b8c3e54d1fe3211eea24de7d7ac23f49c3458420724dd8ceb7e8c1c123e3765e

Analysis

max time kernel
140s
max time network
136s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
09-02-2023 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup Project64 1.6.exe
Size

2.0MB
MD5

eb2d62ed23c4d4486b6649e7b162038a
SHA1

005954395994c0a355c06abae3fc88d10ae84934
SHA256

b8c3e54d1fe3211eea24de7d7ac23f49c3458420724dd8ceb7e8c1c123e3765e
SHA512

4f324a5cd7005213176eb13945f0fcd17c4cd8675ecf76dde70e54d06de6839d0783c99c7dbf66403b1e2e67f099779934207075b4060a90aad3d8ac79434ff5
SSDEEP

49152:bHgGjjjru2mZIem786Btv2KSA8Wt86/fRCUHOZR1lhJQs:LhHgm37BBl2U8WB/JC6OhDJQs

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 24 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	aspack_v212_v242
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	aspack_v212_v242
C:\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	aspack_v212_v242
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll	aspack_v212_v242
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	aspack_v212_v242
C:\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	aspack_v212_v242
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

Project64.exe

pid process

3096 Project64.exe

Loads dropped DLL 24 IoCs

Processes:

Project64.exe

pid	process
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe
3096	Project64.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

bcastdvr.exe

description ioc process

File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini bcastdvr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	bcastdvr.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeMSIEXEC.EXE

description	ioc	process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\F:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Program Files directory 56 IoCs

Processes:

msiexec.exeProject64.exe

description	ioc	process
File created	C:\Program Files (x86)\Project64 1.6\Docs\RDX\Unofficial_ReadMe.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\English_alternative.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.rdb	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.cht	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Plugin Specs\Controller #1.1.h	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Czech.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Zilmar_Audio.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Project64 Message Board.url	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Cheat Codes\Changes.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Bulgarian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Italian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Cheat Codes\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Plugin Specs\Plugin Spec history.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\RDB\WhatsNew.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\3rd Party Plugins\N-Rage\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\English.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.rdx	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Whatsnew.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\German_localised.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Lithuanian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Game FAQ\WhatsNew.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Brazilian Portuguese.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\ChineseB5.pj.lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.exe.manifest	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Ukrainian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Adaptoid_v1_0.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Readme.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Danish.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Dutch.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Spanish.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\No Sound.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\pif2.dat	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\PJgameFAQ.chm	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.exe	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\RSP.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.chm	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Plugin Specs\Audio #1.1.h	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\ChineseGB.pj.lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Plugin Specs\Gfx #1.3.h	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\German.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Project64.cache	Project64.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\3rd Party Plugins\Adaptoid.txt	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Greek.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Norwegian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Finnish.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\French.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Russian.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\T-Chinese.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\Plugin Specs\Rsp #1.1.h	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Docs\3rd Party Plugins\N-Rage\Homepage.url	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Lang\Italian_alternative.pj.Lang	msiexec.exe
File created	C:\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll	msiexec.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\e577119.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9559F7CA-5E34-4237-A2D9-D856464AD727}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI73E8.tmp	msiexec.exe
File created	C:\Windows\Installer\e57711b.msi	msiexec.exe
File created	C:\Windows\Installer\e577119.msi	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

svchost.exeGamePanel.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	GamePanel.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\000A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{57FC4219-A84E-11ED-9424-D2B185039A5C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe

Modifies registry class 10 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pal	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pal\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jap\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.n64	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rom\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.usa	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jap	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.n64\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rom	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.usa\	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

msiexec.exe

pid process

3536 msiexec.exe
3536 msiexec.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Project64.exe

pid process

3096 Project64.exe

pid	process
3536	msiexec.exe
3536	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MSIEXEC.EXEmsiexec.exevssvc.exe

description	pid	process
Token: SeShutdownPrivilege	4616	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	4616	MSIEXEC.EXE
Token: SeSecurityPrivilege	3536	msiexec.exe
Token: SeCreateTokenPrivilege	4616	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	4616	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	4616	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	4616	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	4616	MSIEXEC.EXE
Token: SeTcbPrivilege	4616	MSIEXEC.EXE
Token: SeSecurityPrivilege	4616	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	4616	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	4616	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	4616	MSIEXEC.EXE
Token: SeSystemtimePrivilege	4616	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	4616	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	4616	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	4616	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	4616	MSIEXEC.EXE
Token: SeBackupPrivilege	4616	MSIEXEC.EXE
Token: SeRestorePrivilege	4616	MSIEXEC.EXE
Token: SeShutdownPrivilege	4616	MSIEXEC.EXE
Token: SeDebugPrivilege	4616	MSIEXEC.EXE
Token: SeAuditPrivilege	4616	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	4616	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	4616	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	4616	MSIEXEC.EXE
Token: SeUndockPrivilege	4616	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	4616	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	4616	MSIEXEC.EXE
Token: SeManageVolumePrivilege	4616	MSIEXEC.EXE
Token: SeImpersonatePrivilege	4616	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	4616	MSIEXEC.EXE
Token: SeBackupPrivilege	364	vssvc.exe
Token: SeRestorePrivilege	364	vssvc.exe
Token: SeAuditPrivilege	364	vssvc.exe
Token: SeBackupPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe
Token: SeTakeOwnershipPrivilege	3536	msiexec.exe
Token: SeRestorePrivilege	3536	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

