Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

13129974d7...82.exe

windows7-x64

10

13129974d7...82.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2025, 15:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    13129974d7447f2f74f8377260f5bf82.exe

  • Size

    1.8MB

  • MD5

    13129974d7447f2f74f8377260f5bf82

  • SHA1

    897d9332ace7d3eea31e98563562f2b61fb871d7

  • SHA256

    baf0e2efe3d441c4631b40d199edd05b56b49620f60bfd03ece1012fde47b30c

  • SHA512

    3a3617e221ff0f95ade28b9329b6b05898d3fd2464e352c36746cfabcd503c16896f0712d7ebccb482888adb4da4aa6d0ef5bf5c1197f107a47b8ea1896be54b

  • SSDEEP

    24576:pvAqwosjHFzTcnKZqTuFtsPpOPKKHQXCM//TwKo9V3Ehvty5wqHeKkfahq2:WpomlsnAqicPpgKfSLxX2vc5CfahV

Score
10/10
amadeygcleanerhealerlummastealc092155trumpdefense_evasiondiscoverydropperevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://begindecafer.world/api

https://9garagedrootz.top/api

https://modelshiverd.icu/api

https://arisechairedd.shop/api

https://catterjur.run/api

https://orangemyther.live/api

https://fostinjec.today/api

https://ksterpickced.digital/api

https://xexarthynature.run/api

https://hardswarehub.today/api

https://gadgethgfub.icu/api

https://shardrwarehaven.run/api

https://techmindzs.live/api

https://bcodxefusion.top/api

https://quietswtreams.life/api

https://techspherxe.top/api

https://earthsymphzony.today/api

https://dawtastream.bet/api

https://foresctwhispers.top/api

https://tracnquilforest.life/api

Extracted

Family

stealc

Botnet

trump

C2

http://45.93.20.28

Attributes
  • url_path

    /85a1cacf11314eb8.php

Extracted

Family

lumma

C2

https://exarthynature.run/api

https://moderzysics.top/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Downloads MZ/PE file 13 IoCs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 15 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 60 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\13129974d7447f2f74f8377260f5bf82.exe
    "C:\Users\Admin\AppData\Local\Temp\13129974d7447f2f74f8377260f5bf82.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Users\Admin\AppData\Local\Temp\10126330101\1279735e94.exe
        "C:\Users\Admin\AppData\Local\Temp\10126330101\1279735e94.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 1204
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2000
      • C:\Users\Admin\AppData\Local\Temp\10126340101\ee13c2b96e.exe
        "C:\Users\Admin\AppData\Local\Temp\10126340101\ee13c2b96e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2988
        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
          4⤵
          • Downloads MZ/PE file
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:944
      • C:\Users\Admin\AppData\Local\Temp\10126350101\ecdc345473.exe
        "C:\Users\Admin\AppData\Local\Temp\10126350101\ecdc345473.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2176
        • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
          "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
          4⤵
          • Downloads MZ/PE file
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2496
      • C:\Users\Admin\AppData\Local\Temp\10126360101\0d49a3b977.exe
        "C:\Users\Admin\AppData\Local\Temp\10126360101\0d49a3b977.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2288
      • C:\Users\Admin\AppData\Local\Temp\10126370101\d55158c28f.exe
        "C:\Users\Admin\AppData\Local\Temp\10126370101\d55158c28f.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Users\Admin\AppData\Local\Temp\10126370101\d55158c28f.exe
          "C:\Users\Admin\AppData\Local\Temp\10126370101\d55158c28f.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2544
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 1012
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:1688
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 508
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1524
      • C:\Users\Admin\AppData\Local\Temp\10126380101\e2b1ddb355.exe
        "C:\Users\Admin\AppData\Local\Temp\10126380101\e2b1ddb355.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2668
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 1200
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2276
      • C:\Users\Admin\AppData\Local\Temp\10126390101\c816e942e2.exe
        "C:\Users\Admin\AppData\Local\Temp\10126390101\c816e942e2.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2524
      • C:\Users\Admin\AppData\Local\Temp\10126400101\c379d3025a.exe
        "C:\Users\Admin\AppData\Local\Temp\10126400101\c379d3025a.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1804
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM firefox.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2976
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM chrome.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1920
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM msedge.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2672
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM opera.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2804
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /F /IM brave.exe /T
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2384
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
          4⤵
            PID:2468
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
              5⤵
              • Checks processor information in registry
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:2660
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.0.1620287618\111508271" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63b4cc6d-b915-4d08-aa2e-8f3c8a81d540} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 1284 111f7b58 gpu
                6⤵
                  PID:2764
