                                                                                            Filesize

                                                                                            8KB

                                                                                            MD5

                                                                                            466d35e6a22924dd846a043bc7dd94b8

                                                                                            SHA1

                                                                                            35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

                                                                                            SHA256

                                                                                            e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

                                                                                            SHA512

                                                                                            23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            e4a499b9e1fe33991dbcfb4e926c8821

                                                                                            SHA1

                                                                                            951d4750b05ea6a63951a7667566467d01cb2d42

                                                                                            SHA256

                                                                                            49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

                                                                                            SHA512

                                                                                            a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
                                                                                            Filesize

                                                                                            28KB

                                                                                            MD5

                                                                                            f1656b80eaae5e5201dcbfbcd3523691

                                                                                            SHA1

                                                                                            6f93d71c210eb59416e31f12e4cc6a0da48de85b

                                                                                            SHA256

                                                                                            3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

                                                                                            SHA512

                                                                                            e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            b127d9187c6dbb1b948053c7c9a6811f

                                                                                            SHA1

                                                                                            b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

                                                                                            SHA256

                                                                                            bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

                                                                                            SHA512

                                                                                            88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
                                                                                            Filesize

                                                                                            52KB

                                                                                            MD5

                                                                                            316999655fef30c52c3854751c663996

                                                                                            SHA1

                                                                                            a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                                            SHA256

                                                                                            ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                                            SHA512

                                                                                            5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
                                                                                            Filesize

                                                                                            76KB

                                                                                            MD5

                                                                                            e7cd26405293ee866fefdd715fc8b5e5

                                                                                            SHA1

                                                                                            6326412d0ea86add8355c76f09dfc5e7942f9c11

                                                                                            SHA256

                                                                                            647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

                                                                                            SHA512

                                                                                            1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
                                                                                            Filesize

                                                                                            552KB

                                                                                            MD5

                                                                                            497fd4a8f5c4fcdaaac1f761a92a366a

                                                                                            SHA1

                                                                                            81617006e93f8a171b2c47581c1d67fac463dc93

                                                                                            SHA256

                                                                                            91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                                            SHA512

                                                                                            73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            7210d5407a2d2f52e851604666403024

                                                                                            SHA1

                                                                                            242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

                                                                                            SHA256

                                                                                            337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

                                                                                            SHA512

                                                                                            1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
                                                                                            Filesize

                                                                                            4KB

                                                                                            MD5

                                                                                            4be7661c89897eaa9b28dae290c3922f

                                                                                            SHA1

                                                                                            4c9d25195093fea7c139167f0c5a40e13f3000f2

                                                                                            SHA256

                                                                                            e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

                                                                                            SHA512

                                                                                            2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
                                                                                            Filesize

                                                                                            29KB

                                                                                            MD5

                                                                                            c3e8aeabd1b692a9a6c5246f8dcaa7c9

                                                                                            SHA1

                                                                                            4567ea5044a3cef9cb803210a70866d83535ed31

                                                                                            SHA256

                                                                                            38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

                                                                                            SHA512

                                                                                            f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
                                                                                            Filesize

                                                                                            1.2MB

                                                                                            MD5

                                                                                            ed98e67fa8cc190aad0757cd620e6b77

                                                                                            SHA1

                                                                                            0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                                            SHA256

                                                                                            e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                                            SHA512

                                                                                            ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
                                                                                            Filesize

                                                                                            11KB

                                                                                            MD5

                                                                                            80d09149ca264c93e7d810aac6411d1d

                                                                                            SHA1

                                                                                            96e8ddc1d257097991f9cc9aaf38c77add3d6118

                                                                                            SHA256

                                                                                            382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

                                                                                            SHA512

                                                                                            8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            0a250bb34cfa851e3dd1804251c93f25

                                                                                            SHA1

                                                                                            c10e47a593c37dbb7226f65ad490ff65d9c73a34

                                                                                            SHA256

                                                                                            85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

                                                                                            SHA512

                                                                                            8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
                                                                                            Filesize

                                                                                            40KB

                                                                                            MD5

                                                                                            1587bf2e99abeeae856f33bf98d3512e

                                                                                            SHA1

                                                                                            aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                                            SHA256

                                                                                            c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                                            SHA512

                                                                                            43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
                                                                                            Filesize

                                                                                            161B

                                                                                            MD5

                                                                                            ea7df060b402326b4305241f21f39736

                                                                                            SHA1

                                                                                            7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

                                                                                            SHA256

                                                                                            e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

                                                                                            SHA512

                                                                                            3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\gaben.ico
                                                                                            Filesize

                                                                                            193KB

                                                                                            MD5

                                                                                            e92bbd011643cdf00084042ad8e5f421

                                                                                            SHA1

                                                                                            41b60393b180e73b1b388f356730b329c099fa93

                                                                                            SHA256

                                                                                            82fe81db1c1401fce85c3a6008fbe2cc78d08107a13de6aa860c37c90a1571ec

                                                                                            SHA512

                                                                                            1cd3969b47b3894f357d29e48ce8923c8c83c5b2b3ea9e7c3f0371663473efb83524812b14e13ac0b95fdb39ce04a35b3ef7a74935bf75cf0379b87d8cef4998

