neshta | d212d98ac141ce9579cdfeec15b6bb1dd4f7ed22d4d46b45396b7461fd3de667

Analysis

max time kernel
598s
max time network
619s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
08-05-2023 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

50-Cracking-Tools-All-The-Tools-You-Need-To-Crack (1).zip
Size

406.5MB
MD5

f49ef0b6658440036ef1290a8a4a93c2
SHA1

61a6b9a9a7a6f277ef8258eb47bb25d2299d5b9f
SHA256

d212d98ac141ce9579cdfeec15b6bb1dd4f7ed22d4d46b45396b7461fd3de667
SHA512

59901a2f2958486683901c12bfadbd0821c70a66996e56da35b947ba2ac6f56338ce0c676fdc825121cad8e5a27f46a8ace2b1308971167339ca7542f5cadf09
SSDEEP

12582912:9kQFD6JAOy27P+hill4Yz/3EJer+k8VsdStWBFdBINx7gtLA8behAsBjH+tKi/PJ:aB+kTdSM9BgmRfdf

Score

10^/10

neshta evasion persistence spyware stealer themida trojan

Malware Config

Signatures

Detect Neshta payload 13 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001602d-1546.dat	family_neshta
behavioral1/files/0x000600000001afbc-1651.dat	family_neshta
behavioral1/files/0x000600000001afbc-1650.dat	family_neshta
behavioral1/files/0x000500000002299e-1657.dat	family_neshta
behavioral1/files/0x00040000000076b6-1662.dat	family_neshta
behavioral1/files/0x000500000002299e-1656.dat	family_neshta
behavioral1/files/0x0007000000016925-1672.dat	family_neshta
behavioral1/files/0x0004000000016067-1673.dat	family_neshta
behavioral1/files/0x000a000000016024-1671.dat	family_neshta
behavioral1/files/0x0007000000016933-1667.dat	family_neshta
behavioral1/files/0x000a00000001603e-1670.dat	family_neshta
behavioral1/files/0x000a00000001602d-1669.dat	family_neshta
behavioral1/files/0x000b00000001617c-1668.dat	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	UserOOBE.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	UserOOBE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	UserOOBE.exe

Executes dropped EXE 15 IoCs

pid	Process
4440	UserOOBE.exe
4960	winsrvhost.exe
2164	SLAYER Leecher v0.6.exe
3940	svchost.com
4108	SLAYER~1.EXE
248	SQLi Dumper.exe
4892	svchost.com
4416	SQLIDU~1.EXE
1368	svchost.com
2476	WINDOW~1.EXE
2644	Nitro MultiTool.exe
920	svchost.com
3532	NITROM~1.EXE
2900	svchost.com
2944	JOKERD~1.EXE

Loads dropped DLL 22 IoCs

pid	Process
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib
788	lib.lib

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	api32.dll

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x000600000001b0c0-125.dat	themida
behavioral1/files/0x000600000001b0c0-127.dat	themida
behavioral1/memory/4440-133-0x0000000000400000-0x0000000000866000-memory.dmp	themida
behavioral1/memory/4440-136-0x0000000000400000-0x0000000000866000-memory.dmp	themida
behavioral1/memory/4440-137-0x0000000000400000-0x0000000000866000-memory.dmp	themida
behavioral1/memory/4440-206-0x0000000000400000-0x0000000000866000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UserOOBE.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4440	UserOOBE.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	api32.dll
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	api32.dll
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	api32.dll
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	api32.dll
File opened for modification	C:\PROGRA~3\WINSRV~1\WINSRV~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	api32.dll
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	api32.dll
File opened for modification	C:\PROGRA~3\UserOOBE\UserOOBE.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	api32.dll
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	api32.dll
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	api32.dll
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	api32.dll
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	api32.dll
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	api32.dll
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	api32.dll
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	api32.dll
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	api32.dll
File opened for modification	C:\PROGRA~3\UserOOBE\UserOOBE.exe	api32.dll
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	api32.dll
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	api32.dll
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	api32.dll

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	api32.dll
File opened for modification	C:\Windows\directx.sys	Nitro MultiTool.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\svchost.com	api32.dll
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	SLAYER Leecher v0.6.exe
File opened for modification	C:\Windows\svchost.com	SLAYER Leecher v0.6.exe
File opened for modification	C:\Windows\directx.sys	SQLi Dumper.exe
File opened for modification	C:\Windows\svchost.com	SQLi Dumper.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\directx.sys	api32.dll
File opened for modification	C:\Windows\svchost.com	Nitro MultiTool.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\directx.sys	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Internet Explorer\TypedURLs	alocal.lib

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\Total = "25"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\google.com\NumberOfSubdomain = "1"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "262144"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	libexec.lib
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 3df8bf635a45d901	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 3df8bf635a45d901	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	libexec.lib
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings	SLAYER Leecher v0.6.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000001eff79666899d6310cb79d372b9b61614639ba9aff7af352cd61ee2411a9b908ddde2333e71a324a63d2f0bd9667eb897973917da1ec59ef23ac436faaea82f719bbd06e5fa5ed1e59d342bf3d856ebb7fbad722fc37d6c06d6b8f7bedccaa0ff4b4eb35e4d88850a1d81d7d23943dcc5a2e2e3bb5fb040ea4bf0c60d7efc44c3eebffcd09555952a803292fcb33d59362efc9099dd8d4bc85c8ac6598f300e7c77ef0673fba53260b7334fa4504209b591d3049c06eec9707a7bd3563794dc1798f6caff4a825ae0f4864a17da6d7df33d896e62b5d4027517a6e547e1f95ffe73cb72b03c0758842a2234f86b8caa73b40eb875545f613c462bdee7786839a5ea7b86fa9a0047fc8a02e161fdc2b62f275a7e407c64a21238023f7e84e270cc8ee961b78ea0088f764179b70b18f9ae797e9f15680d4b135f2f891a417880a51335dad443cee502b0d8767dad661fcf1c64dd559134fddeed9b3ce9c815652d094b21dae37ee5c6dbb519018ed8661ff2219b1901eda18965523bb652dea7e0d339a563c7c1cb78b8ddca7769563fca0cbb33dd343086c5fb0fdee7ac0c3a96546304a82cd	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.google.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	libexec.lib
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	libexec.lib
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3896	alocal.lib
3896	alocal.lib