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.1.1132673085\75588454" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17f5ecd5-048e-4b02-9b17-531cd390b430} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 1500 d72d58 socket
                  6⤵
                    PID:1780
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.2.295896686\2090209149" -childID 1 -isForBrowser -prefsHandle 2044 -prefMapHandle 2040 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da249eeb-10e4-4e04-ae3f-4794ac9ef647} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 2060 19fc8e58 tab
                    6⤵
                      PID:2128
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.3.447049613\1941300777" -childID 2 -isForBrowser -prefsHandle 2820 -prefMapHandle 2816 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {83926be7-8975-4bbd-8ce3-24dd3c0e1f74} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 2832 1ccb0258 tab
                      6⤵
                        PID:1728
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.4.1152559632\1004421765" -childID 3 -isForBrowser -prefsHandle 3756 -prefMapHandle 3752 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59316948-453a-44b0-82e4-3e874392ef6f} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 3768 21753e58 tab
                        6⤵
                          PID:2680
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.5.880180136\926361629" -childID 4 -isForBrowser -prefsHandle 3876 -prefMapHandle 3880 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f872100f-ea5f-4683-b8dc-296489f34edb} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 3864 21754458 tab
                          6⤵
                            PID:2228
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2660.6.1694291529\1578277062" -childID 5 -isForBrowser -prefsHandle 4048 -prefMapHandle 4052 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 844 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb193b08-43d8-4652-b216-74781a175dae} 2660 "\\.\pipe\gecko-crash-server-pipe.2660" 4036 21814f58 tab
                            6⤵
                              PID:1916
                      • C:\Users\Admin\AppData\Local\Temp\10126410101\87a504ae61.exe
                        "C:\Users\Admin\AppData\Local\Temp\10126410101\87a504ae61.exe"
                        3⤵
                        • Modifies Windows Defender DisableAntiSpyware settings
                        • Modifies Windows Defender Real-time Protection settings
                        • Modifies Windows Defender TamperProtection settings
                        • Modifies Windows Defender notification settings
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Windows security modification
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2980
                      • C:\Users\Admin\AppData\Local\Temp\10126420101\zY9sqWs.exe
                        "C:\Users\Admin\AppData\Local\Temp\10126420101\zY9sqWs.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1392
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 1008
                          4⤵
                          • Loads dropped DLL
                          • Program crash
                          PID:3264
                      • C:\Users\Admin\AppData\Local\Temp\10126430101\MCxU5Fj.exe
                        "C:\Users\Admin\AppData\Local\Temp\10126430101\MCxU5Fj.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:2584
                        • C:\Users\Admin\AppData\Local\Temp\10126430101\MCxU5Fj.exe
                          "C:\Users\Admin\AppData\Local\Temp\10126430101\MCxU5Fj.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2936
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 1008
                            5⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:3168
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 504
                          4⤵
                          • Loads dropped DLL
                          • Program crash
                          PID:2844
                      • C:\Users\Admin\AppData\Local\Temp\10126440101\9hUDDVk.exe
                        "C:\Users\Admin\AppData\Local\Temp\10126440101\9hUDDVk.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3480
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 836
                          4⤵
                          • Loads dropped DLL
                          • Program crash
                          PID:3920

                  Network

                  MITRE ATT&CK Enterprise v15

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  4
                  T1543

                  Windows Service

                  4
                  T1543.003

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  4
                  T1543

                  Windows Service

                  4
                  T1543.003

                  Defense Evasion

                  Impair Defenses

                  5
                  T1562

                  Disable or Modify Tools

                  5
                  T1562.001

                  Modify Registry

                  7
                  T1112

                  Subvert Trust Controls

                  1
                  T1553

                  Install Root Certificate

                  1
                  T1553.004

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  2
                  T1552

                  Credentials In Files

                  2
                  T1552.001

                  Discovery

                  Browser Information Discovery

                  1
                  T1217

                  Query Registry

                  5
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  Virtualization/Sandbox Evasion