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz8661.tmp\MachineKey.dll
                                                                                            Filesize

                                                                                            52KB

                                                                                            MD5

                                                                                            819265cb9b45d837914f428373b06318

                                                                                            SHA1

                                                                                            0725f84eba20acdbd702b688ea61dee84e370b0c

                                                                                            SHA256

                                                                                            dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf

                                                                                            SHA512

                                                                                            ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\nsz8661.tmp\lastpage.ini
                                                                                            Filesize

                                                                                            214B

                                                                                            MD5

                                                                                            14f51baaf9e518780594e20887e6fe36

                                                                                            SHA1

                                                                                            19f934f6a8cb11c53ae06f71457bfa643bb06576

                                                                                            SHA256

                                                                                            99cc25682aa82e36757361afdd6e0436ff56cdc03993e6d60f20d052f8b9dbe5

                                                                                            SHA512

                                                                                            d48e9a9e12a69fef2b6c324a9c2f1fb46d8eb931a4cde955f2c196c3ee78ac80dcfdb98cc17530854c3775db41de66b09b9ba498c550ac500ec40cdefe4caf81

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\pin.vbs
                                                                                            Filesize

                                                                                            287B

                                                                                            MD5

                                                                                            3f764ed6ee61afced5405a2e3f62738b

                                                                                            SHA1

                                                                                            ce56c02f451bdbf20a1003df87fc2692ca06d0ed

                                                                                            SHA256

                                                                                            22804ed36ad186b3ab18605719c83e70b6244f60aba00e16ca8f97d80b5cc0e4

                                                                                            SHA512

                                                                                            6ed1d6327b67b3c863f71ede1d8be2f24c51454aab25b104d474024bfafcd732ba84a63ea60b218ce0e97a740c2717f87f4a38fcf211e780d027d36f4bc1d859

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\tim.ico
                                                                                            Filesize

                                                                                            14KB

                                                                                            MD5

                                                                                            abd13026c90196210954972001586e30

                                                                                            SHA1

                                                                                            23092e2dd1283487614fbc40cce35201bd79eab0

                                                                                            SHA256

                                                                                            4f05b1809c23ea4c71b01771c43a60df3c48ae2d2b8b55918cf6e2f91d3d8097

                                                                                            SHA512

                                                                                            68a9e0d1b1e002de9ec38e142d7de7bc4b85f4971598faf85553ca19daa7fe51cae9496b3296855345f7a08a97515c3a2bd8e6f87cb14e338687b224fd9c22fa

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                                            Filesize

                                                                                            442KB

                                                                                            MD5

                                                                                            85430baed3398695717b0263807cf97c

                                                                                            SHA1

                                                                                            fffbee923cea216f50fce5d54219a188a5100f41

                                                                                            SHA256

                                                                                            a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                                                            SHA512

                                                                                            06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                                            Filesize

                                                                                            8.0MB

                                                                                            MD5

                                                                                            a01c5ecd6108350ae23d2cddf0e77c17

                                                                                            SHA1

                                                                                            c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                                                            SHA256

                                                                                            345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                                                            SHA512

                                                                                            b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DNTException\container.dat.fun
                                                                                            Filesize

                                                                                            16B

                                                                                            MD5

                                                                                            8ebcc5ca5ac09a09376801ecdd6f3792

                                                                                            SHA1

                                                                                            81187142b138e0245d5d0bc511f7c46c30df3e14

                                                                                            SHA256

                                                                                            619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880

                                                                                            SHA512

                                                                                            cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin
                                                                                            Filesize

                                                                                            2KB

                                                                                            MD5

                                                                                            6a7243a51599e41361f5190191b34165

                                                                                            SHA1

                                                                                            91cc73e5cfc60315f57f65cfe00ee95775e98ab3

                                                                                            SHA256

                                                                                            3ca00146fbf41d5978634cf07dfacf67949956f5037525fb2d2922278f111f0e

                                                                                            SHA512

                                                                                            c4909b35fb9bd008956f60b6b1322f243bc3efa9a112f9b95bb89627e84a07022588401340684ecc486e5dbbeb9065cb3f9f2fb7afc12b6d6b43d2a046d2ce6b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\4327bb4e-5679-4c9a-8bf9-219720e8fb7d
                                                                                            Filesize

                                                                                            12KB

                                                                                            MD5

                                                                                            c9cc85a2c891db112f07e39a8eae6951

                                                                                            SHA1

                                                                                            d4a04e17b62448e55156611a5a84599381a5820e

                                                                                            SHA256

                                                                                            816f9f6912c193a3b6dc99080f9b3995c043f716e1b556bada2c848ca25ed6c8

                                                                                            SHA512

                                                                                            9b63b0757774d9ead4b5ab19614f275d0dbd6551a723403a305c4d4c5456cd70d02ada51c85e5e49df0f92108b869cff061cf4cda1ae6a35bebb5ad30294c969

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\745d3206-224d-45a5-a2b4-4dfab389393a
                                                                                            Filesize