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
204	MicrosoftEdgeCP.exe
204	MicrosoftEdgeCP.exe
204	MicrosoftEdgeCP.exe
204	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4284	MicrosoftEdge.exe
Token: SeDebugPrivilege	4284	MicrosoftEdge.exe
Token: SeDebugPrivilege	4284	MicrosoftEdge.exe
Token: SeDebugPrivilege	4284	MicrosoftEdge.exe
Token: SeDebugPrivilege	1256	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1256	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1256	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1256	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4284	MicrosoftEdge.exe
Token: SeDebugPrivilege	4348	libexec.lib
Token: SeDebugPrivilege	3896	alocal.lib

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4284	MicrosoftEdge.exe
204	MicrosoftEdgeCP.exe
204	MicrosoftEdgeCP.exe
4348	libexec.lib
3896	alocal.lib
3896	alocal.lib

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 4440	4104	AntiPublic [v2.0] by Mico.exe	73
PID 4104 wrote to memory of 4440	4104	AntiPublic [v2.0] by Mico.exe	73
PID 4104 wrote to memory of 4440	4104	AntiPublic [v2.0] by Mico.exe	73
PID 4104 wrote to memory of 4348	4104	AntiPublic [v2.0] by Mico.exe	74
PID 4104 wrote to memory of 4348	4104	AntiPublic [v2.0] by Mico.exe	74
PID 4104 wrote to memory of 4348	4104	AntiPublic [v2.0] by Mico.exe	74
PID 4104 wrote to memory of 4960	4104	AntiPublic [v2.0] by Mico.exe	75
PID 4104 wrote to memory of 4960	4104	AntiPublic [v2.0] by Mico.exe	75
PID 4104 wrote to memory of 4960	4104	AntiPublic [v2.0] by Mico.exe	75
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 204 wrote to memory of 1256	204	MicrosoftEdgeCP.exe	81
PID 3924 wrote to memory of 1796	3924	Malwarebytes [Crack.sx].exe	84
PID 3924 wrote to memory of 1796	3924	Malwarebytes [Crack.sx].exe	84
PID 3924 wrote to memory of 1796	3924	Malwarebytes [Crack.sx].exe	84
PID 5032 wrote to memory of 2060	5032	Malwarebytes [Crack.sx].exe	87
PID 5032 wrote to memory of 2060	5032	Malwarebytes [Crack.sx].exe	87
PID 5032 wrote to memory of 2060	5032	Malwarebytes [Crack.sx].exe	87
PID 896 wrote to memory of 1828	896	Calani-AIO-v0.2.6.1.exe	90
PID 896 wrote to memory of 1828	896	Calani-AIO-v0.2.6.1.exe	90
PID 1828 wrote to memory of 788	1828	lib.lib	91
PID 1828 wrote to memory of 788	1828	lib.lib	91
PID 3712 wrote to memory of 3884	3712	Bolt AIO.exe	94
PID 3712 wrote to memory of 3884	3712	Bolt AIO.exe	94
PID 3712 wrote to memory of 3884	3712	Bolt AIO.exe	94
PID 3792 wrote to memory of 3568	3792	Bolt AIO.exe	97
PID 3792 wrote to memory of 3568	3792	Bolt AIO.exe	97
PID 3792 wrote to memory of 3568	3792	Bolt AIO.exe	97
PID 960 wrote to memory of 2512	960	SLAYER Leecher v0.6.exe	100
PID 960 wrote to memory of 2512	960	SLAYER Leecher v0.6.exe	100
PID 960 wrote to memory of 2512	960	SLAYER Leecher v0.6.exe	100
PID 2164 wrote to memory of 3940	2164	SLAYER Leecher v0.6.exe	102
PID 2164 wrote to memory of 3940	2164	SLAYER Leecher v0.6.exe	102
PID 2164 wrote to memory of 3940	2164	SLAYER Leecher v0.6.exe	102
PID 3940 wrote to memory of 4108	3940	svchost.com	105
PID 3940 wrote to memory of 4108	3940	svchost.com	105
PID 3940 wrote to memory of 4108	3940	svchost.com	105
PID 4108 wrote to memory of 4136	4108	SLAYER~1.EXE	106
PID 4108 wrote to memory of 4136	4108	SLAYER~1.EXE	106
PID 4108 wrote to memory of 4136	4108	SLAYER~1.EXE	106
PID 248 wrote to memory of 4892	248	SQLi Dumper.exe	108
PID 248 wrote to memory of 4892	248	SQLi Dumper.exe	108
PID 248 wrote to memory of 4892	248	SQLi Dumper.exe	108
PID 4892 wrote to memory of 4416	4892	svchost.com	109
PID 4892 wrote to memory of 4416	4892	svchost.com	109
PID 4892 wrote to memory of 4416	4892	svchost.com	109
PID 4416 wrote to memory of 3896	4416	SQLIDU~1.EXE	111
PID 4416 wrote to memory of 3896	4416	SQLIDU~1.EXE	111
PID 1368 wrote to memory of 2476	1368	svchost.com	116
PID 1368 wrote to memory of 2476	1368	svchost.com	116
PID 1368 wrote to memory of 2476	1368	svchost.com	116
PID 2476 wrote to memory of 4460	2476	WINDOW~1.EXE	118
PID 2476 wrote to memory of 4460	2476	WINDOW~1.EXE	118
PID 2476 wrote to memory of 4460	2476	WINDOW~1.EXE	118
PID 428 wrote to memory of 2492	428	cmd.exe	121

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\50-Cracking-Tools-All-The-Tools-You-Need-To-Crack (1).zip"
1⤵
PID:4224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1424

C:\Users\Admin\Desktop\Very Fast AntiPublic [v2.0] Coded by Mico\AntiPublic [v2.0] by Mico.exe
"C:\Users\Admin\Desktop\Very Fast AntiPublic [v2.0] Coded by Mico\AntiPublic [v2.0] by Mico.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4104
- C:\ProgramData\UserOOBE\UserOOBE.exe
  C:\ProgramData\\UserOOBE\\UserOOBE.exe ,.
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4440
- C:\Users\Admin\Desktop\Very Fast AntiPublic [v2.0] Coded by Mico\libexec.lib
  libexec.lib
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4348
- C:\ProgramData\winsrvhost\winsrvhost.exe
  C:\ProgramData\\winsrvhost\\winsrvhost.exe
  2⤵
  - Executes dropped EXE
  PID:4960