                  2
                  T1497

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                    Filesize

                    71KB

                    MD5

                    83142242e97b8953c386f988aa694e4a

                    SHA1

                    833ed12fc15b356136dcdd27c61a50f59c5c7d50

                    SHA256

                    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

                    SHA512

                    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y1738IZL\service[1].htm
                    Filesize

                    1B

                    MD5

                    cfcd208495d565ef66e7dff9f98764da

                    SHA1

                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                    SHA256

                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                    SHA512

                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp
                    Filesize

                    26KB

                    MD5

                    bf6cef58817e45edbf3c71a09a9edc64

                    SHA1

                    49f57fa51c2f3e3d1707b54ac0a44cb239b304f9

                    SHA256

                    7b10491748c9782804080f9786e80b4e5d85d5506329c1d8f59f8ae050a93e5c

                    SHA512

                    c7da20eb74ddb63e49312f54a92c82a33495d689194775ab84562642eca6e53a1bfadac881aa4c43bd5bd4c16632ec6ffecb80f4464ccf788345a95aefbe54b8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                    Filesize

                    15KB

                    MD5

                    96c542dec016d9ec1ecc4dddfcbaac66

                    SHA1

                    6199f7648bb744efa58acf7b96fee85d938389e4

                    SHA256

                    7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                    SHA512

                    cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126330101\1279735e94.exe
                    Filesize

                    2.9MB

                    MD5

                    7ef195119136bbd7338323363639b91b

                    SHA1

                    ef751fa464c872ddfb94e530578ae2d5575ea0ab

                    SHA256

                    76f4434753e13ea20f59819a07b45b0b17ca3d01a0b7f403a936178ae8d95d58

                    SHA512

                    38d2b6cbf352a95d11888707f8ae8d13e6fe6073b495a29814aa8cc689fdb585c0287a1ce4bee2a8226e23ee07c455f4cfd8a3399c48961a5ebf71501032d8b8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126340101\ee13c2b96e.exe
                    Filesize

                    3.7MB

                    MD5

                    816d3fd07925e02b1d0cde9f2d96c6d5

                    SHA1

                    f3859dc7db085a483897faff2604b28230c4e8f3

                    SHA256

                    5a02669e795145ac1c89e49db386b85534c5b34b804f053a14c8ba2401ddc5d0

                    SHA512

                    a805f1bb9de30ae1be60600615b6c9692ff13f7ab85bb03c8463aa3bd963b1ef5cfe4b50ebed44d7346d7e57a95e7f55245c6cd38480b91475e48cbb8667063e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126350101\ecdc345473.exe
                    Filesize

                    4.5MB

                    MD5

                    f23cde620e1aa927df2729ab5bc026ba

                    SHA1

                    17a28874ec64756b561f6bff36a9ce15bc86e023

                    SHA256

                    979d7afda8224f12d4fbf3baf313d34317869d30e52608fe3e2f959fa2998b49

                    SHA512

                    48e7969a0a10d42d92e13a16d86ca653201a5a6456adf1640f323a805d5e088ff50cca60fed50560c05df83913d513ec7ae7119e11883c4360ba46294a73e810

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126360101\0d49a3b977.exe
                    Filesize

                    1.8MB

                    MD5

                    8ff477ff742577c058d141727a10c360

                    SHA1

                    caf8d13255ca0e7d4b44fa9bb84d7818e4ae6174

                    SHA256

                    e3d97d7041d8c959ce04c3c67cbab78d673e0d50f21de893274e4982f4698b6e

                    SHA512

                    9a21efc003d8a09dab95453e210d4562e390bf9c2e3c574fa04ba1a169c7c35fb7debb1c0fdee850d8fe9b52b775274903df6964ba2c2316cce679f2257a8e70

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126370101\d55158c28f.exe
                    Filesize

                    445KB

                    MD5

                    c83ea72877981be2d651f27b0b56efec

                    SHA1

                    8d79c3cd3d04165b5cd5c43d6f628359940709a7

                    SHA256

                    13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

                    SHA512

                    d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126380101\e2b1ddb355.exe
                    Filesize