                                                                                            745B

                                                                                            MD5

                                                                                            1e4ccef65a73e72df93008d2a9e993ed

                                                                                            SHA1

                                                                                            c2f24a3d41563011fe315eea81e523d1e7742a2e

                                                                                            SHA256

                                                                                            f21f9ab29bce83c01baa5da1c14952a91caf9bce1f749940c6866d636d06ee1b

                                                                                            SHA512

                                                                                            760911ff56a7f128ae677982f7ea5b33a77f81512e88e9b3afe93d768d86f82b3e4deede6d9444dd06b6c60316aed3b9eea54b97896e9bb76344d1eacc58c4a9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                                                                            Filesize

                                                                                            997KB

                                                                                            MD5

                                                                                            fe3355639648c417e8307c6d051e3e37

                                                                                            SHA1

                                                                                            f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                                                            SHA256

                                                                                            1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                                                            SHA512

                                                                                            8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                                                                            Filesize

                                                                                            116B

                                                                                            MD5

                                                                                            3d33cdc0b3d281e67dd52e14435dd04f

                                                                                            SHA1

                                                                                            4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                                                            SHA256

                                                                                            f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                                                            SHA512

                                                                                            a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                                                                            Filesize

                                                                                            479B

                                                                                            MD5

                                                                                            49ddb419d96dceb9069018535fb2e2fc

                                                                                            SHA1

                                                                                            62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                                                            SHA256

                                                                                            2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                                                            SHA512

                                                                                            48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                                                                            Filesize

                                                                                            372B

                                                                                            MD5

                                                                                            8be33af717bb1b67fbd61c3f4b807e9e

                                                                                            SHA1

                                                                                            7cf17656d174d951957ff36810e874a134dd49e0

                                                                                            SHA256

                                                                                            e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                                                            SHA512

                                                                                            6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                                                                            Filesize

                                                                                            11.8MB

                                                                                            MD5

                                                                                            33bf7b0439480effb9fb212efce87b13

                                                                                            SHA1

                                                                                            cee50f2745edc6dc291887b6075ca64d716f495a

                                                                                            SHA256

                                                                                            8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                                                            SHA512

                                                                                            d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            688bed3676d2104e7f17ae1cd2c59404

                                                                                            SHA1

                                                                                            952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                                                            SHA256

                                                                                            33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                                                            SHA512

                                                                                            7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            937326fead5fd401f6cca9118bd9ade9

                                                                                            SHA1

                                                                                            4526a57d4ae14ed29b37632c72aef3c408189d91

                                                                                            SHA256

                                                                                            68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                                                            SHA512

                                                                                            b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            179207c8ea35481b9ad44e2f1d4ac5ae

                                                                                            SHA1

                                                                                            66e90b12fafd2352aa58aa79b7e1eaba6e4755d1

                                                                                            SHA256

                                                                                            aad9191a5171f67b77937efd4a55c97da6b773a87631cda02af1878580d9c595

                                                                                            SHA512

                                                                                            2d540fe0b9bc3ac1862e860847baabbd5e306c131ad450dd9aff645b8e61d2a73b40b73762f372250c0f660ae3b7c90e38dcd35b6194e71453b1df2c337b9420

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                                                                                            Filesize

                                                                                            7KB

                                                                                            MD5

                                                                                            1439549c5146c3a5fb5c4155404fb361

                                                                                            SHA1

                                                                                            0b58177f9f5a798e11a2acb01617b69a1583fbff

                                                                                            SHA256

                                                                                            9ba5db9d86279224af643f5215045268c11d8fd7ebd0f98b0112814e068d21ae

                                                                                            SHA512

                                                                                            371a2888bdd23ad7323ea3041c86a280023d9e07c6f7df99f556dee041cff08a0e25e8b3777a0edaf6dbf7ebfbf6f3ca46256459f4f82c0e67c5f921804a207a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js
                                                                                            Filesize

                                                                                            6KB

                                                                                            MD5

                                                                                            4fe3c277b44f5efcb4ba00235feca8cb

                                                                                            SHA1

                                                                                            e72a34db95f3e1498c5605624e53d5792e41196c

                                                                                            SHA256

                                                                                            191defa5aba171fa9f874f988e2995f88b5dc5b1bb240e6a257a0b4595c6b5ae

                                                                                            SHA512

                                                                                            fcd9e9073de32a47cf867db289b196c9943b9b172fd8660bf623da977aff08f5657a5a258cf09fa54f1b95597c61296b3e2f57a27bd0af2e38ca9ddeefbf46c7

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4
                                                                                            Filesize

                                                                                            1KB

                                                                                            MD5

                                                                                            25b6b36d99aa530c3592d8ec84245b46

                                                                                            SHA1

                                                                                            aae49c76da9f0916e372bd2e959d6dbf58b87eaf

                                                                                            SHA256

                                                                                            141b899340c4901458398cdfe63faa06b16f4e72521b2d8b07e348391f289e8a

                                                                                            SHA512

                                                                                            b36c6e6de441b14151ccfef7e02cfda3e47b5327009aab5b550cdc1d8ece602d77c6b04600654a150e40217ee1bc16fd13f830fa925a8275c1c2039177330a09

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore.jsonlz4
                                                                                            Filesize

