Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://temp.sh/ennfh...

windows10-2004-x64

10

http://temp.sh/ennfh...

windows10-ltsc 2021-x64

10

http://temp.sh/ennfh...

windows11-21h2-x64

10

http://temp.sh/ennfh...

windows7-x64

10

Analysis

  • max time kernel
    544s
  • max time network
    561s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 21:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://temp.sh/ennfh/trash_malware.zip

Score
10/10
jigsawwannacrybootkitdefense_evasiondiscoveryexecutionexploitimpactpersistenceprivilege_escalationransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Documents\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Jigsaw Ransomware

    Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.

    ransomwarejigsaw
  • Jigsaw family
    jigsaw
  • UAC bypass 3 TTPs 27 IoCs
    defense_evasiontrojan
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Windows security bypass 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Possible privilege escalation attempt 3 IoCs
    exploit
  • Drops startup file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 3 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 54 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Checks processor information in registry 2 TTPs 9 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 5 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 34 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    defense_evasion

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://temp.sh/ennfh/trash_malware.zip"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://temp.sh/ennfh/trash_malware.zip
      2⤵
      • Checks processor information in registry
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.0.407646310\1372225875" -parentBuildID 20221007134813 -prefsHandle 1208 -prefMapHandle 1200 -prefsLen 20769 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9623137e-8a2d-41e5-be3f-fcf06ea406e6} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1288 10cd8e58 gpu
        3⤵
          PID:1580
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.1.1332135792\2034360136" -parentBuildID 20221007134813 -prefsHandle 1476 -prefMapHandle 1472 -prefsLen 21630 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {187a24b6-5bc6-4613-993e-6a5b148d172d} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1488 d70158 socket
          3⤵
          • Checks processor information in registry
          PID:2852
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.2.1906878381\575221609" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 21668 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf978e19-fdfd-4b98-8c44-e714de74a091} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 2092 1a3d1658 tab
          3⤵
            PID:2356
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.3.1942411831\877844368" -childID 2 -isForBrowser -prefsHandle 2436 -prefMapHandle 2408 -prefsLen 26138 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c680510-1172-491e-8cb3-f26a6f31de3c} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 2372 1b085858 tab
            3⤵
              PID:1936
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.4.1771044412\1924715304" -childID 3 -isForBrowser -prefsHandle 3464 -prefMapHandle 3608 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9eb038a2-525f-486b-82af-635ef377a55b} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 1088 1cc3ce58 tab
              3⤵
                PID:2244
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.5.432937943\58552929" -childID 4 -isForBrowser -prefsHandle 3740 -prefMapHandle 3744 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bba5744-a27b-499c-9142-61104f9fcccf} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 3728 1cc3d158 tab
                3⤵
                  PID:396
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.6.1977305689\767234424" -childID 5 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26273 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5889e157-817a-48f2-98a7-8ca064aff5b3} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 3892 1cc3e658 tab
                  3⤵
                    PID:612
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1956.7.1432875337\1525909406" -childID 6 -isForBrowser -prefsHandle 2200 -prefMapHandle 2136 -prefsLen 26448 -prefMapSize 233414 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bf38c8c-03c5-45bb-a681-3f81897ea191} 1956 "\\.\pipe\gecko-crash-server-pipe.1956" 2092 21090e58 tab
                    3⤵
                      PID:1560
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  1⤵
                    PID:2764
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0x530
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2344
                  • C:\Program Files\7-Zip\7zG.exe
                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\trash_malware\" -spe -an -ai#7zMap20239:88:7zEvent12640
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:1904
                  • C:\Windows\system32\cmd.exe
                    cmd /c ""C:\Users\Admin\Downloads\trash_malware\trash malware\stupidy fuckity malware.bat" "
                    1⤵
                    • Loads dropped DLL
                    • Suspicious behavior: GetForegroundWindowSpam
                    PID:1108
                    • C:\Windows\system32\msg.exe
                      msg * you did a mistake...
                      2⤵
                        PID:2236
                      • C:\Users\Admin\Downloads\trash_malware\trash malware\Zika.exe
                        Zika.exe
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        • Suspicious use of AdjustPrivilegeToken
                        PID:448
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe" -extract C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1444
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.res
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2124
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe" -extract C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1268
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.res
                          3⤵
                          • Executes dropped EXE
                          PID:2840
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe" -addoverwrite C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe", "C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.res, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1312
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe" -extract C:\@[email protected], C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:808
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.rc, C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.res
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3004
                        • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe" -addoverwrite C:\@[email protected]", "C:\@[email protected], C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\icons.res, icongroup,,
                          3⤵
                          • Executes dropped EXE
                          PID:2820
                      • C:\Windows\System32\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs"
                        2⤵
                          PID:2656
                          • C:\Windows\System32\wscript.exe
                            "C:\Windows\System32\wscript.exe" "C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs" /elevated
                            3⤵
                            • Drops file in Windows directory
                            • Modifies Control Panel
                            • System policy modification
                            PID:3064
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\IconDance.exe
                          IconDance.exe
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          PID:2176
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\Illerka.C.exe
                          Illerka.C.exe
                          2⤵
                          • UAC bypass
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks whether UAC is enabled
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • System policy modification
                          PID:896
                          • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\S11M66P6S66T8PC1C61.exe
                            "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\S11M66P6S66T8PC1C61.exe"
                            3⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:1304
                          • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\O14U26L5P13Q5KX3O72.exe
                            "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\O14U26L5P13Q5KX3O72.exe"
                            3⤵
                            • UAC bypass
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • System policy modification
                            PID:324
                        • C:\Users\Admin\Downloads\trash_malware\trash malware\FreeYoutubeDownloader.exe
                          FreeYoutubeDownloader.exe
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • Drops file in Windows directory
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          PID:1312
                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                            "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:2760
                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies Control Panel
                              • Modifies data under HKEY_USERS
                              PID:2028
                              • C:\Windows\SysWOW64\wsmprovhost.exe
                                "C:\Windows\SysWOW64\wsmprovhost.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:592
                              • C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
                                "C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:2156
                              • C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\printui.exe
                                "C:\Windows\winsxs\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_6.1.7601.17514_none_3eceef6140ec9728\printui.exe"
                                5⤵
                                  PID:2072
                                • C:\Windows\SysWOW64\write.exe
                                  "C:\Windows\SysWOW64\write.exe"
                                  5⤵
                                    PID:1540
                                    • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
                                      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
                                      6⤵
                                        PID:1320
                                        • C:\Windows\splwow64.exe
                                          C:\Windows\splwow64.exe 12288
                                          7⤵
                                            PID:2064
                                          • C:\Windows\splwow64.exe
                                            C:\Windows\splwow64.exe 12288
                                            7⤵
                                              PID:1012
                                        • C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe
                                          "C:\Windows\winsxs\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_6.1.7600.16385_none_9243b833ecd918df\baaupdate.exe"
                                          5⤵
                                            PID:1400
                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe
                                      XPAntivirus2008.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Adds Run key to start application
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      PID:768
                                      • C:\Windows\SysWOW64\wscript.exe
                                        wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"
                                        3⤵
                                          PID:1728
                                        • C:\Windows\SysWOW64\wscript.exe
                                          wscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Register Antivirus XP 2008.lnk"
                                          3⤵
                                            PID:2656
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c mpfo.bat "C:\Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe"
                                            3⤵
                                              PID:1000
                                            • C:\Program Files (x86)\rhc51jj0e5aj\rhc51jj0e5aj.exe
                                              "C:\Program Files (x86)\rhc51jj0e5aj\rhc51jj0e5aj.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:2092
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 252
                                                4⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:316
                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPro2017.exe
                                            AntivirusPro2017.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • Writes to the Master Boot Record (MBR)
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3056
                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\HappyAntivirus.exe
                                            HappyAntivirus.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:2556
                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPlatinum.exe
                                            AntivirusPlatinum.exe
                                            2⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            PID:1240
                                            • C:\WINDOWS\302746537.exe
                                              "C:\WINDOWS\302746537.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              PID:1800
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\D549.tmp\302746537.bat" "
                                                4⤵
                                                  PID:2060
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s c:\windows\comctl32.ocx
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:1304
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s c:\windows\mscomctl.ocx
                                                    5⤵
                                                    • Modifies registry class
                                                    PID:2028
                                                  • \??\c:\windows\antivirus-platinum.exe
                                                    c:\windows\antivirus-platinum.exe
                                                    5⤵
                                                    • Windows security bypass
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Windows security modification
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies Internet Explorer settings
                                                    • Modifies Internet Explorer start page
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:2460
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +h c:\windows\antivirus-platinum.exe
                                                    5⤵
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:1948
                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\icons.exe
                                              icons.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                              PID:2084
                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Bonzify.exe
                                              Bonzify.exe
                                              2⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Drops file in Windows directory
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                              PID:3036
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
                                                3⤵
                                                  PID:2920
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im AgentSvr.exe
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2892
                                                  • C:\Windows\SysWOW64\takeown.exe
                                                    takeown /r /d y /f C:\Windows\MsAgent
                                                    4⤵
                                                    • Possible privilege escalation attempt
                                                    • Modifies file permissions
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1668
                                                  • C:\Windows\SysWOW64\icacls.exe
                                                    icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
                                                    4⤵
                                                    • Possible privilege escalation attempt
                                                    • Modifies file permissions
                                                    PID:2064
                                                • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                  INSTALLER.exe /q
                                                  3⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in Windows directory
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2572
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    • Modifies registry class
                                                    PID:1904
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    PID:2088
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    PID:1196
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:868
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2552
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    PID:1576
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
                                                    4⤵
                                                    • Loads dropped DLL
                                                    PID:2068
                                                  • C:\Windows\msagent\AgentSvr.exe
                                                    "C:\Windows\msagent\AgentSvr.exe" /regserver
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:1732
                                                  • C:\Windows\SysWOW64\grpconv.exe
                                                    grpconv.exe -o
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1248
                                                • C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