                    3.1MB

                    MD5

                    d3678cf7d1ed502598ff3fe50c1b11e7

                    SHA1

                    b706c802ef43af66a05254ffbffcf88fbea7f07a

                    SHA256

                    ce17f1dca8151d24bde598e8678be5153609f995a6cbfcb052177f7cefdeafa6

                    SHA512

                    c5a728fd6d6ebeca60ba6ed3d1fdb8151cb62084c605a2fdaeba390f456b95e89b208b932f5c3d520c4d5c60706dd74141195fb57c2a8630d178d34c26992f78

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126390101\c816e942e2.exe
                    Filesize

                    1.7MB

                    MD5

                    79ba9165be6c8031465525f48fe1a7b0

                    SHA1

                    08d8d07d9929814e3dde81920f86b16d8c9f1284

                    SHA256

                    8947b1b6d7d09243e7e6d0abeaf0df6b410e5065e8e78e8d66ebace1dbb3a9d9

                    SHA512

                    9950253099354c3090b0afb173ff36f9bbf7fb6c4aa4f71ede0ea4b1ce7087ed4212fd87290db981c06066d70c1cf45563662f1419dcff68be3240dcd021829f

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126400101\c379d3025a.exe
                    Filesize

                    950KB

                    MD5

                    25322eaf6927513a16e248ea37a3a9d7

                    SHA1

                    584e12fb816e27012c61edfd9ed5efbf1137fc08

                    SHA256

                    04655ec920c50bddbdb9fe5ad953f79baf8bdad0f3d28d2a1ae1aab8caabca52

                    SHA512

                    336f1892870dfcb10afc267ec3280ae84af3ceed3e5cb42c7e1995ea3b29d0226e4f14bf4463213f1523ac0020283d787966169cbb43a8f3b1478ed2361b6919

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126410101\87a504ae61.exe
                    Filesize

                    2.7MB

                    MD5

                    1e460c52dda47dcd8107802d6d7912e6

                    SHA1

                    a83808704df881e5242b4742c5a8194476111fff

                    SHA256

                    5e5820dd23335657df1c6069466d5a98e5d6cfcce60b899b3fca1528f6ffb2e4

                    SHA512

                    b16ca3d2bd4ad60833ad96ee3f7e38c46c133a309a22e5e7420f21b234e64255f8eee1d576fb169f4b72e2f17eafde060bc8b89769a0d9a74f395dfbe80e6824

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126420101\zY9sqWs.exe
                    Filesize

                    354KB

                    MD5

                    f87cf7265f520387d466276cf4be3a85

                    SHA1

                    b5a3733a6be31c61ec57dec0bf8fee7b2f4fd307

                    SHA256

                    9b45e0e9091f0647a315676409a3a05303067d475f2fa4096aeff1819844dce2

                    SHA512

                    8cd1918f954858f10c75a8e65a03bb0a49a4a1f0cc4df1a6305c262e5b1a9f61d6e9522d19ff1b438b6084bec279bee230bded3f3baa140b31fc40e3306f65de

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126430101\MCxU5Fj.exe
                    Filesize

                    415KB

                    MD5

                    641525fe17d5e9d483988eff400ad129

                    SHA1

                    8104fa08cfcc9066df3d16bfa1ebe119668c9097

                    SHA256

                    7a87b801af709e8e510140f0f9523057793e7883ec2b6a4eab90fcf0ec20fd4a

                    SHA512

                    ee92bc34e21bb68aeda20b237e8b8e27f95e4cc44f5fd9743b52079c40f193cc342f8bb2690fd7ab3624e1690979118bd2e00a46bda3052cbd76bc379b87407e

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\10126440101\9hUDDVk.exe
                    Filesize

                    6.9MB

                    MD5

                    87fc5821b29f5cdef4d118e71c764501

                    SHA1

                    011be923a27b204058514e7ab0ffc8d10844a265

                    SHA256

                    1be77012b7c721e4d4027f214bad43253c1f0116c6b2a4364685d8d69120e2aa

                    SHA512

                    0aedfce9b49b72f481d9aeecbcef178a19f27d10acb85e9f64be2c541a4400cf36d622900eae9e8c702387570e933937f6ccfeb190d5fc8661c986a981d2c0f8

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\Tar8F8A.tmp
                    Filesize