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4284

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4276

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\Malwarebytes [Crack.sx].exe
"C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\Malwarebytes [Crack.sx].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\data.cfg
  data.cfg
  2⤵
  PID:1796

C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\Malwarebytes [Crack.sx].exe
"C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\Malwarebytes [Crack.sx].exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\Desktop\Malwarebytes [Crack.sx]\data.cfg
  data.cfg
  2⤵
  PID:2060

C:\Users\Admin\Desktop\Calani AIO\Calani-AIO-v0.2.6.1.exe
"C:\Users\Admin\Desktop\Calani AIO\Calani-AIO-v0.2.6.1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:896
- C:\Users\Admin\Desktop\Calani AIO\lib.lib
  lib.lib
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Users\Admin\Desktop\Calani AIO\lib.lib
    lib.lib
    3⤵
    - Loads dropped DLL
    PID:788

C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe
"C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Users\Admin\Desktop\BoltAIO v2\core.dll
  core.dll
  2⤵
  PID:3884

C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe
"C:\Users\Admin\Desktop\BoltAIO v2\Bolt AIO.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Users\Admin\Desktop\BoltAIO v2\core.dll
  core.dll
  2⤵
  PID:3568

C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe
"C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\Desktop\SLAYER Leecher v0.6\api32.dll
  api32.dll
  2⤵
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:2512

C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe
"C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SLAYER~1.EXE"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Users\Admin\AppData\Local\Temp\3582-490\SLAYER~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\SLAYER~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Users\Admin\Desktop\SLAYER Leecher v0.6\api32.dll
      api32.dll
      4⤵
      Drops file in Windows directory
      PID:4136

C:\Users\Admin\Desktop\SQLi Dumper v8.5\SQLi Dumper.exe
"C:\Users\Admin\Desktop\SQLi Dumper v8.5\SQLi Dumper.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\SQLIDU~1.EXE"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Users\Admin\AppData\Local\Temp\3582-490\SQLIDU~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\SQLIDU~1.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Users\Admin\Desktop\SQLi Dumper v8.5\alocal.lib
      alocal.lib
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:3896

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\Desktop\WINDOW~1\WINDOW~1.EXE"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\Desktop\WINDOW~1\WINDOW~1.EXE
  C:\Users\Admin\Desktop\WINDOW~1\WINDOW~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Users\Admin\Desktop\WINDOW~1\lib.dll
    lib.dll
    3⤵
    PID:4460
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:428
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk DPH2V-TTNVB-4X9Q3-TJR4H-KHJW4
        5⤵
        
        PID:2492
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
        5⤵
        
        PID:404
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:4304
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk W269N-WFGWX-YVC9B-4J6C9-T83GX
        5⤵
        
        PID:4712
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
        5⤵
        
        PID:2004
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      PID:2640
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ipk TX9XD-98N7V-6WMQ6-BX7FG-H8Q99
        5⤵
        
        PID:532
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\system32\slmgr.vbs" /ato
        5⤵
        
        PID:744

C:\Users\Admin\Desktop\Nitro MultiTool By fknMega 1.6.0\Nitro MultiTool.exe
"C:\Users\Admin\Desktop\Nitro MultiTool By fknMega 1.6.0\Nitro MultiTool.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2644
- C:\Windows\svchost.com
  "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\NITROM~1.EXE"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:920
- - C:\Users\Admin\AppData\Local\Temp\3582-490\NITROM~1.EXE
    C:\Users\Admin\AppData\Local\Temp\3582-490\NITROM~1.EXE
    3⤵
    - Executes dropped EXE
    PID:3532
  - - C:\Users\Admin\Desktop\Nitro MultiTool By fknMega 1.6.0\nssdbm3.cfg
      nssdbm3.cfg
      4⤵
      PID:4248

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Users\Admin\Desktop\JOKERD~1\JOKERD~1.EXE"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2900
- C:\Users\Admin\Desktop\JOKERD~1\JOKERD~1.EXE
  C:\Users\Admin\Desktop\JOKERD~1\JOKERD~1.EXE
  2⤵
  - Executes dropped EXE
  PID:2944
- - C:\Users\Admin\Desktop\JOKERD~1\lib.dll
    lib.dll
    3⤵
    PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
328KB

MD5
39c8a4c2c3984b64b701b85cb724533b

SHA1
c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00

SHA256
888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d

SHA512
f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

Filesize
86KB

MD5
3b73078a714bf61d1c19ebc3afc0e454

SHA1
9abeabd74613a2f533e2244c9ee6f967188e4e7e

SHA256
ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29

SHA512
75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

Filesize
5.7MB

MD5
09acdc5bbec5a47e8ae47f4a348541e2

SHA1
658f64967b2a9372c1c0bdd59c6fb2a18301d891

SHA256
1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403

SHA512
3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

Filesize
175KB

MD5
576410de51e63c3b5442540c8fdacbee

SHA1
8de673b679e0fee6e460cbf4f21ab728e41e0973

SHA256
3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe

SHA512
f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
9.4MB

MD5
322302633e36360a24252f6291cdfc91

SHA1
238ed62353776c646957efefc0174c545c2afa3d

SHA256
31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c

SHA512
5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
8ffc3bdf4a1903d9e28b99d1643fc9c7

SHA1
919ba8594db0ae245a8abd80f9f3698826fc6fe5

SHA256
8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

SHA512
0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

Filesize
2.4MB

MD5
8ffc3bdf4a1903d9e28b99d1643fc9c7

SHA1
919ba8594db0ae245a8abd80f9f3698826fc6fe5

SHA256
8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6

SHA512
0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

Filesize
125KB

MD5
cce8964848413b49f18a44da9cb0a79b

SHA1
0b7452100d400acebb1c1887542f322a92cbd7ae

SHA256
fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5

SHA512
bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

Download Submit
C:\ProgramData\UserOOBE\UserOOBE.exe

Filesize
1.7MB

MD5
a45d72861c04aed5572d07cc35b23e75

SHA1
1939ee9056721ac184fc2257c2076c89e843b822

SHA256
fcaaafe25027d1a1611df258626527c35b01fb82c19f5d9648c7b7562f1d95da

SHA512
2ecd805fd512913df33e9b411b1dcc5ba74e9b44fb6fdab2894a8e37de00ee3725e32be6a2eedd6c6102225b7e73145ec9cfee834b3de86bfcd3ec868f34ab29