                                                  INSTALLER.exe /q
                                                  3⤵
                                                  • Boot or Logon Autostart Execution: Active Setup
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Drops file in System32 directory
                                                  • Drops file in Windows directory
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2224
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2780
                                                  • C:\Windows\SysWOW64\regsvr32.exe
                                                    regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3020
                                                  • C:\Windows\SysWOW64\grpconv.exe
                                                    grpconv.exe -o
                                                    4⤵
                                                      PID:2552
                                                • C:\Users\Admin\Downloads\trash_malware\trash malware\Jigsaw.exe
                                                  Jigsaw.exe
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  PID:1452
                                                  • C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe
                                                    "C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\trash_malware\trash?malware\Jigsaw.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:912
                                                • C:\Users\Admin\Downloads\trash_malware\trash malware\WannaCrypt0r.exe
                                                  WannaCrypt0r
                                                  2⤵
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Sets desktop wallpaper using registry
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                  PID:2468
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +h .
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:2140
                                                  • C:\Windows\SysWOW64\icacls.exe
                                                    icacls . /grant Everyone:F /T /C /Q
                                                    3⤵
                                                    • Possible privilege escalation attempt
                                                    • Modifies file permissions
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2536
                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                    taskdl.exe
                                                    3⤵
                                                    • Executes dropped EXE
                                                    PID:1952
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /c 249661741295894.bat
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2464
                                                    • C:\Windows\SysWOW64\cscript.exe
                                                      cscript.exe //nologo m.vbs
                                                      4⤵
                                                      • Loads dropped DLL
                                                      PID:2856
                                                  • C:\Windows\SysWOW64\attrib.exe
                                                    attrib +h +s F:\$RECYCLE
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Views/modifies file attributes
                                                    PID:828
                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                    @[email protected] co
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies system certificate store
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2940
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c start /b @[email protected] vs
                                                    3⤵
                                                    • Loads dropped DLL
                                                    PID:2788
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      @[email protected] vs
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1152
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1200
                                                        • C:\Windows\SysWOW64\vssadmin.exe
                                                          vssadmin delete shadows /all /quiet
                                                          6⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Interacts with shadow copies
                                                          PID:1740
                                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                          wmic shadowcopy delete
                                                          6⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2348
                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                    taskdl.exe
                                                    3⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • System policy modification
                                                    PID:936
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\K80N56J1M43T1TP8G51.exe
                                                      "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\K80N56J1M43T1TP8G51.exe"
                                                      4⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System policy modification
                                                      PID:2488
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\U13T58D2E30D7AZ6H07.exe
                                                      "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\U13T58D2E30D7AZ6H07.exe"
                                                      4⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:2156
                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                    taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                    3⤵
                                                    • UAC bypass
                                                    • Executes dropped EXE
                                                    • Checks whether UAC is enabled
                                                    • System policy modification
                                                    PID:2436
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\C37A87Y4F40I1JW5Z85.exe
                                                      "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\C37A87Y4F40I1JW5Z85.exe"
                                                      4⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:936
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\V23R18X5W24F7YM3U36.exe
                                                      "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\V23R18X5W24F7YM3U36.exe"
                                                      4⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System policy modification
                                                      PID:2380
                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                    @[email protected]
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Sets desktop wallpaper using registry
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1584
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lxejlrdtqen920" /t REG_SZ /d "\"C:\Users\Admin\Downloads\trash_malware\trash malware\tasksche.exe\"" /f
                                                    3⤵
                                                      PID:716
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lxejlrdtqen920" /t REG_SZ /d "\"C:\Users\Admin\Downloads\trash_malware\trash malware\tasksche.exe\"" /f
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry key
                                                        PID:2908
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                      taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:2104
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\R31S01Y5U56Q0MI2J10.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\R31S01Y5U56Q0MI2J10.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1448
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\W47I82V1P04V2PA6K37.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\W47I82V1P04V2PA6K37.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System policy modification
                                                        PID:1828
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      @[email protected]
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1716
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                      taskdl.exe
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:2040
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\E00V61G7W08G2ZT0Q83.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\E00V61G7W08G2ZT0Q83.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1276
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\J16L62D3S46L5DL3R11.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\J16L62D3S46L5DL3R11.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1772
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                      taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:1212
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\W52B34B2Q01J7IB3O00.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\W52B34B2Q01J7IB3O00.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1588
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\G75H25V3I77U3OM1P46.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\G75H25V3I77U3OM1P46.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:2464
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                      taskdl.exe
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:284
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\W64G07Q3V18O6YW0W88.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\W64G07Q3V18O6YW0W88.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:2740
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\B71W07N8R46T0CO4X17.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\B71W07N8R46T0CO4X17.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:2064
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                      taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:2352
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\Z34B03E1K40Q0OS6K15.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\Z34B03E1K40Q0OS6K15.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1380
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\X75N43K7E64V2IV0W12.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\X75N43K7E64V2IV0W12.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:612
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      @[email protected]
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:112
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                      taskdl.exe
                                                      3⤵
                                                      • UAC bypass
                                                      • Executes dropped EXE
                                                      • Checks whether UAC is enabled
                                                      • System Location Discovery: System Language Discovery
                                                      • System policy modification
                                                      PID:1732
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\S84R47C8A47L0SH6Y68.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\S84R47C8A47L0SH6Y68.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1404
                                                      • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\X01H48Z4W86R3WZ0Z87.exe
                                                        "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\X01H48Z4W86R3WZ0Z87.exe"
                                                        4⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • System Location Discovery: System Language Discovery
                                                        • System policy modification
                                                        PID:1440
                                                    • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                      taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                      3⤵
                                                        PID:1868
                                                        • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\X86G43B3A47L5ZZ2S11.exe
                                                          "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\X86G43B3A47L5ZZ2S11.exe"
                                                          4⤵
                                                            PID:2816
                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\Q72X64Z4R22I2OP8N42.exe
                                                            "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\Q72X64Z4R22I2OP8N42.exe"
                                                            4⤵
                                                              PID:1468
                                                          • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                            taskdl.exe
                                                            3⤵
                                                              PID:2396
                                                              • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\K07N07R8K40E0JA7Z20.exe
                                                                "C:\Users\Admin\Downloads\trash_malware\trash malware\msg\K07N07R8K40E0JA7Z20.exe"
                                                                4⤵
                                                                  PID:2884
                                                                • C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\R61E40R6W50T8KN8N64.exe
                                                                  "C:\Users\Admin\Downloads\trash_malware\trash malware\TaskData\R61E40R6W50T8KN8N64.exe"
                                                                  4⤵
                                                                    PID:3032
                                                                • C:\Users\Admin\Downloads\trash_malware\trash malware\taskse.exe
                                                                  taskse.exe C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                                  3⤵
                                                                    PID:112
                                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\taskdl.exe
                                                                    taskdl.exe
                                                                    3⤵
                                                                      PID:1836
                                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\gaben64.exe
                                                                    gaben64.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:2112
                                                                  • C:\Users\Admin\Downloads\trash_malware\trash malware\sweeney64.exe
                                                                    sweeney64.exe
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:1264
                                                                • C:\Windows\system32\vssvc.exe
                                                                  C:\Windows\system32\vssvc.exe
                                                                  1⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1628
                                                                • C:\Windows\system32\DllHost.exe
                                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                  1⤵
                                                                    PID:2380
                                                                  • C:\Windows\msagent\AgentSvr.exe
                                                                    C:\Windows\msagent\AgentSvr.exe -Embedding
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:2640
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                    • Drops file in Windows directory
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    • Suspicious use of SendNotifyMessage
                                                                    PID:1952
                                                                  • C:\Windows\system32\DllHost.exe
                                                                    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                                    1⤵
                                                                      PID:2552
                                                                    • C:\Windows\system32\LogonUI.exe
                                                                      "LogonUI.exe" /flags:0x0
                                                                      1⤵
                                                                        PID:2872
                                                                      • C:\Windows\system32\csrss.exe
                                                                        %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
                                                                        1⤵
                                                                          PID:2800
                                                                        • C:\Windows\system32\winlogon.exe
                                                                          winlogon.exe
                                                                          1⤵
                                                                            PID:1688
                                                                            • C:\Windows\system32\LogonUI.exe
                                                                              "LogonUI.exe" /flags:0x0
                                                                              2⤵
                                                                                PID:1740