                    183KB

                    MD5

                    109cab5505f5e065b63d01361467a83b

                    SHA1

                    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

                    SHA256

                    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

                    SHA512

                    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                    Filesize

                    442KB

                    MD5

                    85430baed3398695717b0263807cf97c

                    SHA1

                    fffbee923cea216f50fce5d54219a188a5100f41

                    SHA256

                    a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                    SHA512

                    06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                    Download Submit

                  • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                    Filesize

                    8.0MB

                    MD5

                    a01c5ecd6108350ae23d2cddf0e77c17

                    SHA1

                    c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                    SHA256

                    345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                    SHA512

                    b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin
                    Filesize

                    2KB

                    MD5

                    e0d6bf277df9ceeff0714e64df7c9c29

                    SHA1

                    8684d6d5eade58491427fa690082956f606f79b6

                    SHA256

                    35d535a59a862a49034f089c4126fa06d3b5f720fa32ab2df74d2aa4bb6b217f

                    SHA512

                    8ec0d902dac83d84f7d77084bf213142c0b023be751f150c5f1ae4bc9543654a555e78770b30066544a6b56f1831040933ef28105437404e65c060dac5f31ce4

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\573593f6-89a3-4c0c-a583-a31bd2415799
                    Filesize

                    745B

                    MD5

                    dfc9887345030d32ece4aa4e17ebc7fa

                    SHA1

                    e66154f8782cf704a4800e3d9ae3a9cb53a2f03d

                    SHA256

                    c3e2e6b3edd048fc9b0dd77a9fb56844e669c3a4bdfc87479fe1fe42058c22a7

                    SHA512

                    579b9ed74126dfd86269b3d143d6e6593bf12a6f57a074269ac50c43232f4fb05e955a0682e602b60ef5bf96b4a25bdcb1af2ef00d51e5931e7d298a2b4bf849

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\689c9b29-9fd8-4eab-80d1-953973f7350e
                    Filesize

                    11KB

                    MD5

                    1c53d86b54c434fddd59664f7dace5d4

                    SHA1

                    1e39d2e6535d0766709af60350e8a45a466077ef

                    SHA256

                    13eebe0567bb471e823b688a5a4563aa53f3ee233c7202d39d2e97c110ed89bb

                    SHA512

                    0c4bd191bda1d5989b46eecb52e181743fc77f7aae9f7d7f80c12b64274175dd626b68d3427d224c4a283d68d039633e59ac1c6b9685d1c57bae58efa4a6e2dd

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                    Filesize

                    997KB

                    MD5

                    fe3355639648c417e8307c6d051e3e37

                    SHA1

                    f54602d4b4778da21bc97c7238fc66aa68c8ee34

                    SHA256

                    1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                    SHA512

                    8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                    Filesize

                    116B

                    MD5

                    3d33cdc0b3d281e67dd52e14435dd04f

                    SHA1

                    4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                    SHA256

                    f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                    SHA512

                    a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                    Filesize

                    479B

                    MD5

                    49ddb419d96dceb9069018535fb2e2fc

                    SHA1

                    62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                    SHA256

                    2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                    SHA512

                    48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                    Filesize

                    372B

                    MD5

                    8be33af717bb1b67fbd61c3f4b807e9e

                    SHA1

                    7cf17656d174d951957ff36810e874a134dd49e0

                    SHA256

                    e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                    SHA512

                    6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                    Filesize

                    11.8MB

                    MD5

                    33bf7b0439480effb9fb212efce87b13

                    SHA1

                    cee50f2745edc6dc291887b6075ca64d716f495a

                    SHA256

                    8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                    SHA512

                    d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                    Filesize

                    1KB

                    MD5

                    688bed3676d2104e7f17ae1cd2c59404

                    SHA1

                    952b2cdf783ac72fcb98338723e9afd38d47ad8e

                    SHA256

                    33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                    SHA512

                    7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                    Filesize

                    1KB

                    MD5

                    937326fead5fd401f6cca9118bd9ade9

                    SHA1

                    4526a57d4ae14ed29b37632c72aef3c408189d91

                    SHA256

                    68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                    SHA512

                    b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                    Filesize

