hxxps://mega[.]nz/file/X540kZBK#iWjVoF3uGxf9todi9Ps3GKTllW3c6uKfPMnVrutJH7g

Analysis

max time kernel
345s
max time network
346s
platform
windows7_x64
resource
win7-en-20211014
submitted
25-11-2021 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/X540kZBK#iWjVoF3uGxf9todi9Ps3GKTllW3c6uKfPMnVrutJH7g

Score

8^/10

agilenet persistence pyinstaller

Malware Config

Signatures

Executes dropped EXE 49 IoCs

Processes:

COMBO EDITOR PRO.execombo_splitter.execombo_splitter.exeFindMyHash.exe._cache_FindMyHash.exeSynaptics.exeDork Searcher Cr7.exe._cache_Dork Searcher Cr7.exeIP Vanish Proxy Tool.exeMailAcess Checker by xRisky.exeMiniMailViewer.exeOpenBullet.exeUnfx Proxy Checker.exeUnfx Proxy Checker.exeUnfx Proxy Checker.exeSylas Spotify Checker.exeWoxy 3.0 [Crack.sx].exe1337 SteamACC Stealer Private.exe._cache_1337 SteamACC Stealer Private.exeLauncher.exe._cache_Launcher.exebin.exe._cache_bin.exeVulnerability Scanner 6.0.exe._cache_Vulnerability Scanner 6.0.exeLauncher.exe._cache_Launcher.exelib.exe._cache_lib.exe2008_11_24_01_webvulnscan6.exeis-RHMA6.tmpAdminPage.exe._cache_AdminPage.exeLauncher.exe._cache_Launcher.exelib.exe._cache_lib.exeAdvanced IP Scanner.exe._cache_Advanced IP Scanner.exeLauncher.exe._cache_Launcher.exelib.exe._cache_lib.exeAllround Stealer - Builder_1.exe._cache_Allround Stealer - Builder_1.exeLauncher.exe._cache_Launcher.exelib.exe._cache_lib.exe

pid	process
1704	COMBO EDITOR PRO.exe
1220	combo_splitter.exe
2072	combo_splitter.exe
2932	FindMyHash.exe
2980	._cache_FindMyHash.exe
2940	Synaptics.exe
2100	Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
2264	IP Vanish Proxy Tool.exe
1456	MailAcess Checker by xRisky.exe
2644	MiniMailViewer.exe
3000	OpenBullet.exe
3060	Unfx Proxy Checker.exe
2224	Unfx Proxy Checker.exe
1644	Unfx Proxy Checker.exe
2816	Sylas Spotify Checker.exe
2924	Woxy 3.0 [Crack.sx].exe
1660	1337 SteamACC Stealer Private.exe
2320	._cache_1337 SteamACC Stealer Private.exe
2676	Launcher.exe
2456	._cache_Launcher.exe
2300	bin.exe
2368	._cache_bin.exe
3048	Vulnerability Scanner 6.0.exe
2224	._cache_Vulnerability Scanner 6.0.exe
2780	Launcher.exe
1408	._cache_Launcher.exe
612	lib.exe
1084	._cache_lib.exe
2880	2008_11_24_01_webvulnscan6.exe
972	is-RHMA6.tmp
936	AdminPage.exe
2860	._cache_AdminPage.exe
1060	Launcher.exe
1292	._cache_Launcher.exe
2548	lib.exe
552	._cache_lib.exe
2704	Advanced IP Scanner.exe
1420	._cache_Advanced IP Scanner.exe
3044	Launcher.exe
2640	._cache_Launcher.exe
2740	lib.exe
2524	._cache_lib.exe
2784	Allround Stealer - Builder_1.exe
2576	._cache_Allround Stealer - Builder_1.exe
1588	Launcher.exe
636	._cache_Launcher.exe
2100	lib.exe
1956	._cache_lib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Unfx Proxy Checker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Control Panel\International\Geo\Nation	Unfx Proxy Checker.exe

Loads dropped DLL 64 IoCs

Processes:

COMBO EDITOR PRO.execombo_splitter.exeFindMyHash.exeSynaptics.exe

pid	process
1704	COMBO EDITOR PRO.exe
1704	COMBO EDITOR PRO.exe
1704	COMBO EDITOR PRO.exe
1704	COMBO EDITOR PRO.exe
1300
1300
1300
1300
1300
1300
1300
1216
2072	combo_splitter.exe
2932	FindMyHash.exe
2932	FindMyHash.exe
2932	FindMyHash.exe
2932	FindMyHash.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe
2940	Synaptics.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/660-126-0x0000000013290000-0x00000000162E7000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

FindMyHash.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	FindMyHash.exe

Drops desktop.ini file(s) 38 IoCs

Processes:

7zG.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Firefox Password Stealer - Steamcafe\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\data\breez.smk\Desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\data\Desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\SimpleStealer 2.1\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Steam Stealer by till7\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\data\breez.smk\Desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\SQLIHelperV.2.5\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Steam Stealer by till7\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\In Shadow Batch Virus Gen - 5.0.0 - MOD\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\SQL_Exploiter_Pro_2.15\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Firefox Password Stealer - Steamcafe\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Hackbase Steam Phisher 1.2 BETA\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\Desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\SQLIHelperV.2.5\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Cain & Abel SNIFFER Self Installer [WinXP]\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Fudsonly Stealer 0.1\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\breez.smk\Desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\SQL_Injection_Tool_v2.1a\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Cain & Abel SNIFFER Self Installer [WinXP]\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\data\Desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Multi Password Stealer 1.6\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Multi Password Stealer 1.6\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\SQL_Injection_Tool_v2.1a\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\Virus Total\desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\Fudsonly Stealer 0.1\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\SimpleStealer 2.1\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\Hackbase Steam Phisher 1.2 BETA\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\In Shadow Batch Virus Gen - 5.0.0 - MOD\Virus Total\desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\breez.smk\Desktop.ini	7zG.exe
File opened for modification	C:\Users\Admin\Downloads\Everything\Hacking Software\MoHackz SQL Exploit Scanner\Desktop.ini	7zG.exe
File created	C:\Users\Admin\Downloads\Everything\Hacking Software\SQL_Exploiter_Pro_2.15\Virus Total\desktop.ini	7zG.exe

Drops file in System32 directory 1 IoCs

Processes:

is-RHMA6.tmp

description ioc process

File created C:\Windows\SysWOW64\ptlx55.dat.{5728B11F-B697-47AA-9C1B-8ECB545B5193} is-RHMA6.tmp
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

Sylas Spotify Checker.exe

pid process

2816 Sylas Spotify Checker.exe
2816 Sylas Spotify Checker.exe
2816 Sylas Spotify Checker.exe
Drops file in Windows directory 1 IoCs

Processes:

is-RHMA6.tmp

description ioc process

File created C:\Windows\WVS_InstDBLogFile.csv is-RHMA6.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\ptlx55.dat.{5728B11F-B697-47AA-9C1B-8ECB545B5193}	is-RHMA6.tmp

pid	process
2816	Sylas Spotify Checker.exe
2816	Sylas Spotify Checker.exe
2816	Sylas Spotify Checker.exe

description	ioc	process
File created	C:\Windows\WVS_InstDBLogFile.csv	is-RHMA6.tmp

Detects Pyinstaller 11 IoCs

pyinstaller

Processes:

resource	yara_rule
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exeEXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE

Modifies registry class 64 IoCs

Processes:

EXCEL.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	EXCEL.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	EXCEL.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	EXCEL.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	EXCEL.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	EXCEL.EXE

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Unfx Proxy Checker.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Unfx Proxy Checker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unfx Proxy Checker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unfx Proxy Checker.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Unfx Proxy Checker.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

2220 EXCEL.EXE

pid	process
2220	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exe._cache_Dork Searcher Cr7.exeUnfx Proxy Checker.exe

pid	process
728	chrome.exe
1088	chrome.exe
1088	chrome.exe
2232	chrome.exe
2656	chrome.exe
2756	chrome.exe
2900	chrome.exe
3052	chrome.exe
2164	chrome.exe
1088	chrome.exe
1088	chrome.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
660	._cache_Dork Searcher Cr7.exe
1644	Unfx Proxy Checker.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

7zG.exeAUDIODG.EXE7zG.exe._cache_Dork Searcher Cr7.exe7zG.exeOpenBullet.exeMailAcess Checker by xRisky.exeWoxy 3.0 [Crack.sx].exe

description	pid	process
Token: SeRestorePrivilege	2356	7zG.exe
Token: 35	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: SeSecurityPrivilege	2356	7zG.exe
Token: 33	2128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2128	AUDIODG.EXE
Token: 33	2128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2128	AUDIODG.EXE
Token: SeRestorePrivilege	2700	7zG.exe
Token: 35	2700	7zG.exe
Token: SeSecurityPrivilege	2700	7zG.exe
Token: SeSecurityPrivilege	2700	7zG.exe
Token: SeDebugPrivilege	660	._cache_Dork Searcher Cr7.exe
Token: SeRestorePrivilege	556	7zG.exe
Token: 35	556	7zG.exe
Token: SeSecurityPrivilege	556	7zG.exe
Token: SeSecurityPrivilege	556	7zG.exe
Token: SeDebugPrivilege	3000	OpenBullet.exe
Token: SeDebugPrivilege	1456	MailAcess Checker by xRisky.exe
Token: SeDebugPrivilege	2924	Woxy 3.0 [Crack.sx].exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exe7zG.exe7zG.exe._cache_Launcher.exe

pid	process
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
2356	7zG.exe
2700	7zG.exe
556	7zG.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe
1408	._cache_Launcher.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

chrome.exe

pid	process
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe
1088	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

EXCEL.EXESylas Spotify Checker.exe._cache_bin.exe._cache_lib.exe

pid process

2220 EXCEL.EXE
2816 Sylas Spotify Checker.exe
2368 ._cache_bin.exe
1956 ._cache_lib.exe

pid	process
2220	EXCEL.EXE
2816	Sylas Spotify Checker.exe
2368	._cache_bin.exe
1956	._cache_lib.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 1088 wrote to memory of 268	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 268	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 268	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1456	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 728	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 728	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 728	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe
PID 1088 wrote to memory of 1672	1088	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" https://mega.nz/file/X540kZBK#iWjVoF3uGxf9todi9Ps3GKTllW3c6uKfPMnVrutJH7g
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb5c4f50,0x7fefb5c4f60,0x7fefb5c4f70
2⤵
PID:268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1124 /prefetch:2
2⤵
PID:1456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1252 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1648 /prefetch:8
2⤵
PID:1672