                                                                            Network

                                                                            MITRE ATT&CK Enterprise v15

                                                                            Reconnaissance

                                                                            Resource Development

                                                                            Initial Access

                                                                            Execution

                                                                            Windows Management Instrumentation

                                                                            1
                                                                            T1047

                                                                            Persistence

                                                                            Boot or Logon Autostart Execution

                                                                            2
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            AppInit DLLs

                                                                            1
                                                                            T1546.010

                                                                            Pre-OS Boot

                                                                            1
                                                                            T1542

                                                                            Bootkit

                                                                            1
                                                                            T1542.003

                                                                            Privilege Escalation

                                                                            Abuse Elevation Control Mechanism

                                                                            1
                                                                            T1548

                                                                            Bypass User Account Control

                                                                            1
                                                                            T1548.002

                                                                            Boot or Logon Autostart Execution

                                                                            2
                                                                            T1547

                                                                            Active Setup

                                                                            1
                                                                            T1547.014

                                                                            Registry Run Keys / Startup Folder

                                                                            1
                                                                            T1547.001

                                                                            Event Triggered Execution

                                                                            1
                                                                            T1546

                                                                            AppInit DLLs

                                                                            1
                                                                            T1546.010

                                                                            Defense Evasion

                                                                            Abuse Elevation Control Mechanism

                                                                            1
                                                                            T1548

                                                                            Bypass User Account Control

                                                                            1
                                                                            T1548.002

                                                                            Direct Volume Access

                                                                            1
                                                                            T1006

                                                                            File and Directory Permissions Modification

                                                                            2
                                                                            T1222

                                                                            Windows File and Directory Permissions Modification

                                                                            1
                                                                            T1222.001

                                                                            Hide Artifacts

                                                                            1
                                                                            T1564

                                                                            Hidden Files and Directories

                                                                            1
                                                                            T1564.001

                                                                            Impair Defenses

                                                                            3
                                                                            T1562

                                                                            Disable or Modify Tools

                                                                            3
                                                                            T1562.001

                                                                            Indicator Removal

                                                                            2
                                                                            T1070

                                                                            File Deletion

                                                                            2
                                                                            T1070.004

                                                                            Modify Registry

                                                                            11
                                                                            T1112

                                                                            Pre-OS Boot

                                                                            1
                                                                            T1542

                                                                            Bootkit

                                                                            1
                                                                            T1542.003

                                                                            Subvert Trust Controls

                                                                            1
                                                                            T1553

                                                                            Install Root Certificate

                                                                            1
                                                                            T1553.004

                                                                            Credential Access

                                                                            Credentials from Password Stores

                                                                            1
                                                                            T1555

                                                                            Credentials from Web Browsers

                                                                            1
                                                                            T1555.003

                                                                            Unsecured Credentials

                                                                            1
                                                                            T1552

                                                                            Credentials In Files

                                                                            1
                                                                            T1552.001

                                                                            Discovery

                                                                            Peripheral Device Discovery

                                                                            1
                                                                            T1120

                                                                            Query Registry

                                                                            4
                                                                            T1012

                                                                            System Information Discovery

                                                                            4
                                                                            T1082

                                                                            System Location Discovery

                                                                            1
                                                                            T1614

                                                                            System Language Discovery

                                                                            1
                                                                            T1614.001

                                                                            Lateral Movement

                                                                            Collection

                                                                            Data from Local System

                                                                            1
                                                                            T1005

                                                                            Command and Control

                                                                            Exfiltration

                                                                            Impact

                                                                            Defacement

                                                                            1
                                                                            T1491

                                                                            Inhibit System Recovery

                                                                            2
                                                                            T1490

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                                                                              Filesize

                                                                              6.0MB

                                                                              MD5

                                                                              626c26ac3aab9fc9487c85763a458cc2

                                                                              SHA1

                                                                              a77d3f13eef3ba4efb1c81efa03887fa075a7d44

                                                                              SHA256

                                                                              15c62ddf6e6e4898c720af7f5dafec87e6b90a89c533d15972178a11153f4a55

                                                                              SHA512

                                                                              dd29c7c6e91519038a0ad80f3a1bb43672ec36d0641efae0f82a5d2c3401b1e0d22ec4d0d4d727f736b18fa12a4e93e713a3dde7bf0d13c5d0df6ff853d20804

                                                                              Download Submit

                                                                            • C:\Program Files (x86)\rhc51jj0e5aj\Uninstall.exe
                                                                              Filesize

                                                                              75KB

                                                                              MD5

                                                                              373ab9f3666e444d538dab8e35d56730

                                                                              SHA1

                                                                              e5498ad390b38983a887e850e48c6235b4be3249

                                                                              SHA256

                                                                              8536a124573aee7b65d87e6d7d7bbc480a3084bef0ea75c1e82816a64817a451

                                                                              SHA512

                                                                              f18112b60ac9ad4b563fec2b895e82be08d776d99a613855c646e1160923c16ca377cc66f7190ce603b2e32b21832d5eb0335daa4f6057ee47cb79110db9bc07

                                                                              Download Submit

                                                                            • C:\Program Files (x86)\rhc51jj0e5aj\rhc51jj0e5aj.exe
                                                                              Filesize

                                                                              9.0MB

                                                                              MD5

                                                                              04b88c7067b53a9bdf844cd1cb4b9c30

                                                                              SHA1

                                                                              7d081a1053cd9ef3d593f5ef9a27303824b779f5

                                                                              SHA256

                                                                              d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9

                                                                              SHA512

                                                                              566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp
                                                                              Filesize

                                                                              25KB

                                                                              MD5

                                                                              2d50d1ad403bfeb3b5cc8822d5158e20

                                                                              SHA1

                                                                              351f1f459b98df13a79223da4b532e9545e9985f

                                                                              SHA256

                                                                              a32486d8a295f38e506d4b78705d09b93547b42ff68ff2a72e175943ee4020a3

                                                                              SHA512

                                                                              d2d5e6575615a429c163779c2d9dabde326918388ff2f67a9358be044fe613e9b1e4a14e2bb875454ce3743e66dc56892df9b921d51d68871e60e93a33304de9

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\cache2\doomed\10252
                                                                              Filesize

                                                                              13KB

                                                                              MD5

                                                                              42fa555763ec00439fff855c5e797093

                                                                              SHA1

                                                                              272fd17b18ae3b4455c6ec91421276721b415810

                                                                              SHA256

                                                                              e37fd1f04155c7e5e14485f2484bbb19502585288de53cc71e1198eb5a6fb249

                                                                              SHA512

                                                                              b8b3fb26b7a877642ffb8bba576bc093fffcb216374fbf0fc3031fa98c700d0d0e846302cbd8c600df4a7b50549736b2f2e25f82b3994edcc4c6da4beb75e89f

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                              Filesize

                                                                              15KB

                                                                              MD5

                                                                              96c542dec016d9ec1ecc4dddfcbaac66

                                                                              SHA1

                                                                              6199f7648bb744efa58acf7b96fee85d938389e4

                                                                              SHA256

                                                                              7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                              SHA512

                                                                              cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\D549.tmp\302746537.bat
                                                                              Filesize

                                                                              348B

                                                                              MD5

                                                                              7d8beb22dfcfacbbc2609f88a41c1458

                                                                              SHA1

                                                                              52ec2b10489736b963d39a9f84b66bafbf15685f

                                                                              SHA256

                                                                              4aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2

                                                                              SHA512

                                                                              a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
                                                                              Filesize

                                                                              73KB

                                                                              MD5

                                                                              81e5c8596a7e4e98117f5c5143293020

                                                                              SHA1

                                                                              45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

                                                                              SHA256

                                                                              7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

                                                                              SHA512

                                                                              05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
                                                                              Filesize

                                                                              40KB

                                                                              MD5

                                                                              48c00a7493b28139cbf197ccc8d1f9ed

                                                                              SHA1

                                                                              a25243b06d4bb83f66b7cd738e79fccf9a02b33b

                                                                              SHA256

                                                                              905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

                                                                              SHA512

                                                                              c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL
                                                                              Filesize

                                                                              160KB

                                                                              MD5

                                                                              237e13b95ab37d0141cf0bc585b8db94

                                                                              SHA1

                                                                              102c6164c21de1f3e0b7d487dd5dc4c5249e0994

                                                                              SHA256

                                                                              d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

                                                                              SHA512

                                                                              9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
                                                                              Filesize

                                                                              60KB

                                                                              MD5

                                                                              a334bbf5f5a19b3bdb5b7f1703363981

                                                                              SHA1

                                                                              6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

                                                                              SHA256

                                                                              c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

                                                                              SHA512

                                                                              1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
                                                                              Filesize

                                                                              64KB

                                                                              MD5

                                                                              7c5aefb11e797129c9e90f279fbdf71b

                                                                              SHA1

                                                                              cb9d9cbfbebb5aed6810a4e424a295c27520576e

                                                                              SHA256

                                                                              394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

                                                                              SHA512

                                                                              df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
                                                                              Filesize

                                                                              60KB

                                                                              MD5

                                                                              4fbbaac42cf2ecb83543f262973d07c0

                                                                              SHA1

                                                                              ab1b302d7cce10443dfc14a2eba528a0431e1718

                                                                              SHA256

                                                                              6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

                                                                              SHA512

                                                                              4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              b4ac608ebf5a8fdefa2d635e83b7c0e8

                                                                              SHA1

                                                                              d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

                                                                              SHA256

                                                                              8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

                                                                              SHA512

                                                                              2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
                                                                              Filesize

                                                                              60KB

                                                                              MD5

                                                                              9fafb9d0591f2be4c2a846f63d82d301

                                                                              SHA1

                                                                              1df97aa4f3722b6695eac457e207a76a6b7457be

                                                                              SHA256

                                                                              e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

                                                                              SHA512

                                                                              ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
                                                                              Filesize

                                                                              268KB

                                                                              MD5

                                                                              5c91bf20fe3594b81052d131db798575

                                                                              SHA1

                                                                              eab3a7a678528b5b2c60d65b61e475f1b2f45baa

                                                                              SHA256

                                                                              e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

                                                                              SHA512

                                                                              face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
                                                                              Filesize

                                                                              28KB

                                                                              MD5

                                                                              0cbf0f4c9e54d12d34cd1a772ba799e1

                                                                              SHA1

                                                                              40e55eb54394d17d2d11ca0089b84e97c19634a7

                                                                              SHA256

                                                                              6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

                                                                              SHA512

                                                                              bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              466d35e6a22924dd846a043bc7dd94b8

                                                                              SHA1

                                                                              35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

                                                                              SHA256

                                                                              e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

                                                                              SHA512

                                                                              23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              e4a499b9e1fe33991dbcfb4e926c8821