                                                                                            949B

                                                                                            MD5

                                                                                            dbd4d5e00b0eff023681226cef3b19e4

                                                                                            SHA1

                                                                                            a81b8848700aacea4dc1b1c3b177bce974666f6b

                                                                                            SHA256

                                                                                            d02f11041c3793177882447fea3478dcf96c973908cb0874878a464e055041a9

                                                                                            SHA512

                                                                                            ad33edcebf290e81b6773c9969edc9961548af290b988066f6f408394ea5da2dfc1915de64e85c499c745de79e13c9cefbc8b7135819365dd0e2ba71e8573436

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                            Filesize

                                                                                            184KB

                                                                                            MD5

                                                                                            85019c88ba2b389a37b86a38168ca07b

                                                                                            SHA1

                                                                                            5a60ccab3c658adb0d2c852e05ff7da96f4df28e

                                                                                            SHA256

                                                                                            b55222d9540b127807426dcdea5429e1c2e5d764378181068068cec8919b557e

                                                                                            SHA512

                                                                                            eefcd23f32561f6a455cad832a199bfe5e8ed3741ec1c95d272be5b67eb2e7cbb71c81eccb2df0c3f99397c1e899216e2fd7cae79a9191d20fc93c8cfae4f92d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Documents\ProtectMove.xlsx.fun
                                                                                            Filesize

                                                                                            9KB

                                                                                            MD5

                                                                                            b6043f4ee24d039b6f1b0333432eb579

                                                                                            SHA1

                                                                                            1077a746b91efb16d27ad99ff56baf12ec83b8d1

                                                                                            SHA256

                                                                                            fdf33c3bb434285c83d1703c92d6dc8d2a270b862c97db93cd4db1b09f58c611

                                                                                            SHA512

                                                                                            217b28383e072476d85ef79128904ca210a340d71ba66f4f31b6ff6f0aa9fa8d31e66edbbd8f2f03a6f6f7bccefa6abff6b508633ce964c47474e02dfd21aa3d

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware.FFcNVk6V.zip.part
                                                                                            Filesize

                                                                                            63KB

                                                                                            MD5

                                                                                            939c89eae6761881af603e34e502e189

                                                                                            SHA1

                                                                                            d89d34300a26100c8dad39f833acb773cfe74dad

                                                                                            SHA256

                                                                                            c182e9352fe57d974e36e52ae2ba878b93d561db0fa8cefb703fc842a170d684

                                                                                            SHA512

                                                                                            aeb99c6e9c2b210a8f072fa6cffe9fdd6527ae61d9c740ebc065695d670a7b57f282b0724608f0f3a40961aca7b890857aaa5e3a8ac44c93397d6aef6db7c62a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware.zip
                                                                                            Filesize

                                                                                            34.7MB

                                                                                            MD5

                                                                                            b42ed53f1fef2c95d0b4c9d034278c2e

                                                                                            SHA1

                                                                                            ec5cedd2939c82688533b4db410671610575e671

                                                                                            SHA256

                                                                                            5bf0dbf99a2eac3b589013c8511413895842232dcd5e6ae608ad3524bce5c7fb

                                                                                            SHA512

                                                                                            9c105ca53533a4af09f262045619bdcf24669743fd10c7ab6c3440aaee0287d049d610b45811c7da40bf23b5a5f96ccb42d0678d845ecb661f3cbf2db313ccca

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPlatinum.exe
                                                                                            Filesize

                                                                                            739KB

                                                                                            MD5

                                                                                            382430dd7eae8945921b7feab37ed36b

                                                                                            SHA1

                                                                                            c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

                                                                                            SHA256

                                                                                            70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

                                                                                            SHA512

                                                                                            26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPro2017.exe
                                                                                            Filesize

                                                                                            816KB

                                                                                            MD5

                                                                                            7dfbfba1e4e64a946cb096bfc937fbad

                                                                                            SHA1

                                                                                            9180d2ce387314cd4a794d148ea6b14084c61e1b

                                                                                            SHA256

                                                                                            312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

                                                                                            SHA512

                                                                                            f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\AxInterop.WMPLib.dll
                                                                                            Filesize

                                                                                            52KB

                                                                                            MD5

                                                                                            c7c4f36c35198df7d2f23c217f4b89bf

                                                                                            SHA1

                                                                                            9fe2c415e97a8d836cb8b7822d94e8da58014035

                                                                                            SHA256

                                                                                            022c37312348e74e6b20a1f37ba35aa11b5621567529dc18276a855625aa23ab

                                                                                            SHA512

                                                                                            aaa72e56b57ce4a7629229ca88bdb095a18aeeeb947fb80a80a6646e01f99444399acdb49580c9c8d8d6a8757595865ae5e9b995597eebe7e70f6a625a8782de

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Blur.exe
                                                                                            Filesize

                                                                                            70KB

                                                                                            MD5

                                                                                            ab27a4504c98f0e22c266b0a377e5558

                                                                                            SHA1

                                                                                            bc33a3caa48b25d7cdff1c72bc6e5c9ef198df84

                                                                                            SHA256

                                                                                            077609aaef36278a7f2dbbc1e27cf876b7615ea9f7241730154777a36b21a9c5

                                                                                            SHA512

                                                                                            e3a5f3b824bc70b8b4957cdfc3bf53978a6fc96c787b4afd485cc685543603fb5c1bf750723bba000bcdd0441a74212c839020622f35e20e1b588b5d15c3c8c2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs
                                                                                            Filesize