MSIEXEC.EXEiexplore.exe

pid process

4616 MSIEXEC.EXE
4616 MSIEXEC.EXE
4232 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

Project64.exeiexplore.exeIEXPLORE.EXE

pid process

3096 Project64.exe
3096 Project64.exe
3096 Project64.exe
4232 iexplore.exe
4232 iexplore.exe
3716 IEXPLORE.EXE
3716 IEXPLORE.EXE

pid	process
4616	MSIEXEC.EXE
4616	MSIEXEC.EXE
4232	iexplore.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

setup Project64 1.6.exemsiexec.exeMSIEXEC.EXEiexplore.exe

description	pid	process	target process
PID 2672 wrote to memory of 4616	2672	setup Project64 1.6.exe	MSIEXEC.EXE
PID 2672 wrote to memory of 4616	2672	setup Project64 1.6.exe	MSIEXEC.EXE
PID 2672 wrote to memory of 4616	2672	setup Project64 1.6.exe	MSIEXEC.EXE
PID 3536 wrote to memory of 5028	3536	msiexec.exe	srtasks.exe
PID 3536 wrote to memory of 5028	3536	msiexec.exe	srtasks.exe
PID 4616 wrote to memory of 3096	4616	MSIEXEC.EXE	Project64.exe
PID 4616 wrote to memory of 3096	4616	MSIEXEC.EXE	Project64.exe
PID 4616 wrote to memory of 3096	4616	MSIEXEC.EXE	Project64.exe
PID 4616 wrote to memory of 3096	4616	MSIEXEC.EXE	Project64.exe
PID 4616 wrote to memory of 3096	4616	MSIEXEC.EXE	Project64.exe
PID 4232 wrote to memory of 3716	4232	iexplore.exe	IEXPLORE.EXE
PID 4232 wrote to memory of 3716	4232	iexplore.exe	IEXPLORE.EXE
PID 4232 wrote to memory of 3716	4232	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe
"C:\Users\Admin\AppData\Local\Temp\setup Project64 1.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672

C:\Windows\SysWOW64\MSIEXEC.EXE
MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\_isCA89\Project64 1.6.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp"
2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4616

C:\Program Files (x86)\Project64 1.6\Project64.exe
"C:\Program Files (x86)\Project64 1.6\Project64.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:5028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4228

C:\Windows\System32\GamePanel.exe
"C:\Windows\System32\GamePanel.exe" 00000000000C0058 /startuptips
1⤵
- Checks SCSI registry key(s)
PID:2472

C:\Windows\System32\bcastdvr.exe
"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer
1⤵
- Drops desktop.ini file(s)
PID:2252

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4232 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3716

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Project64 1.6\Lang\Brazilian Portuguese.pj.Lang
Filesize
13KB

MD5
d0f3fdfc10e78fa0abc79aa8f38a79f6

SHA1
01c5a6084036cc4636aac1c368e9690a87f90dc8

SHA256
a56721bf222274e817bc9b570cbb2a02fdf46b0d526fbf5abe2915aa9ada0233

SHA512
e9e08d2ce725e51f59d824f9bed384d85e2ec2c2f0dc99efaf0bbff7d18e1f22ab96a1d58db3f900563d748a882a45cee59440f4e5875290216dc303f3b9b39b

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Bulgarian.pj.Lang
Filesize
13KB

MD5
0c225dae3cedc792056900f9e10a0d48

SHA1
aaa6850284bfaa352f324ba3fa1967eb832320e5

SHA256
3c7b711680db701fcd3ffc9a67fb6d5812d78aed8b8bde8d5e02d28f07c71d99

SHA512
9c6c800137e57cda233f3633aef4bdd49cd08192666a55c50131457f497d8d19a75a49d8e7e3fd59e7c5b3a985434c0d861096f2e2284f8c45bcc75409f78ee8

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\ChineseB5.pj.lang
Filesize
10KB

MD5
fb157beb9b916402f2a368387bca5d8d

SHA1
d33cf0cb1d3e5b0fd676e6fa0f46b4b8ff7769c0

SHA256
bbac41a27f7a579acacef035a447abe3b4a34b513d5d0824e8d54eb4488838a1

SHA512
bf495640f15c953f3a29caafd2b7815a2e8d1a2c96c9b62605eab15d409fd0d3acf9ae7178d31027375f87ec1ba291d8c4d8ad905fdda4ee9421ccf9cbf47655

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\ChineseGB.pj.lang
Filesize
10KB

MD5
c75b9be0b2c3cce0306ac39041178fb8

SHA1
81ea9cb8f14450764b76c5f6a3a54de081c4b7e7

SHA256
c8b921a7d47a0c37ebb602be7e7bad139b0efe1512074b0183e92babfa7c1c24

SHA512
9e40d208ce13ad71e30b0fda447fdbb021993f434903eccae74d6032f348cbc44a0e9855a7839053ed51ffdf8d550cbf20334e6126655cf307b582b423b40f71

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Czech.pj.Lang
Filesize
13KB

MD5
6e379d6c937ef3b39368c80a2ecccb84

SHA1
56c8ac7b4254e652d48dac1293d2c6f77ad40c5a

SHA256
eb7b17c1bcf49f927cead14fd97460d23b07325be8edf40351bc5a72e152da46

SHA512
75b3c75c180115609efa86b924835944e980adf9bf8b758c506771ad58151e594e385c3d82518c461ef48f487f12a84087e21acda3337c9378c718af8f852fc9

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Danish.pj.Lang
Filesize
12KB