                                                                              SHA1

                                                                              951d4750b05ea6a63951a7667566467d01cb2d42

                                                                              SHA256

                                                                              49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

                                                                              SHA512

                                                                              a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
                                                                              Filesize

                                                                              28KB

                                                                              MD5

                                                                              f1656b80eaae5e5201dcbfbcd3523691

                                                                              SHA1

                                                                              6f93d71c210eb59416e31f12e4cc6a0da48de85b

                                                                              SHA256

                                                                              3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

                                                                              SHA512

                                                                              e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              b127d9187c6dbb1b948053c7c9a6811f

                                                                              SHA1

                                                                              b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

                                                                              SHA256

                                                                              bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

                                                                              SHA512

                                                                              88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
                                                                              Filesize

                                                                              52KB

                                                                              MD5

                                                                              316999655fef30c52c3854751c663996

                                                                              SHA1

                                                                              a7862202c3b075bdeb91c5e04fe5ff71907dae59

                                                                              SHA256

                                                                              ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

                                                                              SHA512

                                                                              5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
                                                                              Filesize

                                                                              76KB

                                                                              MD5

                                                                              e7cd26405293ee866fefdd715fc8b5e5

                                                                              SHA1

                                                                              6326412d0ea86add8355c76f09dfc5e7942f9c11

                                                                              SHA256

                                                                              647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

                                                                              SHA512

                                                                              1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
                                                                              Filesize

                                                                              552KB

                                                                              MD5

                                                                              497fd4a8f5c4fcdaaac1f761a92a366a

                                                                              SHA1

                                                                              81617006e93f8a171b2c47581c1d67fac463dc93

                                                                              SHA256

                                                                              91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

                                                                              SHA512

                                                                              73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              7210d5407a2d2f52e851604666403024

                                                                              SHA1

                                                                              242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

                                                                              SHA256

                                                                              337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

                                                                              SHA512

                                                                              1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              4be7661c89897eaa9b28dae290c3922f

                                                                              SHA1

                                                                              4c9d25195093fea7c139167f0c5a40e13f3000f2

                                                                              SHA256

                                                                              e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

                                                                              SHA512

                                                                              2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
                                                                              Filesize

                                                                              29KB

                                                                              MD5

                                                                              c3e8aeabd1b692a9a6c5246f8dcaa7c9

                                                                              SHA1

                                                                              4567ea5044a3cef9cb803210a70866d83535ed31

                                                                              SHA256

                                                                              38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

                                                                              SHA512

                                                                              f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
                                                                              Filesize

                                                                              1.2MB

                                                                              MD5

                                                                              ed98e67fa8cc190aad0757cd620e6b77

                                                                              SHA1

                                                                              0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

                                                                              SHA256

                                                                              e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

                                                                              SHA512

                                                                              ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
                                                                              Filesize

                                                                              11KB

                                                                              MD5

                                                                              80d09149ca264c93e7d810aac6411d1d

                                                                              SHA1

                                                                              96e8ddc1d257097991f9cc9aaf38c77add3d6118

                                                                              SHA256

                                                                              382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

                                                                              SHA512

                                                                              8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              0a250bb34cfa851e3dd1804251c93f25

                                                                              SHA1

                                                                              c10e47a593c37dbb7226f65ad490ff65d9c73a34

                                                                              SHA256

                                                                              85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

                                                                              SHA512

                                                                              8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
                                                                              Filesize

                                                                              40KB

                                                                              MD5

                                                                              1587bf2e99abeeae856f33bf98d3512e

                                                                              SHA1

                                                                              aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

                                                                              SHA256

                                                                              c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

                                                                              SHA512

                                                                              43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
                                                                              Filesize

                                                                              161B

                                                                              MD5

                                                                              ea7df060b402326b4305241f21f39736

                                                                              SHA1

                                                                              7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

                                                                              SHA256

                                                                              e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

                                                                              SHA512

                                                                              3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.exe
                                                                              Filesize

                                                                              4.1MB

                                                                              MD5

                                                                              c6391727ae405fb9812a8ad2a7729402

                                                                              SHA1

                                                                              83693dc297392c6a28f7f16d23414c6d62921711

                                                                              SHA256

                                                                              d98fbfca17f194400d19111e4813340e6666b254b99f833739b661a4d2d0217c

                                                                              SHA512

                                                                              7a4e2ff93d853415d433f5e90b36959c78b77590aa1fa00753831eb4d01cb1a972bb9e39eb8dee5b216005e7709eacda51c0c410aacfe37fcdb163603fd36570

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\taskhost.ini
                                                                              Filesize

                                                                              44B

                                                                              MD5

                                                                              dbfea325d1e00a904309a682051778ad

                                                                              SHA1

                                                                              525562934d0866f2ba90b3c25ea005c8c5f1e9fb

                                                                              SHA256

                                                                              15a3a3303b4a77272ddb04454333a4c06aa2a113f210ba4a03314026e0821e6d

                                                                              SHA512

                                                                              cd853c67c2b1a44c3f592ff42d207b2251e8b9bc1eb22fc12cd710329069ef75abffccd169418c4f9bd008a40f2fbbfc6904519f27fd658f316309f94b8ff59c

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\gaben.ico
                                                                              Filesize

                                                                              193KB

                                                                              MD5

                                                                              e92bbd011643cdf00084042ad8e5f421

                                                                              SHA1

                                                                              41b60393b180e73b1b388f356730b329c099fa93

                                                                              SHA256

                                                                              82fe81db1c1401fce85c3a6008fbe2cc78d08107a13de6aa860c37c90a1571ec

                                                                              SHA512

                                                                              1cd3969b47b3894f357d29e48ce8923c8c83c5b2b3ea9e7c3f0371663473efb83524812b14e13ac0b95fdb39ce04a35b3ef7a74935bf75cf0379b87d8cef4998

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\nslC8CD.tmp\KillSelf.dll
                                                                              Filesize

                                                                              5KB

                                                                              MD5

                                                                              8b49e96b0bd0fe3822bd4f516ad543ab

                                                                              SHA1

                                                                              3d04d3a4377e2e1888cc2be333b129daa8d2894d

                                                                              SHA256

                                                                              c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037

                                                                              SHA512

                                                                              46826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\nslC8CD.tmp\MachineKey.dll
                                                                              Filesize

                                                                              52KB

                                                                              MD5

                                                                              819265cb9b45d837914f428373b06318

                                                                              SHA1

                                                                              0725f84eba20acdbd702b688ea61dee84e370b0c

                                                                              SHA256

                                                                              dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf

                                                                              SHA512

                                                                              ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\nslC8CD.tmp\Mutex.dll
                                                                              Filesize

                                                                              3KB

                                                                              MD5

                                                                              6899249ce2f6ede73e6fcc40fb31338a

                                                                              SHA1

                                                                              385e408274c8d250ccafed3fe7b329b2f3a0df13

                                                                              SHA256

                                                                              d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212

                                                                              SHA512

                                                                              0db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\nslC8CD.tmp\lastpage.ini
                                                                              Filesize

                                                                              214B

                                                                              MD5

                                                                              14f51baaf9e518780594e20887e6fe36

                                                                              SHA1

                                                                              19f934f6a8cb11c53ae06f71457bfa643bb06576

                                                                              SHA256

                                                                              99cc25682aa82e36757361afdd6e0436ff56cdc03993e6d60f20d052f8b9dbe5

                                                                              SHA512

                                                                              d48e9a9e12a69fef2b6c324a9c2f1fb46d8eb931a4cde955f2c196c3ee78ac80dcfdb98cc17530854c3775db41de66b09b9ba498c550ac500ec40cdefe4caf81

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tim.ico
                                                                              Filesize

                                                                              14KB

                                                                              MD5

                                                                              abd13026c90196210954972001586e30

                                                                              SHA1

                                                                              23092e2dd1283487614fbc40cce35201bd79eab0

                                                                              SHA256

                                                                              4f05b1809c23ea4c71b01771c43a60df3c48ae2d2b8b55918cf6e2f91d3d8097

                                                                              SHA512

                                                                              68a9e0d1b1e002de9ec38e142d7de7bc4b85f4971598faf85553ca19daa7fe51cae9496b3296855345f7a08a97515c3a2bd8e6f87cb14e338687b224fd9c22fa

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                                                              Filesize

                                                                              442KB

                                                                              MD5

                                                                              85430baed3398695717b0263807cf97c

                                                                              SHA1

                                                                              fffbee923cea216f50fce5d54219a188a5100f41

                                                                              SHA256

                                                                              a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                                              SHA512

                                                                              06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                                                              Filesize

                                                                              8.0MB

                                                                              MD5

                                                                              a01c5ecd6108350ae23d2cddf0e77c17

                                                                              SHA1

                                                                              c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                                              SHA256

                                                                              345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                                              SHA512

                                                                              b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              a954d84c471bf52c88bc303fe1c85dfb

                                                                              SHA1

                                                                              3fd3994df87eaa3a4449bc6d5463df9932fc198f

                                                                              SHA256

                                                                              4b99bbc7a88ee3ff71efa17ad8afe7d452e4a50797bf36b5b719a84eba36c447

                                                                              SHA512

                                                                              d9d949bcd471fb9a3e40997ac529770833c893fb25256c9a71b78364e25c1fe4a6eedc7edf24f1d0cba409a4ebdf2d50b43e4e4595219213ebc5ba8142216b53

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\bookmarkbackups\bookmarks-2025-03-06_11_7Rf7HncBl+3VdROYNL8qAw==.jsonlz4
                                                                              Filesize