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
2⤵
PID:1912

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
2⤵
PID:1148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:1932

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2736 /prefetch:2
2⤵
PID:1892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3696 /prefetch:8
2⤵
PID:2080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:8
2⤵
PID:2152

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4056 /prefetch:8
2⤵
PID:2188

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4056 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3504 /prefetch:8
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
2⤵
PID:2248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3360 /prefetch:8
2⤵
PID:2348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4112 /prefetch:8
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4108 /prefetch:8
2⤵
PID:2420

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:8
2⤵
PID:2428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
2⤵
PID:2496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1
2⤵
PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3804 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=784 /prefetch:8
2⤵
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=544 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:8
2⤵
PID:2864

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
2⤵
PID:2940

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 /prefetch:8
2⤵
PID:3012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2752 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1116,9081073488767282451,11109167572156833747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2164

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x560
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Everything\" -spe -an -ai#7zMap7399:82:7zEvent17705
1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2356

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Everything\Combo things\*\" -spe -an -ai#7zMap11379:1128:7zEvent30880
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2700

C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\COMBO EDITOR PRO.exe
"C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\COMBO EDITOR PRO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704

C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
"C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe"
1⤵
- Executes dropped EXE
PID:1220

C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
"C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072

C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\FindMyHash.exe
"C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\FindMyHash.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:2932

C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\._cache_FindMyHash.exe
"C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\._cache_FindMyHash.exe"
2⤵
- Executes dropped EXE
PID:2980

C:\ProgramData\Synaptics\Synaptics.exe
"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2220

C:\Users\Admin\Downloads\Everything\Combo things\SearcherV2\searcher\Dork Searcher Cr7.exe
"C:\Users\Admin\Downloads\Everything\Combo things\SearcherV2\searcher\Dork Searcher Cr7.exe"
1⤵
- Executes dropped EXE
PID:2100

C:\Users\Admin\Downloads\Everything\Combo things\SearcherV2\searcher\._cache_Dork Searcher Cr7.exe
"C:\Users\Admin\Downloads\Everything\Combo things\SearcherV2\searcher\._cache_Dork Searcher Cr7.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:660

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2584

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Everything\Crack things\*\" -spe -an -ai#7zMap1833:944:7zEvent21123
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:556

C:\Users\Admin\Downloads\Everything\Crack things\IP Vanish Proxy Tool\IP Vanish Proxy Tool.exe
"C:\Users\Admin\Downloads\Everything\Crack things\IP Vanish Proxy Tool\IP Vanish Proxy Tool.exe"
1⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\Downloads\Everything\Crack things\MailAcess Checker\MailAcess Checker by xRisky.exe
"C:\Users\Admin\Downloads\Everything\Crack things\MailAcess Checker\MailAcess Checker by xRisky.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Users\Admin\Downloads\Everything\Crack things\mini\MiniMailViewer.exe
"C:\Users\Admin\Downloads\Everything\Crack things\mini\MiniMailViewer.exe"
1⤵
- Executes dropped EXE
PID:2644

C:\Users\Admin\Downloads\Everything\Crack things\Openbullet 1.4.4\OpenBullet.exe
"C:\Users\Admin\Downloads\Everything\Crack things\Openbullet 1.4.4\OpenBullet.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe
"C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3060

C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe
"C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe" --type=gpu-process --field-trial-handle=1168,10534322359539898768,15762486187449265448,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAAAgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --service-request-channel-token=8691499899113865847 --mojo-platform-channel-handle=1184 --ignored=" --type=renderer " /prefetch:2
2⤵
- Executes dropped EXE
PID:2224

C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe
"C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\Unfx Proxy Checker.exe" --type=renderer --field-trial-handle=1168,10534322359539898768,15762486187449265448,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\Downloads\Everything\Crack things\Proxy Checker\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=1389205873344584688 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1628 /prefetch:1
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:1644

C:\Users\Admin\Downloads\Everything\Crack things\Spotify Checker\Sylas Spotify Checker.exe
"C:\Users\Admin\Downloads\Everything\Crack things\Spotify Checker\Sylas Spotify Checker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2816

C:\Users\Admin\Downloads\Everything\Crack things\Woxy 3.0\Woxy 3.0 [Crack.sx].exe
"C:\Users\Admin\Downloads\Everything\Crack things\Woxy 3.0\Woxy 3.0 [Crack.sx].exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\1337 SteamACC Stealer Private.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\1337 SteamACC Stealer Private.exe"
1⤵
- Executes dropped EXE
PID:1660

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_1337 SteamACC Stealer Private.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_1337 SteamACC Stealer Private.exe"
2⤵
- Executes dropped EXE
PID:2320

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\data\Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\data\Launcher.exe"
3⤵
- Executes dropped EXE
PID:2676

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_Launcher.exe"
4⤵
- Executes dropped EXE
PID:2456