MD5
71c2f4f94b713e9ee217af3c0e109eb8

SHA1
761f254fd13c29b409019ddfe911e468da59cc68

SHA256
2bb2413b73023d52b22385a96f3202a1087497c6c7a778212f567427a779def0

SHA512
450c88bd35c87a060acd4c83e99bdec5a97cc94efa173c2865e2931fc6834c33f2b24690d154ed456e6542b1e5f2e8a874189b06056c8148b4aec06c0839204d

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Dutch.pj.Lang
Filesize
12KB

MD5
4ff8eafe585420223079f0cf198d1616

SHA1
9d041784e086dfabc366bbabd6d40052af6b8e98

SHA256
98be38024e9a9d923f95c094054265d7f5432df8b4db7a2569b58e5a2115f9cd

SHA512
4a660db227fba83907bd531aa0318a4d4331ebab85fbebe9eab9943598b5023612c7be5e4273aaa8ddb21a44c353086fb6b764af01098c64b9baa12e37d65a81

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\English.pj.Lang
Filesize
12KB

MD5
51148881ece3aa328615cbe2bc75d865

SHA1
6e22e02d51dbc259617de41245eb7580b679df9d

SHA256
c37fb9b1804346c830e436af8c40ae396c27dcafdba1b4a3f0171641d7fcd661

SHA512
65d7252891973c738755a4146d34a55e4ef920da1762d4574c8f0325685472ae665675ad7242ec5d4a8147c5f97a6592b6d3564bfda3ac803c4fc1c5b4bed3e5

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\English_alternative.pj.Lang
Filesize
12KB

MD5
f4dd92b3913359e965eb9e5e5912b945

SHA1
75f72d4ac8ac7c08826c126fbd0499f7ffec99a5

SHA256
09b466dcf92fbfe4559f4f5f7b28b93878161df206d7ce0ef7e0219a5a2c31ea

SHA512
af2a9748126ac965d9e9687a10176b10d0e0510ba8c1cb8ed2413fd59c30d5dafd6e8d730c733490036b10b206dbf7cf63c36a3ccedd5e5ada9bc4b412f23e67

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Finnish.pj.Lang
Filesize
13KB

MD5
a93a4e659d71595ed2c02071b64a6167

SHA1
eec1b5c109f1a78cc2b0e2c3fabbb3db3ae945c4

SHA256
973eebab5d2e2ca6cc22db201910f6c86919749734a930954c1a141c245dec9f

SHA512
6f0ea41316d9521206ef76725d2765f71fa6109d70c3f57ca1dfa2dd3807508e1c1aef36ab0be609e06246c652aa2b63c3ffbd098b5b00950231547ca3c9bcca

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\French.pj.Lang
Filesize
14KB

MD5
18c03bd409d42717d6bc56621225ce9a

SHA1
af87f8ffb669be578203dce3d36930703f6bb56f

SHA256
b6e9751ab25f75373c574adf43e86a284af5913a4ca463a16e11a6de44c841cb

SHA512
3f636cbc973a624d42ae4897a8268c27c6825547647d12fdfc961205693c61a20a453567b544be5542e61eca6a25a1a3b49d1b96c8d8b3f1c8a77e58302867e5

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\German.pj.Lang
Filesize
13KB

MD5
ce9d84252f7747099d1df992465c0792

SHA1
c59121b234281c72afa5bb25f8592c58189fca3e

SHA256
2280928fc4f59a68177961c1c85fc0140ab5b031cb2d920148b5aa00e3604958

SHA512
2e86ce2ae0dd8107c2aac56ff70b234a193e1e2f5518d66cce54a4fd0ba6e2dbeb9171dbceaa5e8988fb30f64075d06e8051675bea49de50e9f0f491273cbd9b

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\German_localised.pj.Lang
Filesize
13KB

MD5
243b1c0a49eb81e3e42430d0e1712b7b

SHA1
5b330b3db4446e3277b297a689e190f120fef7e2

SHA256
11689bbe4da4b8fd88d8ceae21f151b655837090026d12857ced7246c8626498

SHA512
dfdde13e25d61051acd9db1b54bf3a321310cad27a4154c6a833218db41e463ef637c63d68e6d90a57e0b593922c2ae54c3500adc129f196e1ddabe028f402d1

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Greek.pj.Lang
Filesize
13KB

MD5
bc7e8bcea8c52ac1273b052dd9c65648

SHA1
a17d709336df6b887cf0cec10872f145112814c3

SHA256
9334d62719d3fe4219681152926a324350ac9d59845e1ea06dc756ed8fc8b615

SHA512
f1c4c7099ab23e6e5a1b8766a3af956a5add3cd0f0391005aa140692528cc5262b6780f6fa1ac00c67593f705a60672449d90dbeb50a1f23d25f253e37f08d2f

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Italian.pj.Lang
Filesize
13KB

MD5
e28ad3d2aae90fd8d3a9d32759242b0b

SHA1
59d16dafc292f8936d4494cd399c9fda339e19d9

SHA256
f868a8c15271292c37dab4a37f8cbcba6c19f6e40b95c5c3a2307da356826da3

SHA512
df350d3ef74fe81f7220edefd6127f9d73a0b68e32116ba3aa7375b8f8bc5df160ddd218a6454a0bbd2ca11107f937b9ea41e53bb7bce5478535725417a6237a

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Italian_alternative.pj.Lang
Filesize
14KB

MD5
724d6f8594cd3fdcaf9c3fe40d4e86b5

SHA1
bacafdbf7196ab790d374d54315c55c06974c82a

SHA256
f23f5f299ab9bba58b44d710b052e25a8e9b9bade07f08a7372a494fcf6af10e

SHA512
eadbcc45c170300ea8a680682b13e4e3f321e327bff83455a2ca0750cdaa16d61fdb6f4778ee1d73f529651a95a7070608e50242d7b1d8d37097d17c6594d21e