                                                                              943B

                                                                              MD5

                                                                              eee6961e0cda219c540ede84dbf62c68

                                                                              SHA1

                                                                              b95a56fb33b8eefec54591d4ea6cd12c092ebbbd

                                                                              SHA256

                                                                              79008b1590fb7a23e0de7d9d4d02723dd44133a22976ca2598b7eae2324883aa

                                                                              SHA512

                                                                              1ef572548ac7836ceb36ab8853cd909651008150c2feda277169530dbe585843d80d28b5fe5966059ad5fc78e74d68b381153bacd537a71ad4be2f02974d3850

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\broadcast-listeners.json
                                                                              Filesize

                                                                              204B

                                                                              MD5

                                                                              72c95709e1a3b27919e13d28bbe8e8a2

                                                                              SHA1

                                                                              00892decbee63d627057730bfc0c6a4f13099ee4

                                                                              SHA256

                                                                              9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

                                                                              SHA512

                                                                              613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              2c98ae5ec8bfc8ed359d74c14307f6f3

                                                                              SHA1

                                                                              3982b13a7ac9e0d90d811b7b8b055a40bd74b406

                                                                              SHA256

                                                                              fc518bb3b23fc53028dac3ae5bf3d7a9aaf7b4fca7ec377ea64b1895b96605a4

                                                                              SHA512

                                                                              1fb92b6174de3ced2ecaaf1ac30a291970507981cae4d7e8ec10b2f1bc37de544e6acd7d255513dffdb60702531378d42f296f1867eb7ad3939b4c4c2df7b64b

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\104f60b1-2cdd-4024-a750-d0140f03f312
                                                                              Filesize

                                                                              10KB

                                                                              MD5

                                                                              4ccaacaca4a16b7ff99e601ad6d50574

                                                                              SHA1

                                                                              6691656303357dd2dd32aee9f16f467afc64ba16

                                                                              SHA256

                                                                              4a508e061445be786ad4ce12e16476395517b5f929fa8b14f241a19165b32857

                                                                              SHA512

                                                                              45c960097b61bb23554309f58fccc75a59e97a6064e87be03c8c0887086800af00dc8cc89058da4c8268372e572f0e8494482e277796c5f15a640d1f7cfe5ded

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\3ff69c66-42f8-4367-8e6f-20ead0f66b9b
                                                                              Filesize

                                                                              745B

                                                                              MD5

                                                                              3d4a1b632a4b31c34b69856a00681f2c

                                                                              SHA1

                                                                              9e95dcd62514bc6eaf2400575a0f98b8df526026

                                                                              SHA256

                                                                              a76dc80283da62141e51954953256c28e0abe0b5bd3d811cb56a6ef8488ceca8

                                                                              SHA512

                                                                              e863b40cf024ea7da60ef1a9b3ae1a076797b979b0d83bc1653a6ed65508def9e82f11cc17bcde64d3bbf98f824193533343f359511da8edb0a6bc6dd50e8f9c

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                                                              Filesize

                                                                              997KB

                                                                              MD5

                                                                              fe3355639648c417e8307c6d051e3e37

                                                                              SHA1

                                                                              f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                                              SHA256

                                                                              1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                                              SHA512

                                                                              8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                                                              Filesize

                                                                              116B

                                                                              MD5

                                                                              3d33cdc0b3d281e67dd52e14435dd04f

                                                                              SHA1

                                                                              4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                                              SHA256

                                                                              f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                                              SHA512

                                                                              a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                                                              Filesize

                                                                              479B

                                                                              MD5

                                                                              49ddb419d96dceb9069018535fb2e2fc

                                                                              SHA1

                                                                              62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                                              SHA256

                                                                              2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                                              SHA512

                                                                              48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                                                              Filesize

                                                                              372B

                                                                              MD5

                                                                              8be33af717bb1b67fbd61c3f4b807e9e

                                                                              SHA1

                                                                              7cf17656d174d951957ff36810e874a134dd49e0

                                                                              SHA256

                                                                              e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                                              SHA512

                                                                              6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                                                              Filesize

                                                                              11.8MB

                                                                              MD5

                                                                              33bf7b0439480effb9fb212efce87b13

                                                                              SHA1

                                                                              cee50f2745edc6dc291887b6075ca64d716f495a

                                                                              SHA256

                                                                              8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                                              SHA512

                                                                              d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              688bed3676d2104e7f17ae1cd2c59404

                                                                              SHA1

                                                                              952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                                              SHA256

                                                                              33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                                              SHA512

                                                                              7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              937326fead5fd401f6cca9118bd9ade9

                                                                              SHA1

                                                                              4526a57d4ae14ed29b37632c72aef3c408189d91

                                                                              SHA256

                                                                              68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                                              SHA512

                                                                              b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              61839f4108614af05d7b9bd6d50c21cd

                                                                              SHA1

                                                                              5ca6215a916ba101463e0035047e8a40e82b9948

                                                                              SHA256

                                                                              c1723312c24786f16bbf15978995d761b1d7382e23ac7552c7d25ab083fbaa1b

                                                                              SHA512

                                                                              445be2545ac73b02e4a2b56b53a9b4d6dbb87f65adcb561ce1a363847d5b3aa255328b82cd5627d75aabdbeafa638f69fab78a7499aed22b7ebbc146212e00bb

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              73991a59ca44485edc4665415ce50271

                                                                              SHA1

                                                                              f1493799cabd234594ab9d6974d62e22a7b2a004

                                                                              SHA256

                                                                              d0ec8ba0bb9b6a00a6c1dbdcaad5d82d365ef08e6997ce681466dfec3ffdf9a8

                                                                              SHA512

                                                                              bf173ccf5129da8eda2ab7b51ddc45df3f34a74dc25ada84efbb9943cb3259bdbf7baa523b69533e349bb9bdc8971db081dddb7f02ca7b12b1424a38eabbb4e5

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                                                                              Filesize

                                                                              8KB

                                                                              MD5

                                                                              64981957b6eb4e7bfbffbb4e352791ea

                                                                              SHA1

                                                                              7295f1f39564cab05e254f9087a003b903e5bfd5

                                                                              SHA256

                                                                              cc4eed25fd855f01419a1089d896cb47ef7329cd01818d85011bc39d0096c6ae

                                                                              SHA512

                                                                              4b767d3f6c7e9994a6306783bad4487be7919cb4689444ccf0f751b72f53bbfb00930bdcf5a5d625e43bff2930beaff7c8d3ba8d688c518d043c52fe84ca8a27

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                                                                              Filesize

                                                                              7KB

                                                                              MD5

                                                                              041cd8408b2e10176f5378b9d57ab41b

                                                                              SHA1

                                                                              bfdeef32e48b422dc0bfb9e2d977ce16d5f87d94

                                                                              SHA256

                                                                              f0c37b058455c192278fabdef056743db37dc99e4cbc3c7bf6a3913e77ceed72

                                                                              SHA512

                                                                              2946e8af2d07427de354a9208432cdaf9cb4f0b8aeb5a5099cc5d5325a7dd1defd8c2afde6c7f4fe1e3d958b41306983446086b35d7c7e43a736bfa97d61964d

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js
                                                                              Filesize

                                                                              6KB

                                                                              MD5

                                                                              cbb061b99afbc4590c64ba8674cee8f5

                                                                              SHA1

                                                                              07ba8e688d27b73af4e1ae28fcf66b3c3b7ed6a9

                                                                              SHA256

                                                                              85f655501e43efa816e3c0792d0d10c0c8d948d1cffa4203b07e6cc4c508d3f7

                                                                              SHA512

                                                                              38ea9cc0b8b5a45d8e34f2b7bd54d9fd9a90ebc7d4efcc8b1713d607329ff45caa994738c108749f9a387a2b95c6bcf65915dea81f695f0faab2def1067f288d

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionCheckpoints.json
                                                                              Filesize

                                                                              90B

                                                                              MD5

                                                                              c4ab2ee59ca41b6d6a6ea911f35bdc00

                                                                              SHA1

                                                                              5942cd6505fc8a9daba403b082067e1cdefdfbc4

                                                                              SHA256

                                                                              00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

                                                                              SHA512

                                                                              71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              7f4548ec61b5cee05d1dbbf16371a348

                                                                              SHA1

                                                                              70fd4db1d3832ab4839558ccd08741f412c4424d

                                                                              SHA256

                                                                              80cf70e137d82df6cbb3a94ca35432099cf90c93afd9c6c190872e8534d7188c

                                                                              SHA512

                                                                              525e1c505a7106a25e24ebe8edc3ed5f47a62da9d020916a7aecfb6b482397b129bc04afe9d6ac771f2a8aa98a7898a46caeef616c101290ccabd0194a9c493d

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              cb23e5957df68a0e0e9ebe34a75aaf41

                                                                              SHA1

                                                                              f29a6ca9a4408ec078f99050d8b2c42078a4ef9a

                                                                              SHA256

                                                                              411c0bf1572af52a72930b52a8b2b6c0178fe7672115158afd3dc2d9b46ec1be

                                                                              SHA512

                                                                              65e24f8a2b48da236f91da85f10c7c956be7c9843cbe0733519435c3cd539266c1df3c863065f5ba5f6eb30bcf9c0f2b5851e5d964160433bc08ac5607643121

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore-backups\recovery.jsonlz4
                                                                              Filesize

                                                                              1KB

                                                                              MD5

                                                                              10ee6bb2685c3f8c2a277a3fbb57b32e

                                                                              SHA1

                                                                              4d1f396093ba0bbc2e3514bd0426b7fdfdbd2b9f

                                                                              SHA256

                                                                              c9eeabf4bd53a22d75ca0a8758c997f80f16881aaa34f27c74c58179e99bb6b9

                                                                              SHA512

                                                                              58c9e343969db1b57a5696fd345cb79f86ee8e3285637b71b2503f49501fe0131720dbe96b232d03e9b1590722881280e27b72e81ea71e64fa0a741c1e9c6295