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\data\bin.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\data\bin.exe"
3⤵
- Executes dropped EXE
PID:2300

C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_bin.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\1337 SteamACC Stealer Private\._cache_bin.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2368

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\Vulnerability Scanner 6.0.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\Vulnerability Scanner 6.0.exe"
1⤵
- Executes dropped EXE
PID:3048

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_Vulnerability Scanner 6.0.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_Vulnerability Scanner 6.0.exe"
2⤵
- Executes dropped EXE
PID:2224

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\data\Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\data\Launcher.exe"
3⤵
- Executes dropped EXE
PID:2780

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_Launcher.exe"
4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1408

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\data\lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\data\lib.exe"
3⤵
- Executes dropped EXE
PID:612

C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Acunetix Web Vulnerability Scanner Enterprise Edition v6.0-EDGE\._cache_lib.exe"
4⤵
- Executes dropped EXE
PID:1084

C:\Users\Admin\AppData\Local\Temp\7zS9702.tmp\2008_11_24_01_webvulnscan6.exe
.\2008_11_24_01_webvulnscan6.exe
5⤵
- Executes dropped EXE
PID:2880

C:\Users\Admin\AppData\Local\Temp\is-72DKO.tmp\is-RHMA6.tmp
"C:\Users\Admin\AppData\Local\Temp\is-72DKO.tmp\is-RHMA6.tmp" /SL4 $B0466 C:\Users\Admin\AppData\Local\Temp\7zS9702.tmp\2008_11_24_01_webvulnscan6.exe 59415110 69120
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:972

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\AdminPage.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\AdminPage.exe"
1⤵
- Executes dropped EXE
PID:936

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_AdminPage.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_AdminPage.exe"
2⤵
- Executes dropped EXE
PID:2860

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\data\Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\data\Launcher.exe"
3⤵
- Executes dropped EXE
PID:1060

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_Launcher.exe"
4⤵
- Executes dropped EXE
PID:1292

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\data\lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\data\lib.exe"
3⤵
- Executes dropped EXE
PID:2548

C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Admin Finder PREMIUM\._cache_lib.exe"
4⤵
- Executes dropped EXE
PID:552

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\Advanced IP Scanner.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\Advanced IP Scanner.exe"
1⤵
- Executes dropped EXE
PID:2704

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_Advanced IP Scanner.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_Advanced IP Scanner.exe"
2⤵
- Executes dropped EXE
PID:1420

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\data\Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\data\Launcher.exe"
3⤵
- Executes dropped EXE
PID:3044

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_Launcher.exe"
4⤵
- Executes dropped EXE
PID:2640

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\data\lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\data\lib.exe"
3⤵
- Executes dropped EXE
PID:2740

C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Advanced IP Scanner\._cache_lib.exe"
4⤵
- Executes dropped EXE
PID:2524

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\Allround Stealer - Builder_1.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\Allround Stealer - Builder_1.exe"
1⤵
- Executes dropped EXE
PID:2784

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_Allround Stealer - Builder_1.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_Allround Stealer - Builder_1.exe"
2⤵
- Executes dropped EXE
PID:2576

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\data\Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\data\Launcher.exe"
3⤵
- Executes dropped EXE
PID:1588

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_Launcher.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_Launcher.exe"
4⤵
- Executes dropped EXE
PID:636

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\data\lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\data\lib.exe"
3⤵
- Executes dropped EXE
PID:2100

C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_lib.exe
"C:\Users\Admin\Downloads\Everything\Hacking Software\Allround Stealer\._cache_lib.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI12202\python39.dll
MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit
C:\Users\Admin\Downloads\Everything.rar
MD5
8cad7124ce54618fdf5494fa7aba938f

SHA1
db223a64889880caf5d639959fa681db32c9490b

SHA256
059871ea426b2cedc55432d734d9a803cf761f9e57d1f33a0dbfaecdff9606a1

SHA512
127c8d227836dd4cb6fa534c39dd93a4eff5ab334a6fbd2e266c3442d91d9534761eea85ebd940e3687dcb4d3d5101d014dbe3a8b188bf4e1299242f0b53f996

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\AntiPublic.rar
MD5
10a784593e7a80776af880e3ec5f5661

SHA1
b56b88375e83ee57edc96cc28cec7210b51f8b34

SHA256
67cb5f71d6a4dd7a3904e6d3f4421e4ef25be44a8523d372fc804bf89ecc376e

SHA512
1d40b181f271ebe346a81cd7d35f0d36fe7777357e5008f7fee1709fef955962acd8e4552e64ceaa5140d61d6878517013844aa599ad7c96bf2fc37d8e0c00ba

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro.rar
MD5
8cd5203fd1c0a5f7d2121d23289a3a8a

SHA1
c29c02f1aa894d61bc64f1ea5e5568be3f41b87c

SHA256
6ec15dcd5c2dba08b105d14395ee8676276430b3be0511efe8414649efb5edb0

SHA512
551c4a9405434d9ee82c60f62b9ef589775a5739a89b48c0ff20bc5def0239c37ecc3b15b0d2e55e5d7d385435c91b95860f4b02be24c936d68f2b2b5525f855

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\COMBO EDITOR PRO.exe
MD5
3abc499e9d280e0f8c80b1caf2782ee7