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Lithuanian.pj.Lang
Filesize
14KB

MD5
e2ea69118e4266d912c2f37500124a4b

SHA1
fbbd426c0cb821147977b4f80cf167bde82eccf0

SHA256
6b27d5bdd38b19136e499738bb4fd97f62d9853c8446be9940e27a99f8ddc575

SHA512
a713d19efe95a08ae6d53c7999ac7c61eeb68f30f15061452fb71404d77a164c6a6c396873bf42da200037426ceece356d658dbf3fc98a36ea17a84cab6d3810

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Norwegian.pj.Lang
Filesize
13KB

MD5
ab28501ac90334a4044abc0f641c735d

SHA1
319a8d7544dc236061b5994625eeeeb83f32838d

SHA256
eeee1d4bb8827c19f78d1714b76b0f0c6e0e2a6a9588887ced40a250c38c6d9e

SHA512
b3d090ce5e9878d573dbb0ebee79c3737a206454efc42d7ed7233ff7df8af245adc9bf1c37415be9d58b20bc2371c956fd553b3f46e175b682112deb3ca741ff

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Russian.pj.Lang
Filesize
12KB

MD5
fa0b6e59b1a6cf31a59962ed3704d7b1

SHA1
215c01287606b2bb27ab304d31513c5143bdcbe5

SHA256
ee89f110c00734252326a3240b4d6abf325e215abc5dfaefd19f3e9c6c7d68cf

SHA512
f8a12349e9be7478cbabf4dd5cb091c92ca98049c03d5e79355ac7f7e560175f0a85876389a973da0802287fc80d2ea344686bb928575453f0438189f1246054

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Spanish.pj.Lang
Filesize
13KB

MD5
681fa4a69920fb18928ecdbd3bb93f01

SHA1
4c497b5ca7f860112d005a03a9e445d0a7abfe79

SHA256
3a0a851868414fdd81771ea9ff437c910f04fb4ed0f950781e348ba810e35d83

SHA512
52d5d6f7d8b55ca559f9990724e3d984da345601c4c208a3918a7419256759f61a89b08010bbc43d68d006f8b8efbc0cc95aa094799137b8d68424c4bfe3bb43

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\T-Chinese.pj.Lang
Filesize
10KB

MD5
a1ee4b47e8216905ee7596b86f66b97c

SHA1
83c2037cafc4ba8d604d72891783f115297011a2

SHA256
29ed74a59c722749edd86eef3cdf4885fcaa8ca98a32b022d6fbb9a734b03fda

SHA512
a816f017afcc7796e2d2b58c918cd9a2849b6b742188f39ad86799c829b6e1dc8dd473e7e8f4c37a48251ef78ed9c7857bbc91a235d6f27ed148bc969f414f8e

Download Submit
C:\Program Files (x86)\Project64 1.6\Lang\Ukrainian.pj.Lang
Filesize
12KB

MD5
07360765e73317663a61c5d798c46978

SHA1
bc5d1dd703561e66391f4af58d7a07ed4299045a

SHA256
414f7dd275dced88787b080a76feaab17b6a9b7b48cd7c175f0f3391dda1aaa7

SHA512
b84aab6b3976975a74a821bfbd1636d549266c42664f25019ae269493e83ab985da5748172fd1dc983cccbb084961ae0f701f524d140381131c799f29bf1111b

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Adaptoid_v1_0.dll
Filesize
4KB

MD5
e88b25e65403638f5ca3f6e373f3d4e5

SHA1
514818c42c22990266e4269822a4ca6c07acc0cf

SHA256
127ade4ef446ea5a10345b0b3161e9e3c30f4adbf010f5a7f8c2fec40fb08daa

SHA512
86fbbddb8e89b52def31fedac31fdd5ab7d26f3e390311ae502622e90743da04b71b73dba4453e71ac9ee259d52fe3cd6f77505462a049d67b7099df3ec96153

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll
Filesize
67KB

MD5
d5f798c360aaac128b0fc4a211688ccd

SHA1
4b55d92fda42f108bd0e22503afd905754e95caf

SHA256
0468fc03d5bfd4e47fb0c5f69c657cab62e4bbb2c8948949b4a1d106648ab99e

SHA512
517bce1e5fd1ce06d9d8986e936a0029bf05fd8b6518ea56df7257eb540a2fa722bb799ac2c36a2223f973f074cee29c648720fe01c7b25a77578e828bb1b5d5

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll
Filesize
126KB

MD5
2811a6d5a8052833ef0162e47fda3ad1

SHA1
e5e4532c6831def6cce487eb48af043e4ba7d836

SHA256
fad4e693de17021dd7b2598789f80346047940191d3ca8ed3144bba33a4823ab

SHA512
b53a91e17ad6b6a971ad183eb86ecfb1f40720b65bad934fd5c44fb56d69f4eb3e98955779e99f6b0bc1dc659b8fa94bc7d181d27274a95f26bc284c46b4b592

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll
Filesize
232KB

MD5
ff57f60c58ede6364b980edcb311873b

SHA1
5ec6e231f780d9eafa6ee855e0f4968a7f8c347d

SHA256
05536c82c764f24038bd6f22d47a5427318ce3118bbe1bb798c8309d40f00fcf

SHA512
1e3b5d1bd93cf36dcd862869374d7931eedb1578ceec635c1972f302bd1abaa2d9a63721a2ca9ab4fe1fda8f268f352c70e8a35c8bae91253cb2b4eb1bc7234d