Download Submit
C:\ProgramData\UserOOBE\UserOOBE.exe

Filesize
1.7MB

MD5
a45d72861c04aed5572d07cc35b23e75

SHA1
1939ee9056721ac184fc2257c2076c89e843b822

SHA256
fcaaafe25027d1a1611df258626527c35b01fb82c19f5d9648c7b7562f1d95da

SHA512
2ecd805fd512913df33e9b411b1dcc5ba74e9b44fb6fdab2894a8e37de00ee3725e32be6a2eedd6c6102225b7e73145ec9cfee834b3de86bfcd3ec868f34ab29

Download Submit
C:\ProgramData\winsrvhost\winsrvhost.exe

Filesize
280KB

MD5
20c523142f15b0120a7dcd6afef1c37c

SHA1
cf0adc270f17108c5f83febaba66769ed1b02da3

SHA256
03fe6ee0fb2d086f49999e5180453dcd9b7df0d38f4543fb5ccd97a65371f947

SHA512
00e171cad808010c197ecf5e098cbbef2d8f5d4fc69af92b5215ea5ffcaec8cfddc46fd4527e164e7befc8ba15ec5c491bf539dc4574cb900209c7d9d5f1ae27

Download Submit
C:\ProgramData\winsrvhost\winsrvhost.exe

Filesize
280KB

MD5
20c523142f15b0120a7dcd6afef1c37c

SHA1
cf0adc270f17108c5f83febaba66769ed1b02da3

SHA256
03fe6ee0fb2d086f49999e5180453dcd9b7df0d38f4543fb5ccd97a65371f947

SHA512
00e171cad808010c197ecf5e098cbbef2d8f5d4fc69af92b5215ea5ffcaec8cfddc46fd4527e164e7befc8ba15ec5c491bf539dc4574cb900209c7d9d5f1ae27

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\0L05ZA2T\recaptcha__en[1].js

Filesize
405KB

MD5
e2b80f16cd438a78e686d769dbff9b23

SHA1
a054ffa1e3683691fda2208539cc1b99540f6df2

SHA256
12c5a5f6c4176f49743e6fe7c298b563c375e968ff744745fbb60a7ba8bd1b73

SHA512
42809502133092cee810c17519e9e3306d68f801d742f915ff288611ae00ece469a14daa99bb347b3d9fa7444aaf2f0bd0ce96928769841fcffd77a1e8b98d2b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\O9WFDOOO\favicon[1].ico

Filesize
5KB

MD5
f3418a443e7d841097c714d69ec4bcb8

SHA1
49263695f6b0cdd72f45cf1b775e660fdc36c606

SHA256
6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

SHA512
82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\SLAYER~1.EXE

Filesize
149KB

MD5
d0ff7a10ebe92fbbc4362c5b94d56b53

SHA1
dd882b6cff601050b140e80d4ff83c3458b862a5

SHA256
d54d7120262777bbbaece09211775b3a6ec6fcfa24c95e47482a25f7b02ad31a

SHA512
12a6ed749863d1f74be862ecf83f1d90be272c2eeafa2a3af92d54e75ae0b65236d98cde763f46108a94a309eb95173b90ac00ed0b112605de288c5556b31a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\SLAYER~1.EXE

Filesize
149KB

MD5
d0ff7a10ebe92fbbc4362c5b94d56b53

SHA1
dd882b6cff601050b140e80d4ff83c3458b862a5

SHA256
d54d7120262777bbbaece09211775b3a6ec6fcfa24c95e47482a25f7b02ad31a

SHA512
12a6ed749863d1f74be862ecf83f1d90be272c2eeafa2a3af92d54e75ae0b65236d98cde763f46108a94a309eb95173b90ac00ed0b112605de288c5556b31a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\api32.dll

Filesize
6.7MB

MD5
821f8389ef0f7d7792ecb855b4100270

SHA1
d962c7d1e3ab0c60a56e8d258d3e3cc7c41ae750

SHA256
398cb64ab583e185f45ce992c07e9c7e32f967b1ea094a67128de865786a70d3

SHA512
ad31f9a17c50a3e186f2ed645e8f6932e0b07f28f0866efec1d20c6ef94ae934b50539d6b6713682f796617c4f4292f09035d5f08c05e9ad391ba7a4e2e1fbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\VCRUNTIME140.dll

Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_bz2.pyd

Filesize
78KB

MD5
e877e39cc3c42ed1f5461e2d5e62fc0f

SHA1
156f62a163aca4c5c5f6e8f846a1edd9b073ed7e

SHA256
4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f

SHA512
d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_cffi_backend.cp310-win_amd64.pyd

Filesize
179KB

MD5
282b92ef9ed04c419564fbaee2c5cdbe

SHA1
e19b54d6ab67050c80b36a016b539cbe935568d5

SHA256
5763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e

SHA512
3ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_ctypes.pyd

Filesize
116KB

MD5
c8f57695af24a4f71dafa887ce731ebc

SHA1
cc393263bafce2a37500e071acb44f78e3729939

SHA256
e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1

SHA512
44a1fb805d9ef1a2d39b8c7d80f3545e527ab3b6bfc7abd2f4b610f17c3e6af2ae1fed3688a7cc93da06938ae94e5e865b75937352d12f6b3c45e2d24b6ab731

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_hashlib.pyd

Filesize
57KB

MD5
4fb84e5d3f58453d7ccbf7bcc06266a0

SHA1
15fd2d345ec3a7f4d337450d4f55d1997fae0694

SHA256
df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c

SHA512
1ca574e9e58ced8d4b2a87a119a2db9874cd1f6cedef5d7cbf49abf324fb0d9fb89d8aac7e7dfefbeb00f6834719ed55110bcb36056e0df08b36576ffd4db84c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_lzma.pyd