SHA1
6313ba4865e2b07346f33350bf7c644e1b7f51b6

SHA256
3484aaaa11e0f622905ea5990bdc74a02c9905b234108fb91e3c92f96b7c7c7b

SHA512
bb941ad8027692a54510a285c8eb34231da070c795001d411901704eb28aab193eb56e5729beb0be3764ff77ec96949f1376f2ac3a157d6b9d9c9c624cb0fd57

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\COMBO EDITOR PRO.exe
MD5
3abc499e9d280e0f8c80b1caf2782ee7

SHA1
6313ba4865e2b07346f33350bf7c644e1b7f51b6

SHA256
3484aaaa11e0f622905ea5990bdc74a02c9905b234108fb91e3c92f96b7c7c7b

SHA512
bb941ad8027692a54510a285c8eb34231da070c795001d411901704eb28aab193eb56e5729beb0be3764ff77ec96949f1376f2ac3a157d6b9d9c9c624cb0fd57

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\FontAwesome.Sharp.dll
MD5
dc2cb895f53ed67bef96729252bffc53

SHA1
bce244437720fa1e1ff58033da1e6961708d05bd

SHA256
17ef17eb5b916bc6e9530a3cfa3483117eec7ea18de142de78eebd131ee5a84d

SHA512
206a53908206f5598f4fc7807ef6ea8413c5a5f7b2e5557f5e95a302f6cd483dfdee38db1697b1b52a3ea9a0eb7809c7cf798793a832fd727e23a88286be200f

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\Guna.UI.dll
MD5
6d6a1f28978d42ad2f0a8f278eaac966

SHA1
b09168ec88109422ca29cf4f1b6462d51930873d

SHA256
fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e

SHA512
76ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter.rar
MD5
ec8779666018ae9366e069e44c0dd778

SHA1
73d1aac9c48ba60b7ee070c4ffebce3cfa6d11f4

SHA256
9043d25dc7d2b221d59940ca8fa6304003a39d0f88da5bfa2e10f88c37992caf

SHA512
43f3e25c2700d1ebcf95f942653dcf7d74304b6efc0505940af64237c549fea50724de5d4be1cfefdf8b6897306d7d9227a532e5685e5351fd9cb2a9ba397f6b

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash.rar
MD5
10489a41629aafdb4632c26e14dda898

SHA1
b464d4ab2562f28a85b7300775f2ebf223e00ef1

SHA256
de1c8a551117b5d6c6ffcad34d1eec0b94adfe460cd2631fa2099376a1db9cdb

SHA512
304aec1a263a9d0b3b453f77716d91103c91f7a556ed52effbc40d007d7ccd4b04bdd147f05b48f2398b385dc4905065cb6d9e48332da45f4319a1f1284e4e9a

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\._cache_FindMyHash.exe
MD5
fa963e124a0a465812cb2030952d53bb

SHA1
4d871fdb0e8a8609fb53a8390e8bd29d49650f09

SHA256
eb8bff16823e6bb79e91db9fb98bb7b0ea11a42ea9a50979f3ad0c8d0927934b

SHA512
7e0c01b732529c2adbf68ca07e4f45e42abe0687d8d3e989bb8d25cda8aa2090269d091db55d96ed1cd8ab0036f3efdd29b0e3bbe3ad35618897e1afaa0a4889

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\._cache_FindMyHash.exe
MD5
fa963e124a0a465812cb2030952d53bb

SHA1
4d871fdb0e8a8609fb53a8390e8bd29d49650f09

SHA256
eb8bff16823e6bb79e91db9fb98bb7b0ea11a42ea9a50979f3ad0c8d0927934b

SHA512
7e0c01b732529c2adbf68ca07e4f45e42abe0687d8d3e989bb8d25cda8aa2090269d091db55d96ed1cd8ab0036f3efdd29b0e3bbe3ad35618897e1afaa0a4889

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\FindMyHash.exe
MD5
277c6f4eadeedde75685e12d9373fd19

SHA1
cc15895eaf42b55e07ab95b72dd6784488d283f8

SHA256
9779b91900ea27c606f7e9272ddb36d1da24c19d4274841c39e3583256202cd9

SHA512
4e528b02a196575bef88f2165dabbccf4c5289072142868b427c9e2a6730f6cfcadf928ccf52cd565eab0fe789cb40f155907eae6e899f560d5e4d5e01a3b968

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\FindMyHash\FindMyHash.exe
MD5
277c6f4eadeedde75685e12d9373fd19

SHA1
cc15895eaf42b55e07ab95b72dd6784488d283f8

SHA256
9779b91900ea27c606f7e9272ddb36d1da24c19d4274841c39e3583256202cd9

SHA512
4e528b02a196575bef88f2165dabbccf4c5289072142868b427c9e2a6730f6cfcadf928ccf52cd565eab0fe789cb40f155907eae6e899f560d5e4d5e01a3b968

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\SearcherV2.rar
MD5
f2150e837f0b5f03180fe1ecd2b0f31b