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll
Filesize
53KB

MD5
d5f1a6d72a4eb2e7adf1f5b803e97419

SHA1
d8a93e436e488279d40e0e79a4a04f4ff175f36a

SHA256
9955b91ace2f7e87ec5034274228906e43dac4961abbd296aedfb378b7b3ccf6

SHA512
238b8fd0115f6a820498445d6a2c1cd21e46138272edcb7355cce28ae8aad070e10065c99c95e5d4b03238b8d3b66d2652ad6162e1bb687a99ee6d900ce17ec7

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll
Filesize
52KB

MD5
f5296ecc4d6ea5605291de9203032a82

SHA1
8e72558a56adb82f3ed939c39f67718a0068400e

SHA256
f73c37453aaa866e3fac9cc495b5ccad2822889dda731f36fc3e66d4cb91c1e3

SHA512
659578baaaa5711b440c0e717f6404ecdb3001dc7c49bacd6cd63f43f4e556c8f67461d5e4ce34d1a0d1fd3ce834d6734df431dc4c2c414dbdb1094ab7ce38ce

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\No Sound.dll
Filesize
36KB

MD5
4d43f52f54c1db281839c2510c4b641d

SHA1
1367b1a1e868df1def9a3cd3d677a3ab53e6f9d0

SHA256
f28d8965860ae4b9d6360d14e47ea31752d83797d5616b5aaac2a5834b8701da

SHA512
94016510b0f4f319423a1772ced572e8c83a875491eb577e1d5647af1ee6a2ef0e37978cf4f44d132c8f68a2068cfa7503c2a387732b3472c8dc52edb5d37e47

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\RSP.dll
Filesize
107KB

MD5
23706412ee7a8e7c2c2aa218f9258dd8

SHA1
67fab0e559f4068298b4ca8a682dd2e63be4ac07

SHA256
cdf1a04e877aa9ed57f9446b34a2bdf12cf263542bd461f6a4354d458721abf9

SHA512
b77e1ff74269c7c031bec751162e92305038192952d282e8853d37766f71db62b0dfb99ffcd1139fe866f7b1290a41804c279d7e06fc4718bb7c1c3e2c6404a8

Download Submit
C:\Program Files (x86)\Project64 1.6\Plugin\Zilmar_Audio.dll
Filesize
56KB

MD5
0795c9f1a13113701e5d15b725f21f70

SHA1
0a7424444930a233564deb0bc9d5330a3ae84ce8

SHA256
b652923c13c759d9a4425322e5867342e42f1289e2158bf86679d4958403a9c8

SHA512
30b10ef6534534030365f64d6e25f0ae634bf2201fbb5c7b9de06cf25372fc06734c019a68fe19a8db9deec48748da6cb3d35b835983305ecc29b54d6c73eff6

Download Submit
C:\Program Files (x86)\Project64 1.6\Project64.exe
Filesize
189KB

MD5
be5961ce4de0b363069910edb897498b

SHA1
ffed3dd42551d0e560eb2596defdd16547d8d5fa

SHA256
8d7d373d024206f7513721b320ef3359b885aa6ea73dc2c14b3a42f0c099be2b

SHA512
a4c73543926b68922c86000ed3b966acba53fb25521cf473d3f5f98b4bb416dc9ba50224406764d3bf890c9fbd9394cb1a5c9d4eb88d7fbff3869c73f7b2013d

Download Submit
C:\Program Files (x86)\Project64 1.6\Project64.exe
Filesize
189KB

MD5
be5961ce4de0b363069910edb897498b

SHA1
ffed3dd42551d0e560eb2596defdd16547d8d5fa

SHA256
8d7d373d024206f7513721b320ef3359b885aa6ea73dc2c14b3a42f0c099be2b

SHA512
a4c73543926b68922c86000ed3b966acba53fb25521cf473d3f5f98b4bb416dc9ba50224406764d3bf890c9fbd9394cb1a5c9d4eb88d7fbff3869c73f7b2013d

Download Submit
C:\Program Files (x86)\Project64 1.6\Project64.rdb
Filesize
340KB

MD5
e66224fd74128603f88caf84a2be7b5c

SHA1
55d8a2cb7e075dc5d940182435e94cfcb27d0570

SHA256
14852edd261c00f392f331862b2313bf04ac0b5f0a67d22b0f87049d3240de63

SHA512
8d4ab2db73640382981c14751d1483976e96fe5faf65540ea919c87fa37ca263c22e2ef5734c81ea2f544e067cd351deb8f0e4c2271b5f5bfe094941c3f5f0b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_isCA89\Project64 1.6.msi
Filesize
1.8MB

MD5
3bb7516962c50f2bbd6c922c8e397561

SHA1
37495a93ef0190993cd74a1c4d277dab2e37e3b7

SHA256
359e0e05c52f5c62680064e8716c95889dafe8f23972162feb6d6148d2ff9ada

SHA512
919ff915f3c2799585f5795bef27fa062100cc86bd913df45e1275703feda1c584643cf2c763579b1a5d86229cd87d5aa089bb5a1b09ff8770bb0bff9b7215e6