                                                                                            46KB

                                                                                            MD5

                                                                                            99ec3237394257cb0b5c24affe458f48

                                                                                            SHA1

                                                                                            5300e68423da9712280e601b51622c4b567a23a4

                                                                                            SHA256

                                                                                            ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51

                                                                                            SHA512

                                                                                            af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Bonzify.exe
                                                                                            Filesize

                                                                                            6.4MB

                                                                                            MD5

                                                                                            fba93d8d029e85e0cde3759b7903cee2

                                                                                            SHA1

                                                                                            525b1aa549188f4565c75ab69e51f927204ca384

                                                                                            SHA256

                                                                                            66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764

                                                                                            SHA512

                                                                                            7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Circles.exe
                                                                                            Filesize

                                                                                            75KB

                                                                                            MD5

                                                                                            de302cdfae9ca76f4406cd38ee81f594

                                                                                            SHA1

                                                                                            3f104f87a7ef77043025e36afbc1be3aff76a565

                                                                                            SHA256

                                                                                            41702db1a096906e34dc669b5e7385b64c8c108ef7cb779279e80917eb15e4bb

                                                                                            SHA512

                                                                                            88609e5e63825383221f22a75cd2c3cd20d08a8df78c117141288e05a82aebf1a9a4db384634a9db5dc0d767610b07deedad88d08376fe58d7347c1e589f15f9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\ColorChange.exe
                                                                                            Filesize

                                                                                            71KB

                                                                                            MD5

                                                                                            1db84f940138ade841eb69f2d1b5e657

                                                                                            SHA1

                                                                                            d5d69675ee78842ba397049851617397457d8e23

                                                                                            SHA256

                                                                                            558208dc757f1fb83b56889bb1c44f8b196fbbf1c2864272be8f9106692c5e50

                                                                                            SHA512

                                                                                            9ac57ec73140532501ce4610dce128c7030ec914700687952f67839755bd986243afb32314e0e8f3b13713c4bc8cfa5444772a954088b0a82fa46750aa972520

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\FreeYoutubeDownloader.exe
                                                                                            Filesize

                                                                                            396KB

                                                                                            MD5

                                                                                            13f4b868603cf0dd6c32702d1bd858c9

                                                                                            SHA1

                                                                                            a595ab75e134f5616679be5f11deefdfaae1de15

                                                                                            SHA256

                                                                                            cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

                                                                                            SHA512

                                                                                            e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\HappyAntivirus.exe
                                                                                            Filesize

                                                                                            1.9MB

                                                                                            MD5

                                                                                            cb02c0438f3f4ddabce36f8a26b0b961

                                                                                            SHA1

                                                                                            48c4fcb17e93b74030415996c0ec5c57b830ea53

                                                                                            SHA256

                                                                                            64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

                                                                                            SHA512

                                                                                            373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\IconDance.exe
                                                                                            Filesize

                                                                                            301KB

                                                                                            MD5

                                                                                            7ad8c84dea7bd1e9cbb888734db28961

                                                                                            SHA1

                                                                                            58e047c7abecdd31d4e3c937b0ee89c98ab06c6a

                                                                                            SHA256

                                                                                            a4b6e53453d1874a6f78f0d7aa14dfafba778062f4b85b42b4c1001e1fc17095

                                                                                            SHA512

                                                                                            d34b087f7c6dd224e9bfe7a24364f878fc55c5368ce7395349ca063a7fd9ac555baed8431bfa13c331d7e58108b34e0f9d84482ce2e133f623dd086f14345adb

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Illerka.C.exe
                                                                                            Filesize

                                                                                            378KB

                                                                                            MD5

                                                                                            c718a1cbf0e13674714c66694be02421

                                                                                            SHA1

                                                                                            001d5370d3a7ee48db6caaecb1c213b5dfdf8e65

                                                                                            SHA256

                                                                                            cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f

                                                                                            SHA512

                                                                                            ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Interop.WMPLib.dll
                                                                                            Filesize

                                                                                            323KB

                                                                                            MD5

                                                                                            6515aac6d12e20b052187f256af73b96

                                                                                            SHA1

                                                                                            e91df2fad020ff5f11c28256650d7e231de67b8b

                                                                                            SHA256

                                                                                            4a36aecfb0ade38d252327f534058e3dd2e2209629631b9ad2b1c9cac86aed35

                                                                                            SHA512

                                                                                            ad49c7f734c36eea304846328485b2866d403672511f9df8d4c60038aabbecce952ff5afaf4774eda8dfd7647f0ca1839d136e74dfc16ae43bacd537b453b4b9

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Jigsaw.exe
                                                                                            Filesize

                                                                                            283KB

                                                                                            MD5

                                                                                            2773e3dc59472296cb0024ba7715a64e

                                                                                            SHA1

                                                                                            27d99fbca067f478bb91cdbcb92f13a828b00859

                                                                                            SHA256

                                                                                            3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

                                                                                            SHA512

                                                                                            6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\PixelateScreen.exe
                                                                                            Filesize