SHA1
1be2c3394de844bdfb8b02d1877b1d8d1e9e99d4

SHA256
d62686c6775fb71fe8d75ac5bd881a14ac74aa8c17ddfb8ce7c5028acbfb075b

SHA512
9565002f5844282c4ee905f4977d5fb7aa3370cfca20cc4248b7f07b7d4106bd605a3e855dc73646ef1ad130bcccfe176e23ac5d6f0aada7f3dfe020057b169a

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\TextUtils.rar
MD5
8a21834fbb9b1c75d12d443aef7fd590

SHA1
9796064ba12d9cb9611e9aac4445dd5841272006

SHA256
0f4f411ec72ce321833d79a5ff69c0618c12e99222e0776354bf84e4ba95d95d

SHA512
20039f7ac6472c9584bc1843b6c28c32ef275de9ceb67f86f24e5721cad53a4f3231dbb05968c880e0eeda51a8dcbd71ffe3b464e6d1c1198e94bf69e8d1e877

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\Work With Dorks [DORK's Generator] By JohnDoe v.2.1.rar
MD5
a25a98bd27e3e16ba20696fcad2c350d

SHA1
964f74a53564ffabe1dc319b28ac6cafb3f6ba9e

SHA256
35b97050af16ce00ccbfd0b68a2eb505f8af8f6248799cd5b296e94814e6fb92

SHA512
94141c41b526bf9b19a14898aa15b4855436d7d1e2f0d88d7c169a7884c675d767218fb4938954a3ceb3d651c27c82398d2dfae13304e4b50b0e61291347a69d

Download Submit
C:\Users\Admin\Downloads\Everything\Combo things\sqli dumper.rar
MD5
f8b3958c0cf8c93eef6840bdd668d3dd

SHA1
893020962aff209494600bc17f48431be90c5854

SHA256
a91276218da2b5386870e3dae7d855a322ac21a08ba576a57456108a523871f2

SHA512
b999c6729d07dc322e3c50c290bf20b8d6f359868f4ed9e0f58ae08175489aa6a31cd48e68304b7f6fb8a76ee482fb3ef3a75c760d2a3e56caebf2bec852fcca

Download Submit
\??\pipe\crashpad_1088_IJEQBVUJLMEWBVJP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\ProgramData\Synaptics\Synaptics.exe
MD5
953e3bc9c4c5a9bd692e5f84ca18ab36

SHA1
f5c43ee557391f077ba9289b43b274d3fd850526

SHA256
de6c11367c2970afac43048c1290921fe290d7e27ab5d9f64b5ec5681a5e727e

SHA512
28c0c484263305821c23b0d232784e9b7ba70f6c9d34fff757d81ef56a29f65758c376b49289b0c48fa65ba178d17df7016d3a0a73d483fcd2a6fa859883b480

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI12202\python39.dll
MD5
5cd203d356a77646856341a0c9135fc6

SHA1
a1f4ac5cc2f5ecb075b3d0129e620784814a48f7

SHA256
a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a

SHA512
390008d57fa711d7c88b77937bf16fdb230e7c1e7182faea6d7c206e9f65ced6f2e835f9da9befb941e80624abe45875602e0e7ad485d9a009d2450a2a0e0f1f

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\FontAwesome.Sharp.dll
MD5
dc2cb895f53ed67bef96729252bffc53

SHA1
bce244437720fa1e1ff58033da1e6961708d05bd

SHA256
17ef17eb5b916bc6e9530a3cfa3483117eec7ea18de142de78eebd131ee5a84d

SHA512
206a53908206f5598f4fc7807ef6ea8413c5a5f7b2e5557f5e95a302f6cd483dfdee38db1697b1b52a3ea9a0eb7809c7cf798793a832fd727e23a88286be200f

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\FontAwesome.Sharp.dll
MD5
dc2cb895f53ed67bef96729252bffc53

SHA1
bce244437720fa1e1ff58033da1e6961708d05bd

SHA256
17ef17eb5b916bc6e9530a3cfa3483117eec7ea18de142de78eebd131ee5a84d

SHA512
206a53908206f5598f4fc7807ef6ea8413c5a5f7b2e5557f5e95a302f6cd483dfdee38db1697b1b52a3ea9a0eb7809c7cf798793a832fd727e23a88286be200f

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\Guna.UI.dll
MD5
6d6a1f28978d42ad2f0a8f278eaac966

SHA1
b09168ec88109422ca29cf4f1b6462d51930873d

SHA256
fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e

SHA512
76ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Editor pro\Guna.UI.dll
MD5
6d6a1f28978d42ad2f0a8f278eaac966

SHA1
b09168ec88109422ca29cf4f1b6462d51930873d

SHA256
fb23fa4fca8f28bebe7b7e39593a211cd3c3405de5f948ec520e859b1bcaf91e

SHA512
76ddf88255a9355fc3c781880e23d94206acca4decf5623712411f7a733e91ca9ea37944860401cf9667f10e8c33a087803a4726f91faff1f23e3e0592ddf41d

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\Combo Splitter\combo_splitter.exe
MD5
7137289f6ffbd6f2c0426a3f8da234e2

SHA1
5c860e27f865893c7db89d1bc00fbfef2a257661

SHA256
d946b820f93a265a243c9ccf46d3cfc9113c0e89754649e135f7aed4ea229443

SHA512
a280fe45d5c9de83704f217dbac81f04d4f4b9a3c7436b49d5cf4eccb20c05607c178b740925a32d8b6c0a6847392e976c445dbad03ac294c408b091126d4e77