Download Submit
C:\Users\Admin\Videos\Captures\desktop.ini
Filesize
190B

MD5
b0d27eaec71f1cd73b015f5ceeb15f9d

SHA1
62264f8b5c2f5034a1e4143df6e8c787165fbc2f

SHA256
86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

SHA512
7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
25.0MB

MD5
f65d226880257775d1e518ce14c3c3a3

SHA1
d99f2f42d8fea4cb3486f52d02cb852b24793664

SHA256
b427609c813fd515853b502504661a4f53e3f53e4c099e8399470e3a97310390

SHA512
c5714819968e9c5451a5576411c7217efc43839e84f086477fd6d8c92c640a289d2afe714e0c48dfdb7ec02f88c7c1d1ea57e81236ea5efa318e954e913e5442

Download Submit
\??\Volume{b79df8d1-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{b6ffedb3-5828-4877-af5b-81cd879b46ca}_OnDiskSnapshotProp
Filesize
5KB

MD5
a1f9e045c85ce764f7ce09cd0a72951b

SHA1
c8ec5117f95623d9708d1dd038cfbe6cc7e2e86e

SHA256
6ac3cd99cced0d303241c929982856aea1baa681ec8334eed55e5a8f7f7f260f

SHA512
c6bcd63f978eaa2a8a92f4fa3178e3913e1d518aa3659a438eea5bf8c8e60434d5c3496945a9195e1976d6e31684ac7f8a81fe064da2905574ea7b3d0df03735

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Adaptoid_v1_0.dll
Filesize
4KB

MD5
e88b25e65403638f5ca3f6e373f3d4e5

SHA1
514818c42c22990266e4269822a4ca6c07acc0cf

SHA256
127ade4ef446ea5a10345b0b3161e9e3c30f4adbf010f5a7f8c2fec40fb08daa

SHA512
86fbbddb8e89b52def31fedac31fdd5ab7d26f3e390311ae502622e90743da04b71b73dba4453e71ac9ee259d52fe3cd6f77505462a049d67b7099df3ec96153

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Adaptoid_v1_0.dll
Filesize
4KB

MD5
e88b25e65403638f5ca3f6e373f3d4e5

SHA1
514818c42c22990266e4269822a4ca6c07acc0cf

SHA256
127ade4ef446ea5a10345b0b3161e9e3c30f4adbf010f5a7f8c2fec40fb08daa

SHA512
86fbbddb8e89b52def31fedac31fdd5ab7d26f3e390311ae502622e90743da04b71b73dba4453e71ac9ee259d52fe3cd6f77505462a049d67b7099df3ec96153

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll
Filesize
67KB

MD5
d5f798c360aaac128b0fc4a211688ccd

SHA1
4b55d92fda42f108bd0e22503afd905754e95caf

SHA256
0468fc03d5bfd4e47fb0c5f69c657cab62e4bbb2c8948949b4a1d106648ab99e

SHA512
517bce1e5fd1ce06d9d8986e936a0029bf05fd8b6518ea56df7257eb540a2fa722bb799ac2c36a2223f973f074cee29c648720fe01c7b25a77578e828bb1b5d5

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_DInput.dll
Filesize
67KB

MD5
d5f798c360aaac128b0fc4a211688ccd

SHA1
4b55d92fda42f108bd0e22503afd905754e95caf

SHA256
0468fc03d5bfd4e47fb0c5f69c657cab62e4bbb2c8948949b4a1d106648ab99e

SHA512
517bce1e5fd1ce06d9d8986e936a0029bf05fd8b6518ea56df7257eb540a2fa722bb799ac2c36a2223f973f074cee29c648720fe01c7b25a77578e828bb1b5d5

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll
Filesize
126KB

MD5
2811a6d5a8052833ef0162e47fda3ad1

SHA1
e5e4532c6831def6cce487eb48af043e4ba7d836

SHA256
fad4e693de17021dd7b2598789f80346047940191d3ca8ed3144bba33a4823ab

SHA512
b53a91e17ad6b6a971ad183eb86ecfb1f40720b65bad934fd5c44fb56d69f4eb3e98955779e99f6b0bc1dc659b8fa94bc7d181d27274a95f26bc284c46b4b592

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D6.dll
Filesize
126KB

MD5
2811a6d5a8052833ef0162e47fda3ad1

SHA1
e5e4532c6831def6cce487eb48af043e4ba7d836

SHA256
fad4e693de17021dd7b2598789f80346047940191d3ca8ed3144bba33a4823ab

SHA512
b53a91e17ad6b6a971ad183eb86ecfb1f40720b65bad934fd5c44fb56d69f4eb3e98955779e99f6b0bc1dc659b8fa94bc7d181d27274a95f26bc284c46b4b592

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll
Filesize
232KB

MD5
ff57f60c58ede6364b980edcb311873b

SHA1
5ec6e231f780d9eafa6ee855e0f4968a7f8c347d

SHA256
05536c82c764f24038bd6f22d47a5427318ce3118bbe1bb798c8309d40f00fcf

SHA512
1e3b5d1bd93cf36dcd862869374d7931eedb1578ceec635c1972f302bd1abaa2d9a63721a2ca9ab4fe1fda8f268f352c70e8a35c8bae91253cb2b4eb1bc7234d

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Direct3D8.dll
Filesize
232KB

MD5
ff57f60c58ede6364b980edcb311873b

SHA1
5ec6e231f780d9eafa6ee855e0f4968a7f8c347d

SHA256
05536c82c764f24038bd6f22d47a5427318ce3118bbe1bb798c8309d40f00fcf

SHA512
1e3b5d1bd93cf36dcd862869374d7931eedb1578ceec635c1972f302bd1abaa2d9a63721a2ca9ab4fe1fda8f268f352c70e8a35c8bae91253cb2b4eb1bc7234d