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\sessionstore.jsonlz4
                                                                              Filesize

                                                                              950B

                                                                              MD5

                                                                              c8330fc0604fdde7021619705fa9e8cd

                                                                              SHA1

                                                                              606d5d6ed21b160acd5ba5c398250562345dd9ed

                                                                              SHA256

                                                                              98da421fec1f208eed576ef58d8473c7dd19f9f9ec8093e8ad96c578dfe05ada

                                                                              SHA512

                                                                              09c35c70e907a266f0a39a0c571dad9d4cafeb007569917de62af01ee8f25adc6d6e983139a543a3dc4589b3392f6c1a444cd600c170ef413246397d1fabaef8

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                              Filesize

                                                                              184KB

                                                                              MD5

                                                                              1ba55d958bb8e1aad33a1e9c7539dd9b

                                                                              SHA1

                                                                              c7e9afb8daa41c4a878e63ed9d23f9c214c925d4

                                                                              SHA256

                                                                              dbf3e4d4306ba16c88777f6411211dd548115611d4b32a86fafe9b7b1f1c2b2c

                                                                              SHA512

                                                                              e5efe67fbff7edcb84906d0da3332299493587eac387c1fcee6358bdaff68a9ea1c29be7ed10622db2ca002969cfa7122ddc881ac4afc2820a20310bc0c035e3

                                                                              Download Submit

                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\targeting.snapshot.json
                                                                              Filesize

                                                                              4KB

                                                                              MD5

                                                                              cb724f52d7114a995cd12cc3b6eb4de1

                                                                              SHA1

                                                                              3183a225f7ce05ddc9d1fbe7d64dbd327a4feb01

                                                                              SHA256

                                                                              0f13a76effb55916c291d7a68c0fe3147f9aa345feffdf5083380f9177665f88

                                                                              SHA512

                                                                              0e67d0527db193542deacbf39549dfa860b4d1209eae368a48a4ed04fd3ec33def780f43e6dbe4d74751ff75d63a3acb15dfe8ccb7646b336d0d30e348e0c0aa

                                                                              Download Submit

                                                                            • C:\Users\Admin\Documents\@[email protected]
                                                                              Filesize

                                                                              933B

                                                                              MD5

                                                                              f97d2e6f8d820dbd3b66f21137de4f09

                                                                              SHA1

                                                                              596799b75b5d60aa9cd45646f68e9c0bd06df252

                                                                              SHA256

                                                                              0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

                                                                              SHA512

                                                                              efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware.NyEQsVqi.zip.part
                                                                              Filesize

                                                                              63KB

                                                                              MD5

                                                                              26730d0a9ffb5e080b9bb934180ff6e7

                                                                              SHA1

                                                                              9370ee70e7eb7edae3b9db97844de385e374803c

                                                                              SHA256

                                                                              8faaefc2f432ce3d9d20cada7b69c1303dffff91f6c18a44a77041f4e653e6c8

                                                                              SHA512

                                                                              b3d7b7a6c4b56eccd8007ec32a5edd5aa3e2f1d1037231628da0fbfe1261f1dd6c0c590ca4bc222bcbcb0cfd32cb6628562a119a5bad41c833ce656cbae8167b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware.zip
                                                                              Filesize

                                                                              38.0MB

                                                                              MD5

                                                                              1f071d1ad6adbca1695a514d9f953604

                                                                              SHA1

                                                                              0dd305399f173be003927957838f0b7957b80912

                                                                              SHA256

                                                                              5fd84f4f2108568f61eb71479dc359425690f0a589ccf496000aed8f914e5b07

                                                                              SHA512

                                                                              cc0f83bf25a7655f3eb4108f7beb222ea02532d4e9487c3c053c14f35a140f903139c183f9a74e04fac43c3040c64535e598686d2f08ff3b49b791b74e461557

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\249661741295894.bat
                                                                              Filesize

                                                                              378B

                                                                              MD5

                                                                              0cc2dd83460b5f60061593ad38b401ba

                                                                              SHA1

                                                                              5b85d8c6a562f85ccb003fd59cd12b0e5a394c90

                                                                              SHA256

                                                                              d9547cddf086e2a76b60d7eadbbf752c490e594262898ad724c944227236c14e

                                                                              SHA512

                                                                              9b5973af2d9ca712f7bec86a62dc08cfbbddc903e2275ebdae3cc67ec68e897e08e8d0fe7b6c440edaa2a13aa3478ba40159ca31c838596467b48cccb134b7ec

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\@[email protected]
                                                                              Filesize

                                                                              240KB

                                                                              MD5

                                                                              7bf2b57f2a205768755c07f238fb32cc

                                                                              SHA1

                                                                              45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                              SHA256

                                                                              b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                              SHA512

                                                                              91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPlatinum.exe
                                                                              Filesize

                                                                              739KB

                                                                              MD5

                                                                              382430dd7eae8945921b7feab37ed36b

                                                                              SHA1

                                                                              c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128

                                                                              SHA256

                                                                              70e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b

                                                                              SHA512

                                                                              26abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\AntivirusPro2017.exe
                                                                              Filesize

                                                                              816KB

                                                                              MD5

                                                                              7dfbfba1e4e64a946cb096bfc937fbad

                                                                              SHA1

                                                                              9180d2ce387314cd4a794d148ea6b14084c61e1b

                                                                              SHA256

                                                                              312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94

                                                                              SHA512

                                                                              f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\AxInterop.WMPLib.dll
                                                                              Filesize

                                                                              52KB

                                                                              MD5

                                                                              c7c4f36c35198df7d2f23c217f4b89bf

                                                                              SHA1

                                                                              9fe2c415e97a8d836cb8b7822d94e8da58014035

                                                                              SHA256

                                                                              022c37312348e74e6b20a1f37ba35aa11b5621567529dc18276a855625aa23ab

                                                                              SHA512

                                                                              aaa72e56b57ce4a7629229ca88bdb095a18aeeeb947fb80a80a6646e01f99444399acdb49580c9c8d8d6a8757595865ae5e9b995597eebe7e70f6a625a8782de

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Blur.exe
                                                                              Filesize

                                                                              70KB

                                                                              MD5

                                                                              ab27a4504c98f0e22c266b0a377e5558

                                                                              SHA1

                                                                              bc33a3caa48b25d7cdff1c72bc6e5c9ef198df84

                                                                              SHA256

                                                                              077609aaef36278a7f2dbbc1e27cf876b7615ea9f7241730154777a36b21a9c5

                                                                              SHA512

                                                                              e3a5f3b824bc70b8b4957cdfc3bf53978a6fc96c787b4afd485cc685543603fb5c1bf750723bba000bcdd0441a74212c839020622f35e20e1b588b5d15c3c8c2

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Bolbi.vbs
                                                                              Filesize

                                                                              46KB

                                                                              MD5

                                                                              99ec3237394257cb0b5c24affe458f48

                                                                              SHA1

                                                                              5300e68423da9712280e601b51622c4b567a23a4

                                                                              SHA256

                                                                              ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51

                                                                              SHA512

                                                                              af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Bonzify.exe
                                                                              Filesize

                                                                              6.4MB

                                                                              MD5

                                                                              fba93d8d029e85e0cde3759b7903cee2

                                                                              SHA1

                                                                              525b1aa549188f4565c75ab69e51f927204ca384

                                                                              SHA256

                                                                              66f62408dfce7c4a5718d2759f1d35721ca22077398850277d16e1fca87fe764

                                                                              SHA512

                                                                              7c1441b2e804e925eb5a03e97db620117d3ad4f6981dc020e4e7df4bfc4bd6e414fa3b0ce764481a2cef07eebb2baa87407355bfbe88fab96397d82bd441e6a2

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Circles.exe
                                                                              Filesize

                                                                              75KB

                                                                              MD5

                                                                              de302cdfae9ca76f4406cd38ee81f594

                                                                              SHA1

                                                                              3f104f87a7ef77043025e36afbc1be3aff76a565

                                                                              SHA256

                                                                              41702db1a096906e34dc669b5e7385b64c8c108ef7cb779279e80917eb15e4bb

                                                                              SHA512

                                                                              88609e5e63825383221f22a75cd2c3cd20d08a8df78c117141288e05a82aebf1a9a4db384634a9db5dc0d767610b07deedad88d08376fe58d7347c1e589f15f9

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\ColorChange.exe
                                                                              Filesize

                                                                              71KB

                                                                              MD5

                                                                              1db84f940138ade841eb69f2d1b5e657

                                                                              SHA1

                                                                              d5d69675ee78842ba397049851617397457d8e23

                                                                              SHA256

                                                                              558208dc757f1fb83b56889bb1c44f8b196fbbf1c2864272be8f9106692c5e50

                                                                              SHA512

                                                                              9ac57ec73140532501ce4610dce128c7030ec914700687952f67839755bd986243afb32314e0e8f3b13713c4bc8cfa5444772a954088b0a82fa46750aa972520

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\FreeYoutubeDownloader.exe
                                                                              Filesize

                                                                              396KB

                                                                              MD5

                                                                              13f4b868603cf0dd6c32702d1bd858c9

                                                                              SHA1

                                                                              a595ab75e134f5616679be5f11deefdfaae1de15

                                                                              SHA256

                                                                              cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

                                                                              SHA512

                                                                              e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\HappyAntivirus.exe
                                                                              Filesize