                    7KB

                    MD5

                    6cd230f4913630aa7fa9df9daee3ff89

                    SHA1

                    64aaf2df5852e029e511a52f5017c60238b93be7

                    SHA256

                    755ea43b4aaa62e7c6613662f4846c357236e1e393cadd8863e52624c6e669e8

                    SHA512

                    c62fba917981777e8a6f7d8badba62dc4ba0eae6c90f519256ecef363be96877220ace1b2262c234c7d16254f7061698afe0188f09313e3b897f7a4161ae5235

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js
                    Filesize

                    6KB

                    MD5

                    c862b3db9aac8cca2c8c27ecb4e99925

                    SHA1

                    4a0f093abb664cc1039affc0a22f7698e4a515fd

                    SHA256

                    bd728f9654626cb9700fdea667dc571b324ef115953bafcbad8de102794dae91

                    SHA512

                    52beba1bdf5443a30c2db9f1671853a8fe5b0e09b59de56859ae5471cbd8be6d5a2d784cbe5cc7f17690383b8aeebe00d9f4d8d81162e9a8da8e854201af919a

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js
                    Filesize

                    6KB

                    MD5

                    277484d410da1678e8782f8c9a5f3b5a

                    SHA1

                    ac289c727f5b85dd50f1be8982693e02de9a8fd7

                    SHA256

                    4fc12bb92b34330b8262828167f90429fdc13f198b3984efe13585f61acf015d

                    SHA512

                    9172c6e806f0823e8fa584df4a89be933aa0363e41b40533e4c4391a8e12e027e7c51bff8cf96e20ff1f66f3567fa1567b061292094605e33ea204cf202d1103

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js
                    Filesize

                    6KB

                    MD5

                    350c6bd995685de6681b6dda023f1099

                    SHA1

                    6a226e36d49a2bde8dacd932f9ef1e796681d045

                    SHA256

                    96992cb9e8daa9b30bc1c3737f2426395d14cf897105a434579be32fd4c0a3a0

                    SHA512

                    25a6de6efba56c61114ce7773bf8cdeac710eccb742b26c5bd96ab27df4552912bd7a5a22cb25d854aa30954df526dd1d62849e0435bdf46a5f99a6f04829c66

                    Download Submit

                  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4
                    Filesize

                    4KB

                    MD5

                    524a5b3e2aa5e57e8a86818b2f0c3938

                    SHA1

                    f0117eda99062d62706d49612b1dfe262f979518

                    SHA256

                    fb62a401654bd0b2bd01509d8e8d96c0ceda083f34a5e87650db09e707bf985b

                    SHA512

                    500e9d634bdad8075c1e7613632d23de4ebace57558237d4fa2371523f38a12a693b7e96b0fcb26ed37282bc6feae38a203ce397254e8b636e1002c84ef8d2d1

                    Download Submit

                  • C:\Users\Admin\Desktop\YCL.lnk
                    Filesize

                    1KB

                    MD5

                    70a2cb007fd30dc03675681dbda52c09

                    SHA1

                    d308e4fb80631f6ec96c879e778bc454a0943604

                    SHA256

                    226cf2d9aa4bb2c47e3e09e15db40ae9aab8523de5aae5aebfb278aa2049e56a

                    SHA512

                    3bc7e660991834ef86a327631f6d393d9605e8ac17aae47e75b5b306dfe3c5245068b42144366596071e9f9a3c906c82d8a6a425f471ff11411377f92d0d0625

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\2DfwfYW6\Y-Cleaner.exe
                    Filesize

                    987KB

                    MD5

                    f49d1aaae28b92052e997480c504aa3b

                    SHA1

                    a422f6403847405cee6068f3394bb151d8591fb5

                    SHA256

                    81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                    SHA512

                    41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                    Download Submit

                  • \Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                    Filesize

                    1.8MB

                    MD5

                    13129974d7447f2f74f8377260f5bf82

                    SHA1

                    897d9332ace7d3eea31e98563562f2b61fb871d7

                    SHA256

                    baf0e2efe3d441c4631b40d199edd05b56b49620f60bfd03ece1012fde47b30c

                    SHA512

                    3a3617e221ff0f95ade28b9329b6b05898d3fd2464e352c36746cfabcd503c16896f0712d7ebccb482888adb4da4aa6d0ef5bf5c1197f107a47b8ea1896be54b