Filesize
149KB

MD5
80da699f55ca8ed4df2d154f17a08583

SHA1
fbd6c7f3c72a6ba4185394209e80373177c2f8d7

SHA256
2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20

SHA512
15ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_queue.pyd

Filesize
26KB

MD5
7e7d6da688789aa48094eda82be671b7

SHA1
7bf245f638e549d32957a91e17fcb66da5b00a31

SHA256
9ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb

SHA512
d4c722e741474fe430dd6b6bd5c76367cc01ae4331720d17ed37074ad10493cc96eb717f64e1451e856c863fbb886bdc761d5a2767548874ba67eabf57ac89bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_socket.pyd

Filesize
72KB

MD5
7f25ab4019e6c759fc77383f523ef9af

SHA1
5e6748ce7f6753195117fdc2820996b49fd8d3af

SHA256
d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95

SHA512
a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_ssl.pyd

Filesize
152KB

MD5
cf2f95ecf1a72f8670177c081eedeb04

SHA1
6652f432c86718fed9a83be93e66ea5755986709

SHA256
ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8

SHA512
7e5df920f6acb671e78078e9c4fa3278ae838ea6bef49c0ae44de6a79923a3d7bccf0fb3f0e477ca5092e23450494dee265d8735b24d8026456e1328f6fe8b2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\_tkinter.pyd

Filesize
59KB

MD5
c76da9cb5af654367036201cd6b77a96

SHA1
3a8a41c728cfc17556dcb0cbcd762aae4cbc8239

SHA256
e616f850e6905d5f5f1c821a5c39360090444555c1444f97bd2313f4cb99aaf4

SHA512
d91b1027d2ff6e3491c62f2fbc9942e75d76795cc9d48fef423378d69eb8d813add17c8dacb4cea252c5f2cc13b8550057dae41a1de8ffdb720099efca66370c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\base_library.zip

Filesize
794KB

MD5
db6a59a3995875a0172148387e6ae1e8

SHA1
9d6e9c505558ee728d7a72c782d64dc03e1916b4

SHA256
df6ff3f2e0b17e21edf696c0a9d8a8eb703c6a002f63286da5b19862ae9b5048

SHA512
3a874de0aaf2da009531423b57d85120fa54cfaa18dd5d9ed93304f382051f283c575330fd1c4b2c5e7f2fbe677a4899568dc78fe6dfed1cd5a6457de54151ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\cryptography\hazmat\bindings\_openssl.pyd

Filesize
2.8MB

MD5
afebfd77b0b739f3a1e4477e64b892ec

SHA1
9ee5136303564aa0f3c20fb5274849773e8036b3

SHA256
5a0a7903ef35b36d1862274739c01594ce9724442e97bb5c2f0d82dd4804c0d0

SHA512
8f93a515897927485416e044b2ad47630c32d45c469a466b6d45f85a3527e74ef32d82ab0e414d8bd18b5b5ea16491cf3642d7d4c85f9e52cff91ff101b62b61

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\cryptography\hazmat\bindings\_rust.pyd

Filesize
1.9MB

MD5
4017621e4bbd623aca6180b4be2277e8

SHA1
a780633dfb7c89c2045f2ae5cca611319a14baba

SHA256
e0c5e880ca9bc775e232967968dc112aa6074969664fa995947c9e404d0bbb62

SHA512
3e92a1fae54fe0b1de966c85de3736b09a6673f6c1df7287fc6c8a35507145c9a7d1697ff9419fd5e9b3d4efe6a03a0ba5c78bbfdcb142ea18724b2732d2101b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\libcrypto-1_1.dll

Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\libssl-1_1.dll

Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\python3.DLL

Filesize
60KB

MD5
64a9384c6b329fb089e4d1657a06b175

SHA1
ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea

SHA256
ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d

SHA512
9593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\python310.dll

Filesize
4.3MB

MD5
316ce972b0104d68847ab38aba3de06a

SHA1
ca1e227fd7f1cfb1382102320dadef683213024b

SHA256
34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e

SHA512
a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\select.pyd

Filesize
24KB

MD5
589f030c0baa8c47f7f8082a92b834f5

SHA1
6c0f575c0556b41e35e7272f0f858dcf90c192a7

SHA256
b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010

SHA512
6761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\tcl86t.dll

Filesize
1.8MB

MD5
75909678c6a79ca2ca780a1ceb00232e

SHA1
39ddbeb1c288335abe910a5011d7034345425f7d

SHA256
fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860

SHA512
91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\tk86t.dll

Filesize
1.5MB

MD5
4b6270a72579b38c1cc83f240fb08360

SHA1
1a161a014f57fe8aa2fadaab7bc4f9faaac368de

SHA256
cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08

SHA512
0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI18282\unicodedata.pyd

Filesize
1.1MB

MD5
ababf276d726328ca9a289f612f6904c

SHA1
32e6fc81f1d0cd3b7d2459e0aa053c0711466f84

SHA256
89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631

SHA512
6d18b28fb53ffe2eebd2c5487b61f5586d693d69dd1693d3b14fb47ca0cd830e2bd60f8118693c2ff2dcb3995bbfcc703b6e3067e6b80e82b6f4666ca2a9c2ca

Download Submit
C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe

Filesize
190KB

MD5
8a33856aa7684d332df47dd8e71dc941

SHA1
58df6183bb65d16ec60b8883884a522a663da1d7

SHA256
d70636bcb1c719e9a30f1c3abe864489fcdcb253f87ab13dcee63f5d3acbba7f

SHA512
e58c46df971b2e6eb5defe45ab103dc41a18b5bc1998b40cefc3f0c91b3d7d2f3b71de65de7ec5e37d443adafc4f822ddad3cf1ce3f5ebab39d70ae8bffd4265

Download Submit
C:\Users\Admin\Desktop\SLAYER Leecher v0.6\SLAYER Leecher v0.6.exe

Filesize
190KB

MD5
8a33856aa7684d332df47dd8e71dc941

SHA1
58df6183bb65d16ec60b8883884a522a663da1d7

SHA256
d70636bcb1c719e9a30f1c3abe864489fcdcb253f87ab13dcee63f5d3acbba7f

SHA512
e58c46df971b2e6eb5defe45ab103dc41a18b5bc1998b40cefc3f0c91b3d7d2f3b71de65de7ec5e37d443adafc4f822ddad3cf1ce3f5ebab39d70ae8bffd4265

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
5c0fde53f19860f81969e368249de0d9