                                                                              1.9MB

                                                                              MD5

                                                                              cb02c0438f3f4ddabce36f8a26b0b961

                                                                              SHA1

                                                                              48c4fcb17e93b74030415996c0ec5c57b830ea53

                                                                              SHA256

                                                                              64677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32

                                                                              SHA512

                                                                              373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\IconDance.exe
                                                                              Filesize

                                                                              301KB

                                                                              MD5

                                                                              7ad8c84dea7bd1e9cbb888734db28961

                                                                              SHA1

                                                                              58e047c7abecdd31d4e3c937b0ee89c98ab06c6a

                                                                              SHA256

                                                                              a4b6e53453d1874a6f78f0d7aa14dfafba778062f4b85b42b4c1001e1fc17095

                                                                              SHA512

                                                                              d34b087f7c6dd224e9bfe7a24364f878fc55c5368ce7395349ca063a7fd9ac555baed8431bfa13c331d7e58108b34e0f9d84482ce2e133f623dd086f14345adb

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Illerka.C.exe
                                                                              Filesize

                                                                              378KB

                                                                              MD5

                                                                              c718a1cbf0e13674714c66694be02421

                                                                              SHA1

                                                                              001d5370d3a7ee48db6caaecb1c213b5dfdf8e65

                                                                              SHA256

                                                                              cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f

                                                                              SHA512

                                                                              ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Interop.WMPLib.dll
                                                                              Filesize

                                                                              323KB

                                                                              MD5

                                                                              6515aac6d12e20b052187f256af73b96

                                                                              SHA1

                                                                              e91df2fad020ff5f11c28256650d7e231de67b8b

                                                                              SHA256

                                                                              4a36aecfb0ade38d252327f534058e3dd2e2209629631b9ad2b1c9cac86aed35

                                                                              SHA512

                                                                              ad49c7f734c36eea304846328485b2866d403672511f9df8d4c60038aabbecce952ff5afaf4774eda8dfd7647f0ca1839d136e74dfc16ae43bacd537b453b4b9

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Jigsaw.exe
                                                                              Filesize

                                                                              283KB

                                                                              MD5

                                                                              2773e3dc59472296cb0024ba7715a64e

                                                                              SHA1

                                                                              27d99fbca067f478bb91cdbcb92f13a828b00859

                                                                              SHA256

                                                                              3ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7

                                                                              SHA512

                                                                              6ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\WannaCrypt0r.exe
                                                                              Filesize

                                                                              3.4MB

                                                                              MD5

                                                                              84c82835a5d21bbcf75a61706d8ab549

                                                                              SHA1

                                                                              5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

                                                                              SHA256

                                                                              ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

                                                                              SHA512

                                                                              90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\Zika.exe
                                                                              Filesize

                                                                              5.6MB

                                                                              MD5

                                                                              40228458ca455d28e33951a2f3844209

                                                                              SHA1

                                                                              86165eb8eb3e99b6efa25426508a323be0e68a44

                                                                              SHA256

                                                                              1a904494bb7a21512af6013fe65745e7898cdd6fadac8cb58be04e02346ed95f

                                                                              SHA512

                                                                              da62cc244f9924444c7cb4fdbd46017c65e6130d639f6696f7930d867017c211df8b18601bfdaaee65438cee03977848513d7f08987b9b945f3f05241f55ec39

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\b.wnry
                                                                              Filesize

                                                                              1.4MB

                                                                              MD5

                                                                              c17170262312f3be7027bc2ca825bf0c

                                                                              SHA1

                                                                              f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                              SHA256

                                                                              d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                              SHA512

                                                                              c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\c.wnry
                                                                              Filesize

                                                                              780B

                                                                              MD5

                                                                              383a85eab6ecda319bfddd82416fc6c2

                                                                              SHA1

                                                                              2a9324e1d02c3e41582bf5370043d8afeb02ba6f

                                                                              SHA256

                                                                              079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

                                                                              SHA512

                                                                              c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\icons.exe
                                                                              Filesize

                                                                              105KB

                                                                              MD5

                                                                              3ca1d5768c2944d4284b1541653823c7

                                                                              SHA1

                                                                              85cf021ac23cd1340c6d649e6a77a213c1f848b6

                                                                              SHA256

                                                                              4172c6120f8f98685698365d6dd52c80eb2080203cdde479009bf8f4fa770af0

                                                                              SHA512

                                                                              7972adb329dbebc347b8a68789bbac4ba7c230cc980910d18a322d1a512015633d2a5801e76c0aae2fcfe120790c69417864549787dfc37574fb0aa3bfc202f0

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\mbrsetup.exe
                                                                              Filesize

                                                                              1.3MB

                                                                              MD5

                                                                              5075aa1815f57f9df355bc0c1ed96bac

                                                                              SHA1

                                                                              b56eee0afb749e2faa4da62340e0dfc1a4891348

                                                                              SHA256

                                                                              c69d5d57a31933f5e855f1ef0d2d451beece6d376b95eecfe2bc3140b0410857

                                                                              SHA512

                                                                              07a4e32ab14386d02e9297e5bc06a9a24e4accfdbf0d5a445661338472dee345de7f75b6e1de09a11e94d558a15b309280840b65afd9faf4a0ac1af1421fc8fe

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_bulgarian.wnry
                                                                              Filesize

                                                                              46KB

                                                                              MD5

                                                                              95673b0f968c0f55b32204361940d184

                                                                              SHA1

                                                                              81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                              SHA256

                                                                              40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                              SHA512

                                                                              7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_chinese (simplified).wnry
                                                                              Filesize

                                                                              53KB

                                                                              MD5

                                                                              0252d45ca21c8e43c9742285c48e91ad

                                                                              SHA1

                                                                              5c14551d2736eef3a1c1970cc492206e531703c1

                                                                              SHA256

                                                                              845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                              SHA512

                                                                              1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_chinese (traditional).wnry
                                                                              Filesize

                                                                              77KB

                                                                              MD5

                                                                              2efc3690d67cd073a9406a25005f7cea

                                                                              SHA1

                                                                              52c07f98870eabace6ec370b7eb562751e8067e9

                                                                              SHA256

                                                                              5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                              SHA512

                                                                              0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_croatian.wnry
                                                                              Filesize

                                                                              38KB

                                                                              MD5

                                                                              17194003fa70ce477326ce2f6deeb270

                                                                              SHA1

                                                                              e325988f68d327743926ea317abb9882f347fa73

                                                                              SHA256

                                                                              3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                              SHA512

                                                                              dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_czech.wnry
                                                                              Filesize

                                                                              39KB

                                                                              MD5

                                                                              537efeecdfa94cc421e58fd82a58ba9e

                                                                              SHA1

                                                                              3609456e16bc16ba447979f3aa69221290ec17d0

                                                                              SHA256

                                                                              5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                              SHA512

                                                                              e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_danish.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              2c5a3b81d5c4715b7bea01033367fcb5

                                                                              SHA1

                                                                              b548b45da8463e17199daafd34c23591f94e82cd

                                                                              SHA256

                                                                              a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                              SHA512

                                                                              490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_dutch.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              7a8d499407c6a647c03c4471a67eaad7

                                                                              SHA1

                                                                              d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                              SHA256

                                                                              2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                              SHA512

                                                                              608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_english.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              fe68c2dc0d2419b38f44d83f2fcf232e

                                                                              SHA1

                                                                              6c6e49949957215aa2f3dfb72207d249adf36283

                                                                              SHA256

                                                                              26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                              SHA512

                                                                              941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_filipino.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              08b9e69b57e4c9b966664f8e1c27ab09

                                                                              SHA1

                                                                              2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                              SHA256

                                                                              d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                              SHA512

                                                                              966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_finnish.wnry
                                                                              Filesize

                                                                              37KB

                                                                              MD5

                                                                              35c2f97eea8819b1caebd23fee732d8f

                                                                              SHA1

                                                                              e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                              SHA256

                                                                              1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                              SHA512

                                                                              908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_french.wnry
                                                                              Filesize

                                                                              37KB

                                                                              MD5

                                                                              4e57113a6bf6b88fdd32782a4a381274

                                                                              SHA1

                                                                              0fccbc91f0f94453d91670c6794f71348711061d

                                                                              SHA256

                                                                              9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                              SHA512

                                                                              4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_german.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              3d59bbb5553fe03a89f817819540f469

                                                                              SHA1

                                                                              26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                              SHA256

                                                                              2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                              SHA512

                                                                              95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_greek.wnry
                                                                              Filesize

                                                                              47KB

                                                                              MD5

                                                                              fb4e8718fea95bb7479727fde80cb424

                                                                              SHA1

                                                                              1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                              SHA256

                                                                              e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                              SHA512

                                                                              24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_indonesian.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              3788f91c694dfc48e12417ce93356b0f

                                                                              SHA1

                                                                              eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                              SHA256

                                                                              23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                              SHA512

                                                                              b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_italian.wnry
                                                                              Filesize

                                                                              36KB

                                                                              MD5

                                                                              30a200f78498990095b36f574b6e8690

                                                                              SHA1

                                                                              c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                              SHA256

                                                                              49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                              SHA512

                                                                              c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_japanese.wnry
                                                                              Filesize

                                                                              79KB

                                                                              MD5

                                                                              b77e1221f7ecd0b5d696cb66cda1609e

                                                                              SHA1

                                                                              51eb7a254a33d05edf188ded653005dc82de8a46

                                                                              SHA256

                                                                              7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                              SHA512

                                                                              f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\msg\m_korean.wnry
                                                                              Filesize