Download Submit
\Users\Admin\Downloads\Everything\Combo things\FindMyHash\._cache_FindMyHash.exe
MD5
fa963e124a0a465812cb2030952d53bb

SHA1
4d871fdb0e8a8609fb53a8390e8bd29d49650f09

SHA256
eb8bff16823e6bb79e91db9fb98bb7b0ea11a42ea9a50979f3ad0c8d0927934b

SHA512
7e0c01b732529c2adbf68ca07e4f45e42abe0687d8d3e989bb8d25cda8aa2090269d091db55d96ed1cd8ab0036f3efdd29b0e3bbe3ad35618897e1afaa0a4889

Download Submit
\Users\Admin\Downloads\Everything\Combo things\FindMyHash\FindMyHash.exe
MD5
277c6f4eadeedde75685e12d9373fd19

SHA1
cc15895eaf42b55e07ab95b72dd6784488d283f8

SHA256
9779b91900ea27c606f7e9272ddb36d1da24c19d4274841c39e3583256202cd9

SHA512
4e528b02a196575bef88f2165dabbccf4c5289072142868b427c9e2a6730f6cfcadf928ccf52cd565eab0fe789cb40f155907eae6e899f560d5e4d5e01a3b968

Download Submit
memory/552-293-0x0000000002000000-0x0000000002002000-memory.dmp

Filesize
8KB

Download
memory/552-290-0x0000000000000000-mapping.dmp

Download
memory/552-294-0x0000000002006000-0x0000000002025000-memory.dmp

Filesize
124KB

Download
memory/612-258-0x0000000000000000-mapping.dmp

Download
memory/612-264-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/636-334-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/636-335-0x0000000001085000-0x0000000001096000-memory.dmp

Filesize
68KB

Download
memory/636-324-0x0000000000000000-mapping.dmp

Download
memory/660-129-0x00000000048C0000-0x00000000048C1000-memory.dmp

Filesize
4KB

Download
memory/660-124-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/660-123-0x0000000000000000-mapping.dmp

Download
memory/660-133-0x00000000075B7000-0x00000000075B8000-memory.dmp

Filesize
4KB

Download
memory/660-134-0x00000000075B8000-0x00000000075B9000-memory.dmp

Filesize
4KB

Download
memory/660-132-0x00000000075A6000-0x00000000075B7000-memory.dmp

Filesize
68KB

Download
memory/660-126-0x0000000013290000-0x00000000162E7000-memory.dmp

Filesize
48.3MB

Download
memory/660-130-0x00000000075A0000-0x00000000075A1000-memory.dmp

Filesize
4KB

Download
memory/660-127-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/660-131-0x00000000075A1000-0x00000000075A2000-memory.dmp

Filesize
4KB

Download
memory/936-283-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/972-272-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/972-268-0x0000000000000000-mapping.dmp

Download
memory/1060-286-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1060-277-0x0000000000000000-mapping.dmp

Download
memory/1084-260-0x0000000000000000-mapping.dmp

Download
memory/1292-279-0x0000000000000000-mapping.dmp

Download
memory/1292-287-0x0000000000505000-0x0000000000516000-memory.dmp

Filesize
68KB

Download
memory/1292-284-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/1408-251-0x0000000000000000-mapping.dmp

Download
memory/1408-262-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/1408-263-0x00000000025F5000-0x0000000002606000-memory.dmp

Filesize
68KB

Download
memory/1420-303-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Filesize
4KB

Download
memory/1420-296-0x0000000000000000-mapping.dmp

Download
memory/1456-146-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/1456-147-0x0000000004E40000-0x0000000004E41000-memory.dmp

Filesize
4KB

Download
memory/1456-148-0x0000000004E45000-0x0000000004E56000-memory.dmp

Filesize
68KB

Download
memory/1456-145-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/1456-144-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download
memory/1456-142-0x0000000001360000-0x0000000001361000-memory.dmp

Filesize
4KB

Download
memory/1588-325-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1588-320-0x0000000000000000-mapping.dmp

Download
memory/1644-195-0x0000000000000000-mapping.dmp

Download
memory/1660-234-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1704-93-0x00000000005B1000-0x00000000005B2000-memory.dmp

Filesize
4KB

Download
memory/1704-98-0x00000000005B6000-0x00000000005C7000-memory.dmp

Filesize
68KB

Download
memory/1704-80-0x00000000072A0000-0x00000000072A1000-memory.dmp

Filesize
4KB

Download
memory/1704-69-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1704-82-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/1704-71-0x00000000007F0000-0x0000000000827000-memory.dmp

Filesize
220KB

Download
memory/1704-75-0x00000000070E0000-0x00000000070E1000-memory.dmp

Filesize
4KB

Download
memory/1704-76-0x0000000002030000-0x000000000206D000-memory.dmp

Filesize
244KB

Download
memory/1704-99-0x00000000005C7000-0x00000000005C8000-memory.dmp

Filesize
4KB

Download
memory/1956-331-0x0000000000000000-mapping.dmp

Download
memory/2072-94-0x0000000000000000-mapping.dmp

Download
memory/2100-122-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2100-329-0x0000000000000000-mapping.dmp