SHA1
bb870407d35df5e72a577352b7b18ffc8aea1aaa

SHA256
67c61bae394daffcf10ec65c41c42cb522586bbe5c5ebc79bdb30eeea64c4a0d

SHA512
dac1b886c268c79367ac255a5dcb6377f754beece0d90fff42a70adc3da194a944d5cb59a10aa067dae85f19d34ca62927e28529624b4e074c100b4aaf9b7dca

Download Submit
C:\Windows\directx.sys

Filesize
46B

MD5
4e198a7e858ba11f439ee805d39ddedb

SHA1
749a8a587c0532cffb81b92dd894a29d30486e86

SHA256
88dc1bba828a2d62b2109f392e0bba4f7f903f6fc9e60b955b31109733e3f8c9

SHA512
1304c151ccc641cca8e001bc3d1036c7c15b54e2f35933662ff19b473d8fbb63129be24dfb6ceb9644ac03e53dbe0d0b3950dd396a7d998c5092fa6152708e80

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
57a023c6de781b16c9a0925f0d278125

SHA1
1a0dd0771073d55cf659723a99f59a3beeacc505

SHA256
bac9d0ea010a0f3fb1fd5e1e859e9f2e7aac2c5f018bf1ac23470df95af8c584

SHA512
9edfa0e7d91b012248d2b0824229b5b743952d057caa926809781c92b1647c8468ecd998d824eb7f39f0bad241039e3a0d26c054edc8dd51526e080ecdc50b37

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
f290133dc2c5054f9368d005dea177a6

SHA1
f2b0eb038e56164b68eb824e9da523ef6c3f7069

SHA256
c52f5308ad949e3c61031c83e9883d208712f53cbf1e1f87edb0f5243fb3edac

SHA512
218cb7559a313f9d93f338c33c5b3c11c0e9105c44efee8d9ca870cf5e2b8695571a43b1250b3d24b1efacd94e42bdbbdecaf26477f86aabf7988b6be52d001f

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
f290133dc2c5054f9368d005dea177a6

SHA1
f2b0eb038e56164b68eb824e9da523ef6c3f7069

SHA256
c52f5308ad949e3c61031c83e9883d208712f53cbf1e1f87edb0f5243fb3edac

SHA512
218cb7559a313f9d93f338c33c5b3c11c0e9105c44efee8d9ca870cf5e2b8695571a43b1250b3d24b1efacd94e42bdbbdecaf26477f86aabf7988b6be52d001f

Download Submit
C:\odt\OFFICE~1.EXE

Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\VCRUNTIME140.dll

Filesize
94KB

MD5
a87575e7cf8967e481241f13940ee4f7

SHA1
879098b8a353a39e16c79e6479195d43ce98629e

SHA256
ded5adaa94341e6c62aea03845762591666381dca30eb7c17261dd154121b83e

SHA512
e112f267ae4c9a592d0dd2a19b50187eb13e25f23ded74c2e6ccde458bcdaee99f4e3e0a00baf0e3362167ae7b7fe4f96ecbcd265cc584c1c3a4d1ac316e92f0

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_bz2.pyd

Filesize
78KB

MD5
e877e39cc3c42ed1f5461e2d5e62fc0f

SHA1
156f62a163aca4c5c5f6e8f846a1edd9b073ed7e

SHA256
4b1d29f19adaf856727fa4a1f50eee0a86c893038dfba2e52f26c11ab5b3672f

SHA512
d6579d07ede093676cdca0fb15aa2de9fcd10ff4675919ab689d961de113f6543edbceecf29430da3f7121549f5450f4fe43d67b9eab117e2a7d403f88501d51

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_cffi_backend.cp310-win_amd64.pyd

Filesize
179KB

MD5
282b92ef9ed04c419564fbaee2c5cdbe

SHA1
e19b54d6ab67050c80b36a016b539cbe935568d5

SHA256
5763c1d29903567cde4d46355d3a7380d10143543986ca4eebfca4d22d991e3e

SHA512
3ddebdc28d0add9063ee6d41f14331898f92452a13762b6c4c9aa5a83dde89510176425c11a48591fa05c949cb35218bf421f1974e33eb8133a1b95ea74e4941

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_ctypes.pyd

Filesize
116KB

MD5
c8f57695af24a4f71dafa887ce731ebc

SHA1
cc393263bafce2a37500e071acb44f78e3729939

SHA256
e3b69285f27a8ad97555bebea29628a93333de203ee2fae95b73b6b6d6c162b1

SHA512
44a1fb805d9ef1a2d39b8c7d80f3545e527ab3b6bfc7abd2f4b610f17c3e6af2ae1fed3688a7cc93da06938ae94e5e865b75937352d12f6b3c45e2d24b6ab731

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_hashlib.pyd

Filesize
57KB

MD5
4fb84e5d3f58453d7ccbf7bcc06266a0

SHA1
15fd2d345ec3a7f4d337450d4f55d1997fae0694

SHA256
df47255c100d9cc033a14c7d60051abe89c24da9c60362fe33cdf24c19651f7c

SHA512
1ca574e9e58ced8d4b2a87a119a2db9874cd1f6cedef5d7cbf49abf324fb0d9fb89d8aac7e7dfefbeb00f6834719ed55110bcb36056e0df08b36576ffd4db84c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_lzma.pyd

Filesize
149KB

MD5
80da699f55ca8ed4df2d154f17a08583

SHA1
fbd6c7f3c72a6ba4185394209e80373177c2f8d7

SHA256
2e3fd65c4e02c99a61344ce59e09ec7fde74c671db5f82a891732e1140910f20

SHA512
15ea7cd4075940096a4ab66778a0320964562aa4ae2f6e1acbe173cd5da8855977c66f019fd343cfe8dacc3e410edf933bce117a4e9b542182bad3023805fd44

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_queue.pyd

Filesize
26KB

MD5
7e7d6da688789aa48094eda82be671b7

SHA1
7bf245f638e549d32957a91e17fcb66da5b00a31

SHA256
9ad5bcf2a88e1ffff3b8ee29235dc92ce48b7fca4655e87cb6e4d71bd1150afb

SHA512
d4c722e741474fe430dd6b6bd5c76367cc01ae4331720d17ed37074ad10493cc96eb717f64e1451e856c863fbb886bdc761d5a2767548874ba67eabf57ac89bd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_socket.pyd