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll
Filesize
53KB

MD5
d5f1a6d72a4eb2e7adf1f5b803e97419

SHA1
d8a93e436e488279d40e0e79a4a04f4ff175f36a

SHA256
9955b91ace2f7e87ec5034274228906e43dac4961abbd296aedfb378b7b3ccf6

SHA512
238b8fd0115f6a820498445d6a2c1cd21e46138272edcb7355cce28ae8aad070e10065c99c95e5d4b03238b8d3b66d2652ad6162e1bb687a99ee6d900ce17ec7

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll
Filesize
53KB

MD5
d5f1a6d72a4eb2e7adf1f5b803e97419

SHA1
d8a93e436e488279d40e0e79a4a04f4ff175f36a

SHA256
9955b91ace2f7e87ec5034274228906e43dac4961abbd296aedfb378b7b3ccf6

SHA512
238b8fd0115f6a820498445d6a2c1cd21e46138272edcb7355cce28ae8aad070e10065c99c95e5d4b03238b8d3b66d2652ad6162e1bb687a99ee6d900ce17ec7

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll
Filesize
53KB

MD5
d5f1a6d72a4eb2e7adf1f5b803e97419

SHA1
d8a93e436e488279d40e0e79a4a04f4ff175f36a

SHA256
9955b91ace2f7e87ec5034274228906e43dac4961abbd296aedfb378b7b3ccf6

SHA512
238b8fd0115f6a820498445d6a2c1cd21e46138272edcb7355cce28ae8aad070e10065c99c95e5d4b03238b8d3b66d2652ad6162e1bb687a99ee6d900ce17ec7

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Jabo_Dsound.dll
Filesize
53KB

MD5
d5f1a6d72a4eb2e7adf1f5b803e97419

SHA1
d8a93e436e488279d40e0e79a4a04f4ff175f36a

SHA256
9955b91ace2f7e87ec5034274228906e43dac4961abbd296aedfb378b7b3ccf6

SHA512
238b8fd0115f6a820498445d6a2c1cd21e46138272edcb7355cce28ae8aad070e10065c99c95e5d4b03238b8d3b66d2652ad6162e1bb687a99ee6d900ce17ec7

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll
Filesize
52KB

MD5
f5296ecc4d6ea5605291de9203032a82

SHA1
8e72558a56adb82f3ed939c39f67718a0068400e

SHA256
f73c37453aaa866e3fac9cc495b5ccad2822889dda731f36fc3e66d4cb91c1e3

SHA512
659578baaaa5711b440c0e717f6404ecdb3001dc7c49bacd6cd63f43f4e556c8f67461d5e4ce34d1a0d1fd3ce834d6734df431dc4c2c414dbdb1094ab7ce38ce

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll
Filesize
52KB

MD5
f5296ecc4d6ea5605291de9203032a82

SHA1
8e72558a56adb82f3ed939c39f67718a0068400e

SHA256
f73c37453aaa866e3fac9cc495b5ccad2822889dda731f36fc3e66d4cb91c1e3

SHA512
659578baaaa5711b440c0e717f6404ecdb3001dc7c49bacd6cd63f43f4e556c8f67461d5e4ce34d1a0d1fd3ce834d6734df431dc4c2c414dbdb1094ab7ce38ce

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll
Filesize
52KB

MD5
f5296ecc4d6ea5605291de9203032a82

SHA1
8e72558a56adb82f3ed939c39f67718a0068400e

SHA256
f73c37453aaa866e3fac9cc495b5ccad2822889dda731f36fc3e66d4cb91c1e3

SHA512
659578baaaa5711b440c0e717f6404ecdb3001dc7c49bacd6cd63f43f4e556c8f67461d5e4ce34d1a0d1fd3ce834d6734df431dc4c2c414dbdb1094ab7ce38ce

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\NRage_DInput8_V2.dll
Filesize
52KB

MD5
f5296ecc4d6ea5605291de9203032a82

SHA1
8e72558a56adb82f3ed939c39f67718a0068400e

SHA256
f73c37453aaa866e3fac9cc495b5ccad2822889dda731f36fc3e66d4cb91c1e3

SHA512
659578baaaa5711b440c0e717f6404ecdb3001dc7c49bacd6cd63f43f4e556c8f67461d5e4ce34d1a0d1fd3ce834d6734df431dc4c2c414dbdb1094ab7ce38ce

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\No Sound.dll
Filesize
36KB

MD5
4d43f52f54c1db281839c2510c4b641d

SHA1
1367b1a1e868df1def9a3cd3d677a3ab53e6f9d0

SHA256
f28d8965860ae4b9d6360d14e47ea31752d83797d5616b5aaac2a5834b8701da

SHA512
94016510b0f4f319423a1772ced572e8c83a875491eb577e1d5647af1ee6a2ef0e37978cf4f44d132c8f68a2068cfa7503c2a387732b3472c8dc52edb5d37e47

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\No Sound.dll
Filesize
36KB

MD5
4d43f52f54c1db281839c2510c4b641d

SHA1
1367b1a1e868df1def9a3cd3d677a3ab53e6f9d0

SHA256
f28d8965860ae4b9d6360d14e47ea31752d83797d5616b5aaac2a5834b8701da

SHA512
94016510b0f4f319423a1772ced572e8c83a875491eb577e1d5647af1ee6a2ef0e37978cf4f44d132c8f68a2068cfa7503c2a387732b3472c8dc52edb5d37e47