                                                                                            70KB

                                                                                            MD5

                                                                                            09470b2b44940d912f5c7a10d3a0d432

                                                                                            SHA1

                                                                                            5dbd5d9da6abec54a55efb795504109fa98e6ee5

                                                                                            SHA256

                                                                                            8b5d9d7519cdd3571571c38493cfa005886a665a8c38a52b6bb4954a50d788b3

                                                                                            SHA512

                                                                                            83d5b3e8c4387071cb4461762478a7ee988298c0d9eb2f4ab5d7ec2a8f8441b537636e900f7d1460244a507178ddaf5b9e247e2da4bc126858c3cca35ad5e964

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\RotateScreen.exe
                                                                                            Filesize

                                                                                            70KB

                                                                                            MD5

                                                                                            879df4e458fb97f2abe6f3645bb543ee

                                                                                            SHA1

                                                                                            74bc7228383a64b4a7f8f1253398c7a89632f744

                                                                                            SHA256

                                                                                            181fc0d9b1c544f17c270a17dfdf8d288a70ddb5a294e83d45595427f63dbca8

                                                                                            SHA512

                                                                                            16102a70cac5854cdfc72920944baacb55cfd9c5249601d29c0d28af746cbc1e89cb7a951c2b9410fd03ad96eeb49980978e441209c0a4f17ba000a711549c66

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe
                                                                                            Filesize

                                                                                            1.3MB

                                                                                            MD5

                                                                                            e979fb2eb504972ed87ad3c825ec6c2c

                                                                                            SHA1

                                                                                            7a927cfa6d413f66da1ae05f668ce85b3547aaf2

                                                                                            SHA256

                                                                                            9d45ae1d8d3749efbe72b24bc20142e8c55b88a0733a45e5fe8579cf24981f33

                                                                                            SHA512

                                                                                            df1b55bff5fdee03cd77d59befe5ccfef555100605f7e9782e0a90e21ad6f67c92bdf925e2844d042c9da48e1c05eb4970460683aebbec2bf5a3f9cf6341bee6

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\Zika.exe
                                                                                            Filesize

                                                                                            5.6MB

                                                                                            MD5

                                                                                            40228458ca455d28e33951a2f3844209

                                                                                            SHA1

                                                                                            86165eb8eb3e99b6efa25426508a323be0e68a44

                                                                                            SHA256

                                                                                            1a904494bb7a21512af6013fe65745e7898cdd6fadac8cb58be04e02346ed95f

                                                                                            SHA512

                                                                                            da62cc244f9924444c7cb4fdbd46017c65e6130d639f6696f7930d867017c211df8b18601bfdaaee65438cee03977848513d7f08987b9b945f3f05241f55ec39

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\gaben64.exe
                                                                                            Filesize

                                                                                            1.5MB

                                                                                            MD5

                                                                                            c75a53e3d52543b1f7f18dced4d2e7e6

                                                                                            SHA1

                                                                                            a570b105c8433333152da79d0d584cbf58fa028d

                                                                                            SHA256

                                                                                            44700e507a6d0f3da8a625affe35264963bc6ce21b4c45b1bd5f8636f73324f0

                                                                                            SHA512

                                                                                            a7bf4dac1eac425a3e7613a417fc8de7c841d8dfcc36786e08bcd384399b9ab62013f4ffa820fee3485b878ec7f1318ae406257a4bc52f0e8142112488631a6e

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\icons.exe
                                                                                            Filesize

                                                                                            105KB

                                                                                            MD5

                                                                                            3ca1d5768c2944d4284b1541653823c7

                                                                                            SHA1

                                                                                            85cf021ac23cd1340c6d649e6a77a213c1f848b6

                                                                                            SHA256

                                                                                            4172c6120f8f98685698365d6dd52c80eb2080203cdde479009bf8f4fa770af0

                                                                                            SHA512

                                                                                            7972adb329dbebc347b8a68789bbac4ba7c230cc980910d18a322d1a512015633d2a5801e76c0aae2fcfe120790c69417864549787dfc37574fb0aa3bfc202f0

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\mbrsetup.exe
                                                                                            Filesize

                                                                                            1.3MB

                                                                                            MD5

                                                                                            5075aa1815f57f9df355bc0c1ed96bac

                                                                                            SHA1

                                                                                            b56eee0afb749e2faa4da62340e0dfc1a4891348

                                                                                            SHA256

                                                                                            c69d5d57a31933f5e855f1ef0d2d451beece6d376b95eecfe2bc3140b0410857

                                                                                            SHA512

                                                                                            07a4e32ab14386d02e9297e5bc06a9a24e4accfdbf0d5a445661338472dee345de7f75b6e1de09a11e94d558a15b309280840b65afd9faf4a0ac1af1421fc8fe

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\putin.exe
                                                                                            Filesize

                                                                                            1.3MB

                                                                                            MD5

                                                                                            1181b60d1b2f613141858e09f5baed74

                                                                                            SHA1

                                                                                            c1ad5d6e20153c60310059110d2981c5551f32f5

                                                                                            SHA256

                                                                                            a54871a86ea0ab334357133661e3e5b36e8b03e91f6037639315e109499339a7

                                                                                            SHA512

                                                                                            1aec1047cd576325e2ceb62e98a1e1349e3cf2fdd2393cb22f36af253f66df426fbf94e697e43d4ddcff1d2f6be1c930c18632c4ebdb5c9f312879a451250117