Filesize
72KB

MD5
7f25ab4019e6c759fc77383f523ef9af

SHA1
5e6748ce7f6753195117fdc2820996b49fd8d3af

SHA256
d0497b79345b2c255f6274baea6ac44b74f345e111ab25bf6c91af9b2a3f3b95

SHA512
a179b22c61f661e4d9b17f56b6a7f66f2d8d8e1d2a9a8aca3c4d6a9cb7755ce6d223bfbca817c1098692a39b6fc20ffbdacefd9bfb47ff02ffa47badca437514

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_ssl.pyd

Filesize
152KB

MD5
cf2f95ecf1a72f8670177c081eedeb04

SHA1
6652f432c86718fed9a83be93e66ea5755986709

SHA256
ba6025ab22d8e6c5ad53c66dc919f219a542e87540502905609b33dc0a8dddd8

SHA512
7e5df920f6acb671e78078e9c4fa3278ae838ea6bef49c0ae44de6a79923a3d7bccf0fb3f0e477ca5092e23450494dee265d8735b24d8026456e1328f6fe8b2e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\_tkinter.pyd

Filesize
59KB

MD5
c76da9cb5af654367036201cd6b77a96

SHA1
3a8a41c728cfc17556dcb0cbcd762aae4cbc8239

SHA256
e616f850e6905d5f5f1c821a5c39360090444555c1444f97bd2313f4cb99aaf4

SHA512
d91b1027d2ff6e3491c62f2fbc9942e75d76795cc9d48fef423378d69eb8d813add17c8dacb4cea252c5f2cc13b8550057dae41a1de8ffdb720099efca66370c

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\cryptography\hazmat\bindings\_openssl.pyd

Filesize
2.8MB

MD5
afebfd77b0b739f3a1e4477e64b892ec

SHA1
9ee5136303564aa0f3c20fb5274849773e8036b3

SHA256
5a0a7903ef35b36d1862274739c01594ce9724442e97bb5c2f0d82dd4804c0d0

SHA512
8f93a515897927485416e044b2ad47630c32d45c469a466b6d45f85a3527e74ef32d82ab0e414d8bd18b5b5ea16491cf3642d7d4c85f9e52cff91ff101b62b61

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\cryptography\hazmat\bindings\_rust.pyd

Filesize
1.9MB

MD5
4017621e4bbd623aca6180b4be2277e8

SHA1
a780633dfb7c89c2045f2ae5cca611319a14baba

SHA256
e0c5e880ca9bc775e232967968dc112aa6074969664fa995947c9e404d0bbb62

SHA512
3e92a1fae54fe0b1de966c85de3736b09a6673f6c1df7287fc6c8a35507145c9a7d1697ff9419fd5e9b3d4efe6a03a0ba5c78bbfdcb142ea18724b2732d2101b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\libcrypto-1_1.dll

Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\libssl-1_1.dll

Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\python3.dll

Filesize
60KB

MD5
64a9384c6b329fb089e4d1657a06b175

SHA1
ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea

SHA256
ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d

SHA512
9593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\python3.dll

Filesize
60KB

MD5
64a9384c6b329fb089e4d1657a06b175

SHA1
ba0e6fcc3b1406356a40b9d8577b2e7ce69c4aea

SHA256
ec655cc34819d6a9677c0541fd7e7b2b8a92804e8bf73aee692a9c44d1a24b5d

SHA512
9593d38abfd46bb94409838dd9cbe603fbe154fa0043959512afc264dceec50d846eefa409bcf9936ee1a7c7313604a578b4051eb6fd6918f2beb0da6c8ee532

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\python310.dll

Filesize
4.3MB

MD5
316ce972b0104d68847ab38aba3de06a

SHA1
ca1e227fd7f1cfb1382102320dadef683213024b

SHA256
34f0e44a0d089587e1ea48c1cc4c3164a1819c6db27a7c1b746af46d6388c26e

SHA512
a11da6590a71d977c62b1c26c275763413f6a455e6d85fa052654d05d845dbbe8122bbd8e0a23887f9873d4291382ebbd5df19674ad2dda1cf0ff3206054939b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\select.pyd

Filesize
24KB

MD5
589f030c0baa8c47f7f8082a92b834f5

SHA1
6c0f575c0556b41e35e7272f0f858dcf90c192a7

SHA256
b9ef1709ed4cd0fd72e4c4ba9b7702cb79d1619c11554ea06277f3dac21bd010

SHA512
6761c0e191795f504fc2d63fd866654869d8819c101de51df78ff071a8985541eec9a9659626dfcb31024d25fd47eff42caa2ae85cc0deb8a11113675fac8500

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\tcl86t.dll

Filesize
1.8MB

MD5
75909678c6a79ca2ca780a1ceb00232e

SHA1
39ddbeb1c288335abe910a5011d7034345425f7d

SHA256
fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860

SHA512
91689413826d3b2e13fc7f579a71b676547bc4c06d2bb100b4168def12ab09b65359d1612b31a15d21cb55147bbab4934e6711351a0440c1533fb94fe53313bf

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\tk86t.dll

Filesize
1.5MB

MD5
4b6270a72579b38c1cc83f240fb08360

SHA1
1a161a014f57fe8aa2fadaab7bc4f9faaac368de

SHA256
cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08

SHA512
0c81434d8c205892bba8a4c93ff8fc011fb8cfb72cfec172cf69093651b86fd9837050bd0636315840290b28af83e557f2205a03e5c344239356874fce0c72b9

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI18282\unicodedata.pyd

Filesize
1.1MB

MD5
ababf276d726328ca9a289f612f6904c

SHA1
32e6fc81f1d0cd3b7d2459e0aa053c0711466f84

SHA256
89c93a672b649cd1e296499333df5b3d9ba2fd28f9280233b56441c69c126631

SHA512
6d18b28fb53ffe2eebd2c5487b61f5586d693d69dd1693d3b14fb47ca0cd830e2bd60f8118693c2ff2dcb3995bbfcc703b6e3067e6b80e82b6f4666ca2a9c2ca

Download Submit
memory/688-1790-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1791-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1798-0x000000001AE60000-0x000000001AF60000-memory.dmp

Filesize
1024KB

Download
memory/688-1797-0x000000001AE60000-0x000000001AF60000-memory.dmp

Filesize
1024KB

Download
memory/688-1789-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1796-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1795-0x000000001AE60000-0x000000001AF60000-memory.dmp