Download
memory/2100-336-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2220-118-0x000000002FE71000-0x000000002FE74000-memory.dmp

Filesize
12KB

Download
memory/2220-121-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2220-119-0x000000006D8B1000-0x000000006D8B3000-memory.dmp

Filesize
8KB

Download
memory/2224-182-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-180-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-246-0x0000000000000000-mapping.dmp

Download
memory/2224-254-0x0000000004F10000-0x0000000004F11000-memory.dmp

Filesize
4KB

Download
memory/2224-174-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2224-177-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-178-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-192-0x0000000000000000-mapping.dmp

Download
memory/2224-185-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-184-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-183-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-179-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2224-181-0x0000000000073000-0x0000000000074000-memory.dmp

Filesize
4KB

Download
memory/2264-141-0x0000000004436000-0x0000000004447000-memory.dmp

Filesize
68KB

Download
memory/2264-139-0x0000000004430000-0x0000000004431000-memory.dmp

Filesize
4KB

Download
memory/2264-140-0x0000000004431000-0x0000000004432000-memory.dmp

Filesize
4KB

Download
memory/2264-136-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/2300-244-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2300-238-0x0000000000000000-mapping.dmp

Download
memory/2320-225-0x0000000000000000-mapping.dmp

Download
memory/2320-235-0x0000000004C40000-0x0000000004C41000-memory.dmp

Filesize
4KB

Download
memory/2356-56-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/2368-240-0x0000000000000000-mapping.dmp

Download
memory/2456-243-0x0000000004935000-0x0000000004946000-memory.dmp

Filesize
68KB

Download
memory/2456-230-0x0000000000000000-mapping.dmp

Download
memory/2456-237-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/2524-312-0x0000000000000000-mapping.dmp

Download
memory/2548-288-0x0000000000000000-mapping.dmp

Download
memory/2548-291-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2576-323-0x00000000048D0000-0x00000000048D1000-memory.dmp

Filesize
4KB

Download
memory/2576-317-0x0000000000000000-mapping.dmp

Download
memory/2640-311-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2640-305-0x0000000000000000-mapping.dmp

Download
memory/2640-313-0x00000000007A5000-0x00000000007B6000-memory.dmp

Filesize
68KB

Download
memory/2644-151-0x0000000004600000-0x00000000046CB000-memory.dmp

Filesize
812KB

Download
memory/2644-155-0x0000000000830000-0x0000000000864000-memory.dmp

Filesize
208KB

Download
memory/2644-156-0x0000000000690000-0x00000000006B2000-memory.dmp

Filesize
136KB

Download
memory/2644-149-0x0000000000B70000-0x0000000000B71000-memory.dmp

Filesize
4KB

Download
memory/2644-152-0x0000000000470000-0x0000000000522000-memory.dmp

Filesize
712KB

Download
memory/2644-154-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2644-169-0x0000000000601000-0x0000000000602000-memory.dmp

Filesize
4KB

Download
memory/2644-171-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/2644-170-0x0000000000606000-0x0000000000617000-memory.dmp

Filesize
68KB

Download
memory/2644-153-0x0000000008410000-0x00000000085A8000-memory.dmp

Filesize
1.6MB

Download
memory/2676-228-0x0000000000000000-mapping.dmp

Download
memory/2676-236-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2704-302-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2740-309-0x0000000000000000-mapping.dmp

Download
memory/2740-315-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2780-255-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2780-249-0x0000000000000000-mapping.dmp

Download
memory/2784-322-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2816-209-0x0000000002FB0000-0x0000000002FB1000-memory.dmp

Filesize
4KB

Download
memory/2860-285-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/2860-274-0x0000000000000000-mapping.dmp

Download
memory/2880-271-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2880-265-0x0000000000000000-mapping.dmp

Download
memory/2924-219-0x0000000004D40000-0x0000000004D41000-memory.dmp

Filesize
4KB

Download
memory/2924-220-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2932-101-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/2932-102-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2940-113-0x0000000000000000-mapping.dmp

Download
memory/2940-116-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2980-117-0x0000000004875000-0x0000000004886000-memory.dmp

Filesize
68KB

Download
memory/2980-106-0x0000000000000000-mapping.dmp

Download
memory/2980-109-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2980-115-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/3000-172-0x00000000012F0000-0x00000000012F1000-memory.dmp

Filesize
4KB

Download
memory/3000-157-0x00000000013C0000-0x00000000013C1000-memory.dmp

Filesize
4KB

Download
memory/3000-163-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/3000-164-0x00000000003C5000-0x00000000003D6000-memory.dmp

Filesize
68KB

Download
memory/3000-161-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/3000-160-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/3000-159-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/3000-165-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/3000-166-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3000-168-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/3000-198-0x00000000003D6000-0x00000000003D7000-memory.dmp

Filesize
4KB

Download
memory/3044-304-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/3044-300-0x0000000000000000-mapping.dmp

Download
memory/3048-252-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/3060-197-0x00000000039B0000-0x00000000039B1000-memory.dmp

Filesize
4KB

Download