                                                                                            Download Submit

                                                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\stupidy fuckity malware.bat
                                                                                            Filesize

                                                                                            719B

                                                                                            MD5

                                                                                            ee0ba5ac6286067906edfe7c8367861d

                                                                                            SHA1

                                                                                            c353a265322aba64efde0fcdcebb312eb3b796da

                                                                                            SHA256

                                                                                            e3b251dead6eaec37594847e109453da719d2f8c59b14b15632d5252b5fb5e07

                                                                                            SHA512

                                                                                            d5208a625e90acab9ca22d2471a19dee210aa8988fdb760fefb098a0108fe77abe65a860810f43fb78ecc72ef58c50b39a0b2d2100d85152c3901baf0e94295c

                                                                                            Download Submit

                                                                                          • C:\Windows\302746537.exe
                                                                                            Filesize

                                                                                            22KB

                                                                                            MD5

                                                                                            8703ff2e53c6fd3bc91294ef9204baca

                                                                                            SHA1

                                                                                            3dbb8f7f5dfe6b235486ab867a2844b1c2143733

                                                                                            SHA256

                                                                                            3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

                                                                                            SHA512

                                                                                            d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

                                                                                            Download Submit

                                                                                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                            Filesize

                                                                                            153KB

                                                                                            MD5

                                                                                            f33a4e991a11baf336a2324f700d874d

                                                                                            SHA1

                                                                                            9da1891a164f2fc0a88d0de1ba397585b455b0f4

                                                                                            SHA256

                                                                                            a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

                                                                                            SHA512

                                                                                            edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

                                                                                            Download Submit

                                                                                          • \Program Files (x86)\rhcnklj0engs\rhcnklj0engs.exe
                                                                                            Filesize

                                                                                            9.0MB

                                                                                            MD5

                                                                                            04b88c7067b53a9bdf844cd1cb4b9c30

                                                                                            SHA1

                                                                                            7d081a1053cd9ef3d593f5ef9a27303824b779f5

                                                                                            SHA256

                                                                                            d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9

                                                                                            SHA512

                                                                                            566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42

                                                                                            Download Submit

                                                                                          • \Users\Admin\AppData\Local\Temp\67ed4e642b2c4fd49a9bc8e195591454\svchost.exe
                                                                                            Filesize

                                                                                            861KB

                                                                                            MD5

                                                                                            66064dbdb70a5eb15ebf3bf65aba254b

                                                                                            SHA1

                                                                                            0284fd320f99f62aca800fb1251eff4c31ec4ed7

                                                                                            SHA256

                                                                                            6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

                                                                                            SHA512

                                                                                            b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

                                                                                            Download Submit

                                                                                          • \Users\Admin\AppData\Local\Temp\nsz8661.tmp\KillSelf.dll
                                                                                            Filesize

                                                                                            5KB

                                                                                            MD5

                                                                                            8b49e96b0bd0fe3822bd4f516ad543ab

                                                                                            SHA1

                                                                                            3d04d3a4377e2e1888cc2be333b129daa8d2894d

                                                                                            SHA256

                                                                                            c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037

                                                                                            SHA512

                                                                                            46826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26

                                                                                            Download Submit

                                                                                          • \Users\Admin\AppData\Local\Temp\nsz8661.tmp\Mutex.dll
                                                                                            Filesize

                                                                                            3KB

                                                                                            MD5

                                                                                            6899249ce2f6ede73e6fcc40fb31338a

                                                                                            SHA1

                                                                                            385e408274c8d250ccafed3fe7b329b2f3a0df13

                                                                                            SHA256

                                                                                            d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212

                                                                                            SHA512

                                                                                            0db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d

                                                                                            Download Submit

                                                                                          • \Users\Admin\Downloads\trash_malware\trash malware\sweeney64.exe
                                                                                            Filesize

                                                                                            1.2MB

                                                                                            MD5

                                                                                            983d92b95c706a99fc613e59ba5d45c4

                                                                                            SHA1

                                                                                            f4b63d88ce8ce5df0e2a8a6b1e5954188f2a45a5

                                                                                            SHA256

                                                                                            6ea7e86a7de8be07b56496385b5584d417dfeb0a7198d2766d508697327932ac

                                                                                            SHA512

                                                                                            4a53dadf6b6009ab0bb6dd382735fc2d9c5c13792d76212b9b3762fe458493061ac37d87bde877876ff20b8019aaf4bfe018edc6157c3dc5cfc7ab7f19a2f300

                                                                                            Download Submit

                                                                                          • memory/536-965-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                                            Filesize

                                                                                            4.3MB

                                                                                            Download

                                                                                          • memory/848-18413-0x0000000000C80000-0x0000000000CF4000-memory.dmp

                                                                                            Filesize

                                                                                            464KB

                                                                                            Download

                                                                                          • memory/920-768-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                            Filesize

                                                                                            320KB

                                                                                            Download

                                                                                          • memory/920-8110-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                            Filesize