                    Download Submit

                  • memory/944-80-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  • memory/944-82-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  • memory/944-88-0x0000000010000000-0x000000001001C000-memory.dmp

                    Filesize

                    112KB

                    Download

                  • memory/1628-2-0x00000000002C1000-0x00000000002EF000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/1628-4-0x00000000002C0000-0x000000000076E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-19-0x0000000006BC0000-0x000000000706E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-22-0x00000000002C0000-0x000000000076E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-0-0x00000000002C0000-0x000000000076E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-18-0x0000000006BC0000-0x000000000706E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-5-0x00000000002C0000-0x000000000076E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1628-1-0x00000000772A0000-0x00000000772A2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/1628-3-0x00000000002C0000-0x000000000076E000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2176-140-0x0000000000C90000-0x00000000018BE000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2176-141-0x0000000000C90000-0x00000000018BE000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2176-114-0x0000000000C90000-0x00000000018BE000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2176-176-0x0000000000C90000-0x00000000018BE000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2288-224-0x00000000001C0000-0x0000000000663000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2496-158-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  • memory/2524-280-0x00000000003D0000-0x0000000000A50000-memory.dmp

                    Filesize

                    6.5MB

                    Download

                  • memory/2532-48-0x00000000008B0000-0x0000000000BD0000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2532-53-0x00000000008B0000-0x0000000000BD0000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2544-172-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2544-168-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-166-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-164-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-175-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-162-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-173-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2544-170-0x0000000000400000-0x0000000000465000-memory.dmp

                    Filesize

                    404KB

                    Download

                  • memory/2584-514-0x0000000000AB0000-0x0000000000B20000-memory.dmp

                    Filesize

                    448KB

                    Download

                  • memory/2668-263-0x0000000000C20000-0x0000000000F36000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2736-156-0x0000000001180000-0x00000000011F8000-memory.dmp

                    Filesize

                    480KB

                    Download

                  • memory/2912-72-0x0000000006A40000-0x000000000743C000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2912-46-0x0000000006420000-0x0000000006740000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2912-240-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-118-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-111-0x0000000006A40000-0x000000000766E000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2912-282-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-113-0x0000000006A40000-0x000000000766E000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2912-94-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-84-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-644-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-79-0x0000000006A40000-0x000000000743C000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2912-20-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-24-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-76-0x0000000006A40000-0x000000000743C000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2912-23-0x0000000000C41000-0x0000000000C6F000-memory.dmp

                    Filesize

                    184KB

                    Download

                  • memory/2912-26-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-462-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-75-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-137-0x0000000006A40000-0x000000000766E000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2912-27-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-138-0x0000000006A40000-0x000000000766E000-memory.dmp

                    Filesize

                    12.2MB

                    Download

                  • memory/2912-28-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-29-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-30-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-47-0x0000000006420000-0x0000000006740000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2912-133-0x0000000006A40000-0x0000000006EE3000-memory.dmp

                    Filesize

                    4.6MB

                    Download

                  • memory/2912-564-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-54-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-553-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-535-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-74-0x0000000006A40000-0x000000000743C000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2912-541-0x0000000000C40000-0x00000000010EE000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2912-56-0x0000000006420000-0x0000000006740000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2912-55-0x0000000006420000-0x0000000006740000-memory.dmp

                    Filesize

                    3.1MB

                    Download

                  • memory/2936-528-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-529-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-521-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-523-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-525-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-527-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2936-519-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2936-517-0x0000000000400000-0x0000000000466000-memory.dmp

                    Filesize

                    408KB

                    Download

                  • memory/2980-460-0x0000000000340000-0x00000000005F8000-memory.dmp

                    Filesize

                    2.7MB

                    Download

                  • memory/2980-461-0x0000000000340000-0x00000000005F8000-memory.dmp

                    Filesize

                    2.7MB

                    Download

                  • memory/2988-73-0x00000000003E0000-0x0000000000DDC000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2988-77-0x00000000003E0000-0x0000000000DDC000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2988-78-0x00000000003E0000-0x0000000000DDC000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/2988-83-0x00000000003E0000-0x0000000000DDC000-memory.dmp

                    Filesize

                    10.0MB

                    Download

                  • memory/3480-637-0x0000000000210000-0x0000000000275000-memory.dmp

                    Filesize

                    404KB

                    Download