                                                                              89KB

                                                                              MD5

                                                                              6735cb43fe44832b061eeb3f5956b099

                                                                              SHA1

                                                                              d636daf64d524f81367ea92fdafa3726c909bee1

                                                                              SHA256

                                                                              552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

                                                                              SHA512

                                                                              60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

                                                                              Download Submit

                                                                            • C:\Users\Admin\Downloads\trash_malware\trash malware\stupidy fuckity malware.bat
                                                                              Filesize

                                                                              739B

                                                                              MD5

                                                                              aa416839111989eec2411d409582a9fa

                                                                              SHA1

                                                                              74f6b0a73f6f380046b347574867fced82504264

                                                                              SHA256

                                                                              a55e69e805387339fef5309169242a48f8533f21e15b1d16fdf9292e71b7fc8d

                                                                              SHA512

                                                                              d14900d93e7a7c869700d589b5be869b1dd96f894870ed51f4e11a49bbc816fd503f8549d984a0a352ac1b8ad1c315c0685cdfe5f387fd91daef539e49f197d8

                                                                              Download Submit

                                                                            • C:\Users\Public\Pictures\Sample Pictures\@[email protected]
                                                                              Filesize

                                                                              883B

                                                                              MD5

                                                                              8a0a6f1b83e123d40c36b56a32c75d3f

                                                                              SHA1

                                                                              d5d11fdd1b90e230b3a0b03ed581420da764709d

                                                                              SHA256

                                                                              1e416425bbae83f646f35d441120f4b7fb6d4c2f7bb5df60ea99f434b0c4e187

                                                                              SHA512

                                                                              cc5297331ad4ab90fc702ad82c2f00e4272fc4f1ddb07a5a50f7d8aaffaa710f9e2b4def29203af9e77d2ad1d3de6b0fc8e1c763561e36ec70e0cd1b2f0d53cb

                                                                              Download Submit

                                                                            • C:\Windows\302746537.exe
                                                                              Filesize

                                                                              22KB

                                                                              MD5

                                                                              8703ff2e53c6fd3bc91294ef9204baca

                                                                              SHA1

                                                                              3dbb8f7f5dfe6b235486ab867a2844b1c2143733

                                                                              SHA256

                                                                              3028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035

                                                                              SHA512

                                                                              d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204

                                                                              Download Submit

                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                              Filesize

                                                                              153KB

                                                                              MD5

                                                                              f33a4e991a11baf336a2324f700d874d

                                                                              SHA1

                                                                              9da1891a164f2fc0a88d0de1ba397585b455b0f4

                                                                              SHA256

                                                                              a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

                                                                              SHA512

                                                                              edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

                                                                              Download Submit

                                                                            • \Users\Admin\AppData\Local\Temp\fc3c6bd844574cc3b13b9052481e6dae\svchost.exe
                                                                              Filesize

                                                                              861KB

                                                                              MD5

                                                                              66064dbdb70a5eb15ebf3bf65aba254b

                                                                              SHA1

                                                                              0284fd320f99f62aca800fb1251eff4c31ec4ed7

                                                                              SHA256

                                                                              6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

                                                                              SHA512

                                                                              b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

                                                                              Download Submit

                                                                            • \Users\Admin\Downloads\trash_malware\trash malware\XPAntivirus2008.exe
                                                                              Filesize

                                                                              1.3MB

                                                                              MD5

                                                                              e979fb2eb504972ed87ad3c825ec6c2c

                                                                              SHA1

                                                                              7a927cfa6d413f66da1ae05f668ce85b3547aaf2

                                                                              SHA256

                                                                              9d45ae1d8d3749efbe72b24bc20142e8c55b88a0733a45e5fe8579cf24981f33

                                                                              SHA512

                                                                              df1b55bff5fdee03cd77d59befe5ccfef555100605f7e9782e0a90e21ad6f67c92bdf925e2844d042c9da48e1c05eb4970460683aebbec2bf5a3f9cf6341bee6

                                                                              Download Submit

                                                                            • \Users\Admin\Downloads\trash_malware\trash malware\gaben64.exe
                                                                              Filesize

                                                                              1.5MB

                                                                              MD5

                                                                              c75a53e3d52543b1f7f18dced4d2e7e6

                                                                              SHA1

                                                                              a570b105c8433333152da79d0d584cbf58fa028d

                                                                              SHA256

                                                                              44700e507a6d0f3da8a625affe35264963bc6ce21b4c45b1bd5f8636f73324f0

                                                                              SHA512

                                                                              a7bf4dac1eac425a3e7613a417fc8de7c841d8dfcc36786e08bcd384399b9ab62013f4ffa820fee3485b878ec7f1318ae406257a4bc52f0e8142112488631a6e

                                                                              Download Submit

                                                                            • \Users\Admin\Downloads\trash_malware\trash malware\sweeney64.exe
                                                                              Filesize

                                                                              1.2MB

                                                                              MD5

                                                                              983d92b95c706a99fc613e59ba5d45c4

                                                                              SHA1

                                                                              f4b63d88ce8ce5df0e2a8a6b1e5954188f2a45a5

                                                                              SHA256

                                                                              6ea7e86a7de8be07b56496385b5584d417dfeb0a7198d2766d508697327932ac

                                                                              SHA512

                                                                              4a53dadf6b6009ab0bb6dd382735fc2d9c5c13792d76212b9b3762fe458493061ac37d87bde877876ff20b8019aaf4bfe018edc6157c3dc5cfc7ab7f19a2f300

                                                                              Download Submit

                                                                            • memory/448-597-0x0000000000810000-0x0000000000DBC000-memory.dmp

                                                                              Filesize

                                                                              5.7MB

                                                                              Download

                                                                            • memory/768-1977-0x00000000034C0000-0x00000000034D0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/768-1989-0x00000000034C0000-0x00000000034D0000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/768-1962-0x0000000003A90000-0x0000000004402000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/768-1955-0x0000000003A90000-0x0000000004402000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/808-2314-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                              Filesize

                                                                              884KB

                                                                              Download

                                                                            • memory/1240-1116-0x00000000022F0000-0x0000000002300000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/1240-1106-0x00000000007F0000-0x00000000007F6000-memory.dmp

                                                                              Filesize

                                                                              24KB

                                                                              Download

                                                                            • memory/1268-2062-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                              Filesize

                                                                              884KB

                                                                              Download

                                                                            • memory/1276-9202-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/1312-1308-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                              Filesize

                                                                              240KB

                                                                              Download

                                                                            • memory/1312-2189-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                              Filesize

                                                                              884KB

                                                                              Download

                                                                            • memory/1444-1208-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                              Filesize

                                                                              884KB

                                                                              Download

                                                                            • memory/1448-9389-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/1452-684-0x00000000003E0000-0x0000000000418000-memory.dmp

                                                                              Filesize

                                                                              224KB

                                                                              Download

                                                                            • memory/1716-8908-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/1772-9137-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/1800-1118-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/1800-1914-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/1828-9344-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/2028-18035-0x0000000000BA0000-0x0000000000C14000-memory.dmp

                                                                              Filesize

                                                                              464KB

                                                                              Download

                                                                            • memory/2040-9046-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/2060-1895-0x0000000000100000-0x000000000010D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/2060-1896-0x0000000000100000-0x000000000010D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/2068-4683-0x0000000000020000-0x0000000000027000-memory.dmp

                                                                              Filesize

                                                                              28KB

                                                                              Download

                                                                            • memory/2084-1944-0x0000000000400000-0x000000000041D000-memory.dmp

                                                                              Filesize

                                                                              116KB

                                                                              Download

                                                                            • memory/2092-1968-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-2590-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1974-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-2377-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1973-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-2482-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1969-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1972-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-2481-0x00000000015A0000-0x0000000001F12000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1970-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2092-1971-0x0000000000400000-0x0000000000D72000-memory.dmp

                                                                              Filesize

                                                                              9.4MB

                                                                              Download

                                                                            • memory/2104-9257-0x0000000074F70000-0x0000000074F78000-memory.dmp

                                                                              Filesize

                                                                              32KB

                                                                              Download

                                                                            • memory/2124-1683-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                              Filesize

                                                                              4.3MB

                                                                              Download

                                                                            • memory/2176-8362-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                              Filesize

                                                                              320KB

                                                                              Download

                                                                            • memory/2176-11216-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                              Filesize

                                                                              320KB

                                                                              Download

                                                                            • memory/2176-1942-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                              Filesize

                                                                              320KB

                                                                              Download

                                                                            • memory/2460-1994-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/2460-1897-0x0000000000400000-0x000000000040D000-memory.dmp

                                                                              Filesize

                                                                              52KB

                                                                              Download

                                                                            • memory/2468-676-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                              Filesize

                                                                              64KB

                                                                              Download

                                                                            • memory/2556-681-0x00000000012C0000-0x00000000014B2000-memory.dmp

                                                                              Filesize

                                                                              1.9MB

                                                                              Download

                                                                            • memory/2760-1759-0x0000000000BE0000-0x0000000000C0E000-memory.dmp

                                                                              Filesize

                                                                              184KB

                                                                              Download

                                                                            • memory/2820-2371-0x0000000000400000-0x00000000004DD000-memory.dmp

                                                                              Filesize

                                                                              884KB

                                                                              Download

                                                                            • memory/2840-2165-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                              Filesize

                                                                              4.3MB

                                                                              Download

                                                                            • memory/3004-2354-0x0000000000400000-0x000000000084A000-memory.dmp

                                                                              Filesize

                                                                              4.3MB

                                                                              Download

                                                                            • memory/3056-8363-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-598-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-1943-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-7109-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-3078-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-9952-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-11217-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-4321-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download

                                                                            • memory/3056-5863-0x0000000000400000-0x0000000000A06000-memory.dmp

                                                                              Filesize

                                                                              6.0MB

                                                                              Download