                                                                                            320KB

                                                                                            Download

                                                                                          • memory/924-426-0x0000000000CC0000-0x000000000126C000-memory.dmp

                                                                                            Filesize

                                                                                            5.7MB

                                                                                            Download

                                                                                          • memory/940-1068-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                                            Filesize

                                                                                            884KB

                                                                                            Download

                                                                                          • memory/1176-690-0x0000000000840000-0x0000000000850000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1176-693-0x0000000000840000-0x0000000000850000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1176-701-0x00000000039A0000-0x0000000004312000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/1176-703-0x0000000000840000-0x0000000000850000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1176-668-0x00000000039A0000-0x0000000004312000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/1176-664-0x00000000039A0000-0x0000000004312000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/1176-683-0x0000000000830000-0x0000000000840000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1176-696-0x0000000000840000-0x0000000000850000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1632-7562-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-475-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-770-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-10133-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-11422-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-1860-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-8846-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-6281-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1632-3232-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            6.0MB

                                                                                            Download

                                                                                          • memory/1748-1416-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                                            Filesize

                                                                                            4.3MB

                                                                                            Download

                                                                                          • memory/1776-769-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                            Filesize

                                                                                            240KB

                                                                                            Download

                                                                                          • memory/1776-907-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                            Filesize

                                                                                            240KB

                                                                                            Download

                                                                                          • memory/1880-772-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                                            Filesize

                                                                                            116KB

                                                                                            Download

                                                                                          • memory/1992-1146-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/1992-1145-0x0000000000A00000-0x0000000000A06000-memory.dmp

                                                                                            Filesize

                                                                                            24KB

                                                                                            Download

                                                                                          • memory/2000-1287-0x00000000000C0000-0x00000000000CD000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                            Download

                                                                                          • memory/2000-1288-0x00000000000C0000-0x00000000000CD000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                            Download

                                                                                          • memory/2056-1254-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                                            Filesize

                                                                                            884KB

                                                                                            Download

                                                                                          • memory/2064-1346-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                                            Filesize

                                                                                            884KB

                                                                                            Download

                                                                                          • memory/2112-1147-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/2112-1303-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/2132-919-0x0000000000BF0000-0x0000000000C1E000-memory.dmp

                                                                                            Filesize

                                                                                            184KB

                                                                                            Download

                                                                                          • memory/2336-391-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/2336-389-0x00000000727DD000-0x00000000727E8000-memory.dmp

                                                                                            Filesize

                                                                                            44KB

                                                                                            Download

                                                                                          • memory/2336-388-0x000000005FFF0000-0x0000000060000000-memory.dmp

                                                                                            Filesize

                                                                                            64KB

                                                                                            Download

                                                                                          • memory/2336-392-0x00000000727DD000-0x00000000727E8000-memory.dmp

                                                                                            Filesize

                                                                                            44KB

                                                                                            Download

                                                                                          • memory/2356-1197-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                                            Filesize

                                                                                            4.3MB

                                                                                            Download

                                                                                          • memory/2468-818-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                                            Filesize

                                                                                            884KB

                                                                                            Download

                                                                                          • memory/2572-25382-0x0000000000490000-0x00000000004B0000-memory.dmp

                                                                                            Filesize

                                                                                            128KB

                                                                                            Download

                                                                                          • memory/2572-25378-0x00000000013C0000-0x00000000013CE000-memory.dmp

                                                                                            Filesize

                                                                                            56KB

                                                                                            Download

                                                                                          • memory/2636-1289-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                            Download

                                                                                          • memory/2636-2616-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                                            Filesize

                                                                                            52KB

                                                                                            Download

                                                                                          • memory/2772-474-0x00000000010E0000-0x00000000012D2000-memory.dmp

                                                                                            Filesize

                                                                                            1.9MB

                                                                                            Download

                                                                                          • memory/2816-476-0x000000001ACD0000-0x000000001AD08000-memory.dmp

                                                                                            Filesize

                                                                                            224KB

                                                                                            Download

                                                                                          • memory/2916-676-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-781-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-702-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-829-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-677-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-675-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-680-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-679-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-785-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-681-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/2916-682-0x0000000001560000-0x0000000001ED2000-memory.dmp

                                                                                            Filesize

                                                                                            9.4MB

                                                                                            Download

                                                                                          • memory/3080-20477-0x0000000001E80000-0x0000000001EC5000-memory.dmp

                                                                                            Filesize

                                                                                            276KB

                                                                                            Download

                                                                                          • memory/3080-20509-0x0000000000620000-0x000000000064E000-memory.dmp

                                                                                            Filesize

                                                                                            184KB

                                                                                            Download

                                                                                          • memory/3080-20502-0x0000000000610000-0x000000000061C000-memory.dmp

                                                                                            Filesize

                                                                                            48KB

                                                                                            Download

                                                                                          • memory/3080-20484-0x000000001AD20000-0x000000001AF9C000-memory.dmp

                                                                                            Filesize

                                                                                            2.5MB

                                                                                            Download

                                                                                          • memory/3080-20476-0x00000000005E0000-0x0000000000607000-memory.dmp

                                                                                            Filesize

                                                                                            156KB

                                                                                            Download