Filesize
1024KB

Download
memory/688-1786-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1794-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1787-0x00000000022F0000-0x0000000002300000-memory.dmp

Filesize
64KB

Download
memory/688-1788-0x0000000000AD0000-0x0000000000AE0000-memory.dmp

Filesize
64KB

Download
memory/688-1792-0x000000001B290000-0x000000001B308000-memory.dmp

Filesize
480KB

Download
memory/688-1785-0x00000000001E0000-0x0000000000256000-memory.dmp

Filesize
472KB

Download
memory/1256-242-0x00000240D3D20000-0x00000240D3D22000-memory.dmp

Filesize
8KB

Download
memory/1256-355-0x00000240D6640000-0x00000240D6642000-memory.dmp

Filesize
8KB

Download
memory/1256-308-0x00000240D55B0000-0x00000240D55B2000-memory.dmp

Filesize
8KB

Download
memory/1256-232-0x00000240D3BB0000-0x00000240D3BB2000-memory.dmp

Filesize
8KB

Download
memory/1256-226-0x00000240C2C60000-0x00000240C2C62000-memory.dmp

Filesize
8KB

Download
memory/1256-224-0x00000240C2C40000-0x00000240C2C42000-memory.dmp

Filesize
8KB

Download
memory/1256-221-0x00000240C2BD0000-0x00000240C2BD2000-memory.dmp

Filesize
8KB

Download
memory/1256-324-0x00000240D4010000-0x00000240D4030000-memory.dmp

Filesize
128KB

Download
memory/1256-516-0x00000240C2B00000-0x00000240C2B14000-memory.dmp

Filesize
80KB

Download
memory/1256-238-0x00000240D3D00000-0x00000240D3D02000-memory.dmp

Filesize
8KB

Download
memory/1256-264-0x00000240D4900000-0x00000240D4A00000-memory.dmp

Filesize
1024KB

Download
memory/1256-278-0x00000240D4900000-0x00000240D4A00000-memory.dmp

Filesize
1024KB

Download
memory/3896-1716-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1705-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1696-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1698-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1699-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1700-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1701-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1702-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1704-0x0000000023810000-0x0000000023FB6000-memory.dmp

Filesize
7.6MB

Download
memory/3896-1713-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1695-0x0000000000D00000-0x0000000000F5A000-memory.dmp

Filesize
2.4MB

Download
memory/3896-1708-0x0000000023670000-0x0000000023770000-memory.dmp

Filesize
1024KB

Download
memory/3896-1710-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1718-0x0000000023670000-0x0000000023770000-memory.dmp

Filesize
1024KB

Download
memory/3896-1717-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1712-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1715-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/3896-1714-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/4284-504-0x0000019945290000-0x0000019945292000-memory.dmp

Filesize
8KB

Download
memory/4284-282-0x000001994B400000-0x000001994B401000-memory.dmp

Filesize
4KB

Download
memory/4284-335-0x000001994B180000-0x000001994B194000-memory.dmp

Filesize
80KB

Download
memory/4284-283-0x000001994B410000-0x000001994B411000-memory.dmp

Filesize
4KB

Download
memory/4284-511-0x0000019944F50000-0x0000019944F51000-memory.dmp

Filesize
4KB

Download
memory/4284-197-0x0000019949910000-0x0000019949912000-memory.dmp

Filesize
8KB

Download
memory/4284-198-0x0000019949940000-0x0000019949942000-memory.dmp

Filesize
8KB

Download
memory/4284-507-0x0000019945200000-0x0000019945201000-memory.dmp

Filesize
4KB

Download
memory/4284-156-0x0000019944E20000-0x0000019944E30000-memory.dmp

Filesize
64KB

Download
memory/4284-174-0x0000019945640000-0x0000019945650000-memory.dmp

Filesize
64KB

Download
memory/4284-193-0x0000019945200000-0x0000019945201000-memory.dmp

Filesize
4KB

Download
memory/4284-195-0x0000019945240000-0x0000019945242000-memory.dmp

Filesize
8KB

Download
memory/4348-239-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-152-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-255-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-254-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-138-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-139-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-140-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-141-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-142-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-143-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-145-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-144-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-146-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-147-0x00000000057F0000-0x000000000588C000-memory.dmp

Filesize
624KB

Download
memory/4348-148-0x0000000005D90000-0x000000000628E000-memory.dmp

Filesize
5.0MB

Download
memory/4348-149-0x0000000005930000-0x00000000059C2000-memory.dmp

Filesize
584KB

Download
memory/4348-150-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-135-0x0000000005540000-0x0000000005550000-memory.dmp

Filesize
64KB

Download
memory/4348-151-0x00000000058B0000-0x00000000058BA000-memory.dmp

Filesize
40KB

Download
memory/4348-134-0x0000000000C70000-0x0000000000CB2000-memory.dmp

Filesize
264KB

Download
memory/4348-246-0x0000000005610000-0x0000000005710000-memory.dmp

Filesize
1024KB

Download
memory/4348-245-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-243-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-153-0x0000000005A90000-0x0000000005AE6000-memory.dmp

Filesize
344KB

Download
memory/4348-154-0x0000000005B50000-0x0000000005BAC000-memory.dmp

Filesize
368KB

Download
memory/4348-155-0x0000000006640000-0x00000000066EA000-memory.dmp

Filesize
680KB

Download
memory/4348-235-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-216-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-217-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4348-233-0x0000000005740000-0x0000000005750000-memory.dmp

Filesize
64KB

Download
memory/4440-206-0x0000000000400000-0x0000000000866000-memory.dmp

Filesize
4.4MB

Download
memory/4440-133-0x0000000000400000-0x0000000000866000-memory.dmp

Filesize
4.4MB

Download
memory/4440-137-0x0000000000400000-0x0000000000866000-memory.dmp

Filesize
4.4MB

Download
memory/4440-136-0x0000000000400000-0x0000000000866000-memory.dmp

Filesize
4.4MB

Download
memory/4460-1738-0x0000000073ED0000-0x0000000073F07000-memory.dmp

Filesize
220KB

Download
memory/4460-1734-0x0000000073ED0000-0x0000000073F07000-memory.dmp

Filesize
220KB

Download