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll
Filesize
107KB

MD5
23706412ee7a8e7c2c2aa218f9258dd8

SHA1
67fab0e559f4068298b4ca8a682dd2e63be4ac07

SHA256
cdf1a04e877aa9ed57f9446b34a2bdf12cf263542bd461f6a4354d458721abf9

SHA512
b77e1ff74269c7c031bec751162e92305038192952d282e8853d37766f71db62b0dfb99ffcd1139fe866f7b1290a41804c279d7e06fc4718bb7c1c3e2c6404a8

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll
Filesize
107KB

MD5
23706412ee7a8e7c2c2aa218f9258dd8

SHA1
67fab0e559f4068298b4ca8a682dd2e63be4ac07

SHA256
cdf1a04e877aa9ed57f9446b34a2bdf12cf263542bd461f6a4354d458721abf9

SHA512
b77e1ff74269c7c031bec751162e92305038192952d282e8853d37766f71db62b0dfb99ffcd1139fe866f7b1290a41804c279d7e06fc4718bb7c1c3e2c6404a8

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll
Filesize
107KB

MD5
23706412ee7a8e7c2c2aa218f9258dd8

SHA1
67fab0e559f4068298b4ca8a682dd2e63be4ac07

SHA256
cdf1a04e877aa9ed57f9446b34a2bdf12cf263542bd461f6a4354d458721abf9

SHA512
b77e1ff74269c7c031bec751162e92305038192952d282e8853d37766f71db62b0dfb99ffcd1139fe866f7b1290a41804c279d7e06fc4718bb7c1c3e2c6404a8

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\RSP.dll
Filesize
107KB

MD5
23706412ee7a8e7c2c2aa218f9258dd8

SHA1
67fab0e559f4068298b4ca8a682dd2e63be4ac07

SHA256
cdf1a04e877aa9ed57f9446b34a2bdf12cf263542bd461f6a4354d458721abf9

SHA512
b77e1ff74269c7c031bec751162e92305038192952d282e8853d37766f71db62b0dfb99ffcd1139fe866f7b1290a41804c279d7e06fc4718bb7c1c3e2c6404a8

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Zilmar_Audio.dll
Filesize
56KB

MD5
0795c9f1a13113701e5d15b725f21f70

SHA1
0a7424444930a233564deb0bc9d5330a3ae84ce8

SHA256
b652923c13c759d9a4425322e5867342e42f1289e2158bf86679d4958403a9c8

SHA512
30b10ef6534534030365f64d6e25f0ae634bf2201fbb5c7b9de06cf25372fc06734c019a68fe19a8db9deec48748da6cb3d35b835983305ecc29b54d6c73eff6

Download Submit
\Program Files (x86)\Project64 1.6\Plugin\Zilmar_Audio.dll
Filesize
56KB

MD5
0795c9f1a13113701e5d15b725f21f70

SHA1
0a7424444930a233564deb0bc9d5330a3ae84ce8

SHA256
b652923c13c759d9a4425322e5867342e42f1289e2158bf86679d4958403a9c8

SHA512
30b10ef6534534030365f64d6e25f0ae634bf2201fbb5c7b9de06cf25372fc06734c019a68fe19a8db9deec48748da6cb3d35b835983305ecc29b54d6c73eff6

Download Submit
memory/2672-159-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-135-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-121-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-161-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-168-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-160-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-163-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-123-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-158-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-157-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-156-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-155-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-154-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-153-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-152-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-150-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-151-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-149-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-148-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-147-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-146-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-145-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-142-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-144-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-143-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-141-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-140-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-139-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-138-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-137-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-136-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-122-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-167-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-134-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-164-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-162-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-133-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-165-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-132-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-166-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-124-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-131-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-129-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-120-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-125-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-126-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-127-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-128-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/2672-130-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/3096-412-0x0000000007EC0000-0x0000000007EDF000-memory.dmp

Filesize
124KB

Download
memory/3096-358-0x0000000007DA0000-0x0000000007DC0000-memory.dmp

Filesize
128KB

Download
memory/3096-353-0x00000000078B0000-0x000000000794A000-memory.dmp

Filesize
616KB

Download
memory/3096-352-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/3096-431-0x0000000010000000-0x00000000100A0000-memory.dmp

Filesize
640KB

Download
memory/3096-315-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3096-356-0x0000000007D50000-0x0000000007D97000-memory.dmp

Filesize
284KB

Download
memory/3096-248-0x0000000000000000-mapping.dmp

Download
memory/3096-391-0x0000000003CE0000-0x0000000003DAF000-memory.dmp

Filesize
828KB

Download
memory/3096-407-0x0000000003C70000-0x0000000003C8F000-memory.dmp

Filesize
124KB

Download
memory/3096-444-0x0000000006DC0000-0x0000000006E5A000-memory.dmp

Filesize
616KB

Download
memory/3096-396-0x0000000003CE0000-0x0000000003DAF000-memory.dmp

Filesize
828KB

Download
memory/3096-397-0x0000000003C70000-0x0000000003C8F000-memory.dmp

Filesize
124KB

Download
memory/3096-445-0x0000000007D50000-0x0000000007D97000-memory.dmp

Filesize
284KB

Download
memory/4616-181-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-179-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-173-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-171-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-170-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-175-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-169-0x0000000000000000-mapping.dmp

Download
memory/4616-176-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-178-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-172-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-180-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-185-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-182-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-183-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-184-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/4616-186-0x0000000077560000-0x00000000776EE000-memory.dmp

Filesize
1.6MB

Download
memory/5028-245-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads