546c322a03bdfc0b2cd14570e475b785bc3916575956893db39cd7874d2f5675

Resubmissions

20/07/2023, 06:58

230720-hrwtlsdg9z 7

20/07/2023, 06:50

230720-hl48ssdc66 7

Analysis

max time kernel
115s
max time network
245s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20/07/2023, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SpeedWin.exe
Size

16.8MB
MD5

c8a775e4dd8707109e23396bb4d1ed8f
SHA1

b816240a146da079bb49096c550860c097f31b4b
SHA256

546c322a03bdfc0b2cd14570e475b785bc3916575956893db39cd7874d2f5675
SHA512

cd1247ada2eaec47c79ea96f5cf19dd9a3d9476fbda967b2de56cf12b684b7de857b11e12f88a9afbb46486ad5b23aa01c36f51d27be8d6ba0f429eb4cef527e
SSDEEP

196608:3omHVY0A5rKomHVY0A5kWq14/4WwhkCQc2qY9h0nAy1aha+0ZBc5i/wm2/YuFyvT:J1YT61YTRqyqY9h0nAzhpQ/ChDc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2232	SpeedWIN.exe
2988	SpeedWIN.exe

Loads dropped DLL 17 IoCs

pid	Process
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2172	MsiExec.exe
2152	MsiExec.exe
2152	MsiExec.exe
2152	MsiExec.exe
2688	msiexec.exe
2688	msiexec.exe
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SpeedWin.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	SpeedWin.exe
File opened (read-only)	\??\Y:	SpeedWin.exe
File opened (read-only)	\??\E:	SpeedWin.exe
File opened (read-only)	\??\H:	SpeedWin.exe
File opened (read-only)	\??\T:	SpeedWin.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	SpeedWin.exe
File opened (read-only)	\??\A:	SpeedWin.exe
File opened (read-only)	\??\B:	SpeedWin.exe
File opened (read-only)	\??\Q:	SpeedWin.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	SpeedWin.exe
File opened (read-only)	\??\X:	SpeedWin.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\V:	SpeedWin.exe
File opened (read-only)	\??\Y:	SpeedWin.exe
File opened (read-only)	\??\B:	SpeedWin.exe
File opened (read-only)	\??\J:	SpeedWin.exe
File opened (read-only)	\??\P:	SpeedWin.exe
File opened (read-only)	\??\U:	SpeedWin.exe
File opened (read-only)	\??\P:	SpeedWin.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	SpeedWin.exe
File opened (read-only)	\??\K:	SpeedWin.exe
File opened (read-only)	\??\I:	SpeedWin.exe
File opened (read-only)	\??\K:	SpeedWin.exe
File opened (read-only)	\??\W:	SpeedWin.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	SpeedWin.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	SpeedWin.exe
File opened (read-only)	\??\H:	SpeedWin.exe
File opened (read-only)	\??\G:	SpeedWin.exe
File opened (read-only)	\??\R:	SpeedWin.exe
File opened (read-only)	\??\V:	SpeedWin.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	SpeedWin.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	SpeedWin.exe
File opened (read-only)	\??\O:	SpeedWin.exe
File opened (read-only)	\??\R:	SpeedWin.exe
File opened (read-only)	\??\S:	SpeedWin.exe
File opened (read-only)	\??\S:	SpeedWin.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	SpeedWin.exe
File opened (read-only)	\??\U:	SpeedWin.exe
File opened (read-only)	\??\Z:	SpeedWin.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	SpeedWin.exe
File opened (read-only)	\??\N:	SpeedWin.exe
File opened (read-only)	\??\Z:	SpeedWin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Resources.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Security.Permissions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Windows.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.MemoryMappedFiles.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.Mail.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Xml.XmlDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Microsoft.CSharp.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Microsoft.VisualBasic.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Globalization.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Text.Encoding.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Runtime.InteropServices.RuntimeInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Compression.ZipFile.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Configuration.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.ServiceProcess.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Data.DataSetExtensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Runtime.CompilerServices.Unsafe.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.FileSystem.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.HttpListener.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Accessibility.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.ComponentModel.EventBasedAsync.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Pipes.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Threading.Tasks.Dataflow.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Threading.Timer.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Microsoft.VisualBasic.Forms.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\Microsoft.Win32.SystemEvents.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Runtime.InteropServices.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Net.NameResolution.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Threading.ThreadPool.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.CodeDom.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Globalization.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Text.Encoding.CodePages.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Pipes.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Security.Cryptography.Cng.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Security.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.IO.Compression.FileSystem.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\mscorlib.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Drawing.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Formats.Asn1.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Threading.AccessControl.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Xml.ReaderWriter.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.AppContext.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Threading.Tasks.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\PatsimaOS\SpeedWin\System.Windows.Forms.dll	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f7769cb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7DF8.tmp	msiexec.exe
File created	C:\Windows\Installer\f7769cc.ipi	msiexec.exe
File created	C:\Windows\Installer\{F95C9862-E29C-4A8B-BD05-8001A764AFE1}\SpeedWIN.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\f7769cc.ipi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI6B22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8105.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{F95C9862-E29C-4A8B-BD05-8001A764AFE1}\SpeedWIN.exe	msiexec.exe
File created	C:\Windows\Installer\f7769ce.msi	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f7769cb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D74.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 60 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd690000000002000000000010660000000100002000000007d22b2881591f5fdc86445a7b2af922e89627e5d62938ffbe93faf44691b027000000000e8000000002000020000000c5be9c6a2ac1eda88b799bc0d19c11b4b5eef38d0aadd7ed21d132f8243da37d90000000406df5f366a95a7e3fed0f63734f91f5340d63ad223ac018fe04d679e22c14090a8588030bb75f9f73f72de6731f5a636da3aa8e693a6a4cf740c14bc220f1d084b5baa605fd1fdf6687ecfd6094c54b64335322179562f80fbb750cef392a3e5e0d7e132fc5ce898882cda4fab870db47bc568aaa938d2c8ab7325bb4ad5b56cba10bf5a164f46858a6c23b89f3197a400000008eeafa1408bc4d43adb928bc47252b0bece1af0968584ff8871a0239027f4b2f1f3141e87baaf80dc4a355d9b3fe40aaf4ea9daf50ae9894a5ae7c1297f536ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{23144E71-26CB-11EE-B86C-7E694F6CA729} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d26cecd7bad901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000c5bc2483fde3ae026f2b107474e247743e39041c286cb0a621e2bd3b0dc204eb000000000e80000000020000200000005846b23566f9ca03fc0fe58e71899e3526bad2ffaf18bd96d8731bcab668e3fb20000000d30d575f0526d1d712a400917722fa39645f5ea33f050424ae5bad56c368bd894000000067cd037e03121d0647110ed791969059e756712d718bf0eaffed186e871f613b25f5d6b1d615561504b4c3e86d3c893d3b93c3294d8e0bfd1ca482b8fa8dea1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12D8E931-26CB-11EE-B86C-7E694F6CA729} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F75F1F4C304EDB5468B4C2806E1F85F9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\PackageName = "SpeedWin.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\Media\1 = "Disk1;Disk1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2689C59FC92EB8A4DB5008107A46FA1E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\ProductIcon = "C:\\Windows\\Installer\\{F95C9862-E29C-4A8B-BD05-8001A764AFE1}\\SpeedWIN.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F75F1F4C304EDB5468B4C2806E1F85F9\2689C59FC92EB8A4DB5008107A46FA1E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\PatsimaOS\\SpeedWin 1.0.0\\install\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\PackageCode = "CABB69C886B43FA4FB975BE1657F1DD1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\Version = "16777216"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\PatsimaOS\\SpeedWin 1.0.0\\install\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\2689C59FC92EB8A4DB5008107A46FA1E\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\ProductName = "SpeedWin"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2689C59FC92EB8A4DB5008107A46FA1E\Language = "3082"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2688	msiexec.exe
2688	msiexec.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2688	msiexec.exe
Token: SeTakeOwnershipPrivilege	2688	msiexec.exe
Token: SeSecurityPrivilege	2688	msiexec.exe
Token: SeCreateTokenPrivilege	2668	SpeedWin.exe
Token: SeAssignPrimaryTokenPrivilege	2668	SpeedWin.exe
Token: SeLockMemoryPrivilege	2668	SpeedWin.exe
Token: SeIncreaseQuotaPrivilege	2668	SpeedWin.exe
Token: SeMachineAccountPrivilege	2668	SpeedWin.exe
Token: SeTcbPrivilege	2668	SpeedWin.exe
Token: SeSecurityPrivilege	2668	SpeedWin.exe
Token: SeTakeOwnershipPrivilege	2668	SpeedWin.exe
Token: SeLoadDriverPrivilege	2668	SpeedWin.exe
Token: SeSystemProfilePrivilege	2668	SpeedWin.exe
Token: SeSystemtimePrivilege	2668	SpeedWin.exe
Token: SeProfSingleProcessPrivilege	2668	SpeedWin.exe
Token: SeIncBasePriorityPrivilege	2668	SpeedWin.exe
Token: SeCreatePagefilePrivilege	2668	SpeedWin.exe
Token: SeCreatePermanentPrivilege	2668	SpeedWin.exe
Token: SeBackupPrivilege	2668	SpeedWin.exe
Token: SeRestorePrivilege	2668	SpeedWin.exe
Token: SeShutdownPrivilege	2668	SpeedWin.exe
Token: SeDebugPrivilege	2668	SpeedWin.exe
Token: SeAuditPrivilege	2668	SpeedWin.exe
Token: SeSystemEnvironmentPrivilege	2668	SpeedWin.exe
Token: SeChangeNotifyPrivilege	2668	SpeedWin.exe
Token: SeRemoteShutdownPrivilege	2668	SpeedWin.exe
Token: SeUndockPrivilege	2668	SpeedWin.exe
Token: SeSyncAgentPrivilege	2668	SpeedWin.exe
Token: SeEnableDelegationPrivilege	2668	SpeedWin.exe
Token: SeManageVolumePrivilege	2668	SpeedWin.exe
Token: SeImpersonatePrivilege	2668	SpeedWin.exe
Token: SeCreateGlobalPrivilege	2668	SpeedWin.exe
Token: SeCreateTokenPrivilege	2668	SpeedWin.exe
Token: SeAssignPrimaryTokenPrivilege	2668	SpeedWin.exe
Token: SeLockMemoryPrivilege	2668	SpeedWin.exe
Token: SeIncreaseQuotaPrivilege	2668	SpeedWin.exe
Token: SeMachineAccountPrivilege	2668	SpeedWin.exe
Token: SeTcbPrivilege	2668	SpeedWin.exe
Token: SeSecurityPrivilege	2668	SpeedWin.exe
Token: SeTakeOwnershipPrivilege	2668	SpeedWin.exe
Token: SeLoadDriverPrivilege	2668	SpeedWin.exe
Token: SeSystemProfilePrivilege	2668	SpeedWin.exe
Token: SeSystemtimePrivilege	2668	SpeedWin.exe
Token: SeProfSingleProcessPrivilege	2668	SpeedWin.exe
Token: SeIncBasePriorityPrivilege	2668	SpeedWin.exe
Token: SeCreatePagefilePrivilege	2668	SpeedWin.exe
Token: SeCreatePermanentPrivilege	2668	SpeedWin.exe
Token: SeBackupPrivilege	2668	SpeedWin.exe
Token: SeRestorePrivilege	2668	SpeedWin.exe
Token: SeShutdownPrivilege	2668	SpeedWin.exe
Token: SeDebugPrivilege	2668	SpeedWin.exe
Token: SeAuditPrivilege	2668	SpeedWin.exe
Token: SeSystemEnvironmentPrivilege	2668	SpeedWin.exe
Token: SeChangeNotifyPrivilege	2668	SpeedWin.exe
Token: SeRemoteShutdownPrivilege	2668	SpeedWin.exe
Token: SeUndockPrivilege	2668	SpeedWin.exe
Token: SeSyncAgentPrivilege	2668	SpeedWin.exe
Token: SeEnableDelegationPrivilege	2668	SpeedWin.exe
Token: SeManageVolumePrivilege	2668	SpeedWin.exe
Token: SeImpersonatePrivilege	2668	SpeedWin.exe
Token: SeCreateGlobalPrivilege	2668	SpeedWin.exe
Token: SeCreateTokenPrivilege	2668	SpeedWin.exe
Token: SeAssignPrimaryTokenPrivilege	2668	SpeedWin.exe
Token: SeLockMemoryPrivilege	2668	SpeedWin.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
2668	SpeedWin.exe
2668	SpeedWin.exe
2668	SpeedWin.exe
2972	iexplore.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2416	iexplore.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2416	iexplore.exe
2416	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2688 wrote to memory of 2172	2688	msiexec.exe	29
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2668 wrote to memory of 2624	2668	SpeedWin.exe	32
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2688 wrote to memory of 2152	2688	msiexec.exe	36
PID 2232 wrote to memory of 2972	2232	SpeedWIN.exe	39
PID 2232 wrote to memory of 2972	2232	SpeedWIN.exe	39
PID 2232 wrote to memory of 2972	2232	SpeedWIN.exe	39
PID 2972 wrote to memory of 2740	2972	iexplore.exe	41
PID 2972 wrote to memory of 2740	2972	iexplore.exe	41
PID 2972 wrote to memory of 2740	2972	iexplore.exe	41
PID 2972 wrote to memory of 2740	2972	iexplore.exe	41
PID 2224 wrote to memory of 2260	2224	chrome.exe	46
PID 2224 wrote to memory of 2260	2224	chrome.exe	46
PID 2224 wrote to memory of 2260	2224	chrome.exe	46
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48
PID 2224 wrote to memory of 2444	2224	chrome.exe	48

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe
"C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe
  "C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe" /i "C:\Users\Admin\AppData\Roaming\PatsimaOS\SpeedWin 1.0.0\install\SpeedWin.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\PatsimaOS\SpeedWin" SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedWin" SECONDSEQUENCE="1" CLIENTPROCESSID="2668" CHAINERUIPROCESSID="2668Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" AGREE_CHECKBOX="Yes" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1689576912 " TARGETDIR="C:\" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\SpeedWin.exe" AI_INSTALL="1"
  2⤵
  - Enumerates connected drives
  PID:2624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A58E1251A4DE1585BAABD0CEDCC1B66E C
  2⤵
  - Loads dropped DLL
  PID:2172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C70AD96931C024CDF624AA32C0B1C327
  2⤵
  - Loads dropped DLL
  PID:2152
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5C3474B27646C99999B2432E57D80FCF
  2⤵
  PID:1916
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 021EA75A869F3317DC81F30E91F8A453
  2⤵
  PID:1092
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 04FDE900F4C92902DF5EC45E0507DBC1
  2⤵
  PID:692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7BBBEEBBC6630EB1AC02A05675D9B28A
  2⤵
  PID:948

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1512

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005DC" "0000000000000554"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2812

C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe
"C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.18&gui=true
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2740

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5d79758,0x7fef5d79768,0x7fef5d79778
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:2
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:2
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1252 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3436 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3672 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3668 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4072 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3796 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3904 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3972 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:2020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3468 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3552 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3844 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2140 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3928 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=800 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1840 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3376 --field-trial-handle=1340,i,7420069042771625060,295312001875973396,131072 /prefetch:8
  2⤵
  PID:324
- C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.20-win-x64.exe
  "C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.20-win-x64.exe"
  2⤵
  PID:1876
- - C:\Windows\Temp\{B1F4007A-E4FE-4068-881F-28F5C3A82AE4}\.cr\windowsdesktop-runtime-6.0.20-win-x64.exe
    "C:\Windows\Temp\{B1F4007A-E4FE-4068-881F-28F5C3A82AE4}\.cr\windowsdesktop-runtime-6.0.20-win-x64.exe" -burn.clean.room="C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.20-win-x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
    3⤵
    PID:1376
  - - C:\Windows\Temp\{E8BB2B50-DA9D-4A6E-A79B-EAD63C1E220F}\.be\windowsdesktop-runtime-6.0.20-win-x64.exe
      "C:\Windows\Temp\{E8BB2B50-DA9D-4A6E-A79B-EAD63C1E220F}\.be\windowsdesktop-runtime-6.0.20-win-x64.exe" -q -burn.elevated BurnPipe.{61788B88-603B-48DB-975B-B6C47747F4BE} {98F642F5-4B40-48DA-95BC-20AF3578EBC9} 1376
      4⤵
      PID:1672

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1880

C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe
"C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe"
1⤵
- Executes dropped EXE
PID:2988
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.18&gui=true
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2416
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2780

C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe
"C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe"
1⤵
PID:2008

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:2136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1ac
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7769cd.rbs

Filesize
44KB

MD5
201248ca1de1028f55492f339eb43778

SHA1
c34198a7fb53cfee431b2a0c4186754346ef0779

SHA256
a000d8d617f4857606e20f006fddbf686c99858352d1cec1e95b324543b01b71

SHA512
3fe20c846863f0f95aa6056372fe757d74af2127c56cbf0fa76104a2fe36fc4c987689166033051ebcc0a6212d6b3703daaa31df03f87cfb98265c56e755ddc6

Download Submit
C:\Config.Msi\f7769d3.rbs

Filesize
55KB

MD5
2ce75c266689420c7edb907af6e2ad55

SHA1
1ca8bf29ad698e7e6b041ba2a618874d5de33664

SHA256
6c6c489f7f607151d516719432c13475363e28a52683c01c10fb607227ae1851

SHA512
2bc70892c51dd7ca60bce291c1cbb7425fcd6f7cb2031fc05559d1b0b9cf0989c8990315256c854ae08ae55847f1f8e8717a6551112b326ca71a2eb01b6ee336

Download Submit
C:\Config.Msi\f7769d9.rbs

Filesize
8KB

MD5
8105677d3bef5722f7734051018d8fad

SHA1
0b131ef4b4fb616a7a965b5eb8a8f62ee4c86e4c

SHA256
d757262bf5c0ce37f987e551901028763fd05c6dd8f7da43e6e5ed37f2100f1a

SHA512
0f5a73430011e2b8dcedbe8c17786d87ac8e922cd66e748794e355aaf7a20ac454a4766ef0aace1e070085a163176dd6b8bb23b4720222fc6a468c35db829a3a

Download Submit
C:\Config.Msi\f7769df.rbs

Filesize
9KB

MD5
44cf346626a2cb00707316d3777795fe

SHA1
7156c9e4338fc6910549a403b66cdfb219a4195d

SHA256
405a37eca72c79fcb385384b4cef4446e78ac3c6b0e386f18eb34a7ecc20fc12

SHA512
1960208189bb1329475c5ce505f2f8a2bffd6874b9f14dabc674bdef2f62d3fc6ca4b865bb5a552b9f7bee496d5fd4ce8bdfa742aa119f377f7f10d4bddc8471

Download Submit
C:\Config.Msi\f7769e5.rbs

Filesize
86KB

MD5
326da63aeb39caa82ac621a22690d552

SHA1
b7e47e92bdbf8d6d877be87c5fd380c0794a5825

SHA256
e77984724bc10660c8cb0f1926acf89239739a3201d3ed343673f3b9dfc13d24

SHA512
bc25439b7de630d01e5827b28072be9db97e15d9cd66bbfd4218aacdbfd321c2343dfa0c86174a35a00453a25d0aad66269dd1852b6aacb10b69ef3ea5e48c0e

Download Submit
C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
C:\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
C:\Program Files\dotnet\LICENSE.txt

Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files\dotnet\ThirdPartyNotices.txt

Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cede8ce2859a7c7f92ac83b79237ddda

SHA1
797f474a4127762cb23f765c2a2080a41ad871fc

SHA256
a946a69e021e039a1d728009f6066892b124d4b245c65ee60eac7fdf995ad9a0

SHA512
80d48020ecec479ae39762e59c2c42aa7528570b5fe2d8dfeb3a601c1d53ce7030fbfd342dfc503c81581a7ae8f380af9ef8a310eb1f4b55ba0701cfdbd5caef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
cede8ce2859a7c7f92ac83b79237ddda

SHA1
797f474a4127762cb23f765c2a2080a41ad871fc

SHA256
a946a69e021e039a1d728009f6066892b124d4b245c65ee60eac7fdf995ad9a0

SHA512
80d48020ecec479ae39762e59c2c42aa7528570b5fe2d8dfeb3a601c1d53ce7030fbfd342dfc503c81581a7ae8f380af9ef8a310eb1f4b55ba0701cfdbd5caef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e91dd72f9969f3193145c1fb4c62de61

SHA1
89890df8838739092cc78a99d65a78ae6e98e421

SHA256
f3b130839e2d1faa7778066f20b83d68fa6e614ac2ccd6038baa0b82febc408c

SHA512
cba25566f096f6aa94e4f9133665668953a73ef6a961496424dbff24367234f5b16ec50b0241969cc4cc43a468288d235659507883d63dbceff00d55a4fab2b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
deb12cdf13dd54b8ce908af541eeca9a

SHA1
daddc20f43627bd94911e1445a784054df4b0b8b

SHA256
83d24dcefd862b24abd623dd70ad00ea15e7b6723cbd52aeb944cc3fcc0cbcc7

SHA512
e0a42a58188ec7ed717ae70f09e1a7f3282b2cb663c2e2f103958d16d7a1e3881aacff1e8257b70d05bfa66de4175dc361da83a5984f5f83b4ecae231db0c336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e89d29681e686ef2037fa1ca11022fe

SHA1
d6d9b1d041c0f90361259268b57a27d8ab7f1ffa

SHA256
d610462efb28837683bf56124719ca2c55202bcee0f2daff287ed7fb986202b8

SHA512
30013e3a3fd1cd2817d670beb875965c3a6ee9b8c559d43156954d940d3b10b486c10c5eb22060f69a1cb416ebd307bcfabecfda3a095fd8bdf3aea8c54ba211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
df60ae8ca5e7838571c5e23b150bdb6a

SHA1
b720413b3008a6e891ce03845901b8b0e5bf5955

SHA256
0053f4f3ee0cf057b64575d8253c1295a6ff80f68d1f15a6e2ec66875811e699

SHA512
f96128dea36c1fbae8c5c91d05f6a0cbf029b6672b3d1e3dd9ad565150333455e5b285234c75afe0f2bb49f8059c452cc758f5a6bbca7b76aec9d44fd48200ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
65a126da13a53976977be49eb5e114b2

SHA1
724949fe12661bf3c5571d767294ef3c042b61f0

SHA256
dbda57543e530e1a0e24212426e5339b8d52646374240ad0b43f81d454bdffeb

SHA512
3c1ec7f9f74cda1f71ba675942d3345b055163009ea1b4f983b89a2cb053c01b77fb073d28ac0c4e1b80e6f9d520ff359f2671997e292a183b9c1e619c541394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5253cfe55899449a88a4773c3fcf1f88

SHA1
8bd1fb79a27f006d9eca7eb538e154ff559f8a55

SHA256
ed9634c08c4ef7f7120a989c14c49b6b1754bbf5de34727bfa78d80ca984ea36

SHA512
d06ce1efe55108f61e0d667d4fe40d3db09175742bdb8a1393367701eeb0a3a9f2100109a79b998d1a729259a72b68034bbd0e210f7ed3393c686c9fb3d4b650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4f5f9a97bf1a17f7f1fa0d639313f6ec

SHA1
607d032f7d3c14fc4cf80d9352710e5c3a0db5ca

SHA256
512cb8b2746fc2f15485da6a66f71e4c1f15f31f395cf193928670333f29f5f6

SHA512
7f05e87cfd4814cae6f7ef2c7e42445a4c3bf17133530764cdb3728fb765f129e188a338abdf4f4cc7a92d72cd385d786d7c46dd62d06eeb1c89705f810cabb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
630c427f3e8a45d79b05b25fdb2f5b14

SHA1
c7c5ac836e08b8f00416089da55645f74c911102

SHA256
b23ba2b7cdb3677ef7f21d04821083b45f6eb756b130c2143a412ee2db54e41c

SHA512
840ad3e39f3f0fa56b5322454891542f86e07fe06408e1fbff51c8b418dea02a61e271968bb858de2b4a47561c1de8ac3c6b92117bfa1317a2d14d3fb2733406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb75b046ef33d3a4bcd007bcc5be5f9b

SHA1
07a6b2f30ab327986330d011ed33c549ca0b86da

SHA256
7703843d2d2024f4f40a63b46e51a2ccc8682ed44db377a057286ea8c0ebc49f

SHA512
c72f66d96854a424186e492611d7d49f6049cd56a4aac27a8064be019988b302e8dd002b5c4ea5dc452746224fe97159305c63dea8adae85110b270d9fa83ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb1197296b2a9d9dcd93dff823c84f35

SHA1
81c1efc888b4d45676324f2c217350ff2458bc90

SHA256
b7546d33ae0454fb71592385b416b816e0846e7500514bc479f7645912855269

SHA512
46a14d2da0bd0c835195fdc9c22eab02d4d726f89daee5687bb6334b8324107c13c54c2e3786e221efd8742080d9310ea45dd4563623d5c86fe77548de54373a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea95302e605c64b668db33e452f8a288

SHA1
709fe871e81c62fb930f5cfa30fd1946371a583e

SHA256
7c4c270805104994bf9e42a3af22fd6f3c6338df74df7c240b26398d0baf9ed2

SHA512
9d0ac445ee92f9036e11b0f733f82844ef6c102a8169275906bbb34c9e547b71b34cba9c9b3ab65ca3709048248555b71f2bd03cb2b4b7a896d91022a4c1de65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
075994f5cd757b27c431411756575e22

SHA1
a7ea0fc925b2fad856d9b9c5d93de676e604e059

SHA256
0db0eccc69bee73be70cbf3255fbb542294dfa2c7cba4c11fea33a3e72519bd8

SHA512
168eaef05880eb2fc963c7e4b26089283f977f57717087c5328ab28beb8e9c6a97551b973e0688222ce6f0e50fe293ec51a110b999a50e17277709574f4ae893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0dae9aead61f5a6c26c402dac5ad6f3a

SHA1
f3915010dcdd63cd4f855c75440d04dbf48eb5a0

SHA256
7f7adc4d45d9f8daa95bd1abd9894b1dc33a92cab69f92009b18a219141bddee

SHA512
5c93a33245b0e0a2ff2bd57cf8075031b58365afb8db27df760e1598fde408318f6627cfbbdd76dbdc38e1be92568829c1ad29fcc33462ce442180a7d1e8c91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de5c9057111d18984926593f1b38fb3a

SHA1
21ece097833eb364e29336424ee9e1bc1d9e65a3

SHA256
f79159e7fe4848fb2db044d617b2bfeed0a742b9a0ffa64797d52c68929ec0fa

SHA512
d3eb83618ef316f6314816fce76e0c507bf7dcef55b976b032fe1e1c5f34bc7ea3a3c555e03ddad5c010d954732d10cbf1ab1f716d937d5a9a59afc6cd56ec63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66fabae4cb3d331216f77a299f6f8045

SHA1
67c0cd0f63de85dd9608d1201fe3e8a476c09bd0

SHA256
cbed13629a4c2ce50e695f56954ca62047ae23eb016a4d1884d36ef1b1e47f5c

SHA512
45401f224d879c1ac6e5e68a1d19f1922a531ef0b517f5065e6440594120139797f83d333e91fe50153a971c71e76209ca5f68c6493642f92231618724296803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f4451bc53a8e646a24e5d338860bd86d

SHA1
8ba6c47c9f10ac84891939e5ebdcf94f8e0b1537

SHA256
40c32f8e49c801e1eb98ca5a7a7f04cf5ca7c5e4099b9689aa9e4764c3537656

SHA512
3af396a5734d0c67a93d200100118a2a4aadb8039d3fd8326c23146352e05ba3b81b2b943a05cd35a10c4662615dd5ef1414fbf18e9e6644553afbb26b8a3147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c56f5eb774335133f977a6b32044a7

SHA1
d6c65fb6e1921a62a23a186c7ea15799d5c33849

SHA256
5c1672bb5c6fde14a5a7cec4428a654410c8943f915b661dea44a286c01e67c9

SHA512
58c29ca4a11468d7dd8400c8799d7e039b88b59b0fc9f46d1d1b61dd9699039c330a553a1a9492c8925bc4055e8acb21139376fc1c0ee013d72860a4383287ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
55c56f5eb774335133f977a6b32044a7

SHA1
d6c65fb6e1921a62a23a186c7ea15799d5c33849

SHA256
5c1672bb5c6fde14a5a7cec4428a654410c8943f915b661dea44a286c01e67c9

SHA512
58c29ca4a11468d7dd8400c8799d7e039b88b59b0fc9f46d1d1b61dd9699039c330a553a1a9492c8925bc4055e8acb21139376fc1c0ee013d72860a4383287ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e806d7dac41bd4642e67caebc4e3b7

SHA1
b2e78f7132273f890e2c278171aeb2bc188838ab

SHA256
31da0cedff5e5417cc0b5003567fca8af662dff4544d79e56c1d8be54c17067d

SHA512
c17e570297984299b4b6b8be56fc72f230bf4c4aa60c77062e4faf4d50f99f26c15abf35187c7e689a69086df3f88214215176198e4b2a0a74c552111978dc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41e806d7dac41bd4642e67caebc4e3b7

SHA1
b2e78f7132273f890e2c278171aeb2bc188838ab

SHA256
31da0cedff5e5417cc0b5003567fca8af662dff4544d79e56c1d8be54c17067d

SHA512
c17e570297984299b4b6b8be56fc72f230bf4c4aa60c77062e4faf4d50f99f26c15abf35187c7e689a69086df3f88214215176198e4b2a0a74c552111978dc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e0e87fedd9591e3c16e6328e6548d15

SHA1
90ba35f3d913565c37e4c25b000da071272cca72

SHA256
2c5f9a2bf2b7ce6d63d72ac7421bfda3bc457f67aada49f7b73355be0e6d978e

SHA512
b0c2f7834363cbb67b9a7094c74636008cd86565751c332c9b599f25790d271fd1877387ee2f09cb4f900fd0dcef24baa34672b68f9bfd2756d550124f8dbbcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49d2eef4d324fa918a41427797eab9dd

SHA1
2a336ec733bedbf961262d84a8fb42c08ad14e62

SHA256
17af1af53cadcd05f2c60533dd04995685c17f01dc2a6d34a8aaf7b5c4407fbf

SHA512
1139f64afe66bd70ff5534346cd689cc563bf255eaf84b11b7b183e7c27c193eab9e6840799658b9e73e9586f60aca12abb32facc463e405fd35308df7495201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66c77da9669c0fa3ee758aa8110f80e7

SHA1
e18799a25a8a5b4a13dffbbf058da3ab4595ab56

SHA256
d876daa16cac8191c42e252a0a820c515c36b28228ded61f1fc873e09be0830f

SHA512
180ba50a182d948629b39343b548fe57852765d4a8f491ad82e1ae67b65f1743ebe66cf13b4a493f97b32f1d70756ab447e86988540fcd42d490260bd451893e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
792ce3070b8561b5aba64443fa56bc40

SHA1
aa96065b4657bb29907a8bfef01c20649557d938

SHA256
6c087ac7a6f801a67f60c36d784ae01e5b8e5811d7a1abd9caba8221af5fb8fc

SHA512
77c3a37bcd70c97fa726d6c03eb33f9a39e6000e938528d6e93e3c13a00badca446fddfb9048b5b28681940eaa9959f15490cecdcba49976426c71053d6cb72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
07f9364a64767a91932a5b336c2a214f

SHA1
68af2c8473f74480f68f9f0b21e14665a92a748a

SHA256
2abd0403507aa074d99f22ae73485e591f6a011860780841f65cb5b613c110e9

SHA512
3a497bd4e0caba00e4bdcb5df9977d874fe0873f2cd975cd2a81d6f1be4c1b8ecebcba153d58d780e9d8c989e70711acfdb1e6b8f47bc38f83b90c61d0cb395f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5cd764f38d0488551e3f1b834f56b90c

SHA1
3226b0914cc007a3a927c780a96002a7998331de

SHA256
b7abd765b5c9fef017251d5d1675afd8137a51ca56390a020d0001765f3471a2

SHA512
7b98b8988e092b4d36dfdd007fe6caacf06edd1b86b37f1e029606c88e6e4d57db5e40ab1ca6b88ca41af121c7e698e987ad729a39a0ff6a29d3dd546bf2dfda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
320798bf2f30b514954c1e383d4d74c3

SHA1
b9ac7498b9b2768d57865dad50064e538e16dee5

SHA256
ddb9100d63cebdcc306f67bde4730df7ecfe622c98b2dca592520111e16724fe

SHA512
00c1b606178b2182f2a3530dc3260b6ac4783dcc2966a4000dd54293812993206467a0f4c3b40b91446038e15c2a56fdcb2a4065792a3998d3e7dbd004992dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ba78f0651f20299721fc58f433c7db9

SHA1
1c72211c5e98cf0422c5c38279a6c10d66e1cdd8

SHA256
ad0e37e9c4e862b506e8fd58268701bdc8c91536fda42d075326035744aa22b4

SHA512
bbaccc0ad08e83d81c6fef79a8a8f6f055cd1a7327a0757717332c227b35c2bac64cffb55410582a0167e3061d418308fe340ad4fb30c86f5c0553e3bed42631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
613d9966e2d5eacc22c62f0a900283a9

SHA1
cc08af08abd9d16e546bf6cfe6cb6a5f2ff33e2d

SHA256
6e93799ef260fc9e16d86e509ed81a846028125bef68d7d8baa023c91e6515a6

SHA512
6d42f785b8958d0db091c09a85e196e9e7553d10644d82758f7051aa7b21bc34d15fe167a5d2cf419976f2ea14809a26c9288bc25ca9862f1e002ab1386549c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ae9520b7a86a2c0e7f2a3b1b7272074

SHA1
80d146b96b33f6463f9e70b47af42debbcde1fe4

SHA256
5a9e5f92e47cae80118c2bd21580d712a661d362e997825db91ae0a73495bdda

SHA512
db96cb26631d13596390ecea9ce196223202f5197a2c2db5aadf38ce8ca1e3c69d08a6e0b0691e57b85d3f8da09736f715ab2c360466f7af87f508f747d65b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f7d986c210cc88c24ca37a73c12dc21c

SHA1
8b40eef24e7ed4ce8f1a6ee82a9ad46d9a4b3ebf

SHA256
9b04127f3e3cc94e969c9de368584cdbb5131388c77e2b4c9cf5c4d6ace278d2

SHA512
d99cba3a52ceda8d85c735c6844d4fe57df15123719d6aef4c3efc3fee3977ad61f7e345d7cf1e9e2e74710120dead7c662b6e0b25373fe8e81a075848b4217c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20c3a87fabfc11f645abb460ce6c6759

SHA1
7a7c0b86a4cbe586c980aa821794d2493d52bf34

SHA256
bdff55ebb60dcc03ce8bb6b78b6a8979c26fbf6fea188785d3104a39e38f346d

SHA512
81b54a9fec449809f41159c1c8fd54eb26fe9b657c1575d84fc008ef279f6ab7508cf9190482df407b34891c48a66b17966a136116c1fc7daa291fa6c8445436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
073b33dced4511bef36d3af1db93a359

SHA1
42d2f05707a57a8504d4700f468f0215fb76dbcb

SHA256
94107a9a9cdef4be376a086da0663540874303280627fed3edd0975db6866160

SHA512
e243aecbed048e1740c0762ff9833d21035aa86c0f16645ee2496a07793b9ac39aa5a777f130f6a5b298502d54135bd52c70efce2712357e5c9b9301c815bac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de6221fb7d07ea12e72a9ff0077a3ee6

SHA1
8472c10160e5fd7a338fefa82a1fd6f2903a74f3

SHA256
94a660e069c9a31312647fc4cf85bb21104849636c676963c091466ac7606ce4

SHA512
7b76d73c451344e0df7961ed6b363305bcb69015331bcd41066a2c910053b1286860521db4f3e9131b15f017a3a6f05ed81ffb9f7faa7d56b4a87cd923a61e34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afcfd6450dd18c04528a148d2e72192e

SHA1
5ef7b519b5d932429b6680875f119e706c293d77

SHA256
44d49f892a96f3dcabcd5d4f29973fedf62e6e361cd0b7139e2b0d4cc72dcf8d

SHA512
31733b913b065fb74b66dd66388ce013755efc0de3bac77d95c277ca05e4d16cf6a870e680bc9dcb13c6b05330e6c01d3e12f37980a09f5f1b909145e7d7708f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1092623966ee3c1f2a8ac76b9b6c5129

SHA1
f9a722f67d98de1dcc67909031414e50ccc8ee04

SHA256
4a60883fa4b72c5151641a2da046d0ba0d3a8b0b94d514d8ceb76fbe4747546c

SHA512
8f6c99838559c73046e19ec5623defd06017e7d69283b4f92ad13843cc2bd854ba55df80be5db2a7f903531c4c91e92342037a2e99d037be94d63f29894d0379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4713e53e10a8213da10d1da68f1c50c6

SHA1
3d3dffcd6c73cca9c628d8395e999703af22bcb4

SHA256
f032b365194d50091b970c8a96b8d3b842f95846184f261b2b5308bffa9258be

SHA512
4bd35219c82975ddeef7846215b6ae2bb0dc122f5400aef48c0746fc131112979c82ca6e6af9e9675bb9e01f08ab52165ef2381dab6f1538ad361a98f94e932e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
98e0442a381a947b633e54a6b341fd29

SHA1
c9bceff50049da116afce578c4e57c2d105051ea

SHA256
b6aee9107eeb3b91c9c3dabdad74f8654099cba671905a00299047e7ecf1f79a

SHA512
80faaa24632cf7effe455bf9c025b0c640d7877ee6d263fcf4876b3078562684ba635c7930bc46745e35f341ea8fa4a4271624956d06894a3d15231429266f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
42ef59b8bbee57330465b488560a3a9b

SHA1
683ae81a78fb645c178d93526686110ac321c660

SHA256
5df7452d9ebca55ee6f4e401d21513f996f9f977601f5004e1c5ed192f72c8ce

SHA512
689406fa5471a1f0c9e0eda51d9340171788085a7ac34d843ee2eb19eaf1f8a0066db0a40fb4e17b6a511b8a045007aac0cc6d864971866870eb3cb03b7df534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
670252600f683e85362c9d2f9608fdab

SHA1
c9bcf6f6cfcae218cf8d1ad34837be4e1ca239d4

SHA256
77950946aa27f84b3f693f1c9e09df7a18c4a697946253bd33eab866fc811723

SHA512
b400b7f1605a863c732091d08a63fbb140149b68118f3d2fa137aac83148f115ada0798426d5d9d8ec214ce3d54db0077abb2c669150d4a86b218ea6ba49b78e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37581251fa665160952bed2eba5701fb

SHA1
f65f2244b83b0a4d1f6aac2fe0f6b9f48b05da5e

SHA256
3385266c7f20480dd6d2fc54d9026eddbae3ea521058e1a15aca00098cbffa84

SHA512
e44d16cf724798619231a7cacbe822490dc317f18d49a11ddc9f9023b0f679d6a721196212fac3169efacaa11894da3b8b07b3d79d9ddba4564f4a9dcf57bdaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23f9c3b81d9ebe5113931161c3af972c

SHA1
908722413d8e4290d157894067b56b240093a541

SHA256
e200c63161083e3221498207722b00e49efe8e2b8e2708496607420f3649d0bf

SHA512
85465d5b1c3ce191ff5b54d320d2940cba815099f3ebb7fa3901d11dacdf260e0efab544c9096005f5b6d090597b7fa6d3908f3ecce7a38ba095613fc274d437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cce589f1cbd265e4f11683b6b6bfcd47

SHA1
e4270ecc0b8c9de7be45c3a5d6ce861775397ced

SHA256
6d246b8a516aa21ef4357fca85121a8346a5da13bb9467230df501008a0ccebf

SHA512
e7cc751796cedf2954d5238f0b09ca41b5fbb8483fdc80b196be2b02298eb52f563649b35548faace0ae2cc558f87f08e00da73325470f4ea3dc3d1a80a19e52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
904adab97a5d5e5d53e172a14e93eb9d

SHA1
c9a36a73eae7e448c8f750e7c9477f24a0082f56

SHA256
5b7a4b44be1051570801a4f5d425d3641f7a3f387e4c4ab0db35665024902d33

SHA512
1803109263c3ccb2ee69df89eee62cf7b47c5b8265d5077949ed7732e73b6ee598b4f8fabfeb3dd2bcc264fa06368c1025d0e9871d73ee7d1b4253e638864667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5e970c084dc73faa6d17259564051f22

SHA1
cda657bf1bb96eebb2cf73eae861e19a7941468a

SHA256
e42534b97b43853d0926f1c79583dd403e1956b1f6f48c0dd9c47fca49f0bdc7

SHA512
b6e7a45c015449c4c70c73d30af8c78513a133d2d76a50fd9382b24af7531bcf6872a2fdf3297c980f2a42cc84e44b6251a0a430cdea33082cfcc56235d9b9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
298f15874ed0ef384448059bc6bf1475

SHA1
bef4fa42ef9f4f17ccf65cfe084d0595bc162473

SHA256
e081b584ca71ff922bc5c4916adc106e043094614f659f9e2ab023f36289f0df

SHA512
2c48f5d4af5459d83a4372ae0a9281bd1b4eaed408a7aae260ffa061c6c2f6e2579e95e0e6502c926a1f455b598cfc3f37794cc27116197022b1f0676564cdcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4c3a6a229884b1997255b60dac8bb0fb

SHA1
629b2ec18bd35fe6d900404ab9de743d524f9b81

SHA256
a6f7f5ecb6db37369c0670b380044737c4339e10df6bb3989dadbb1d969b2ab6

SHA512
0d8819a95169b28468d51827dc3d2bfedc5873f4e716aafc9e33999e3b1acd17006e16189aa5888c639867d6aab82c6e149411802bcff06d3a4a96ac65fb9fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ed10514127c90abe5b6b69a9629ec77

SHA1
3de3a5816eb1f59c907e5ac80bcec64df694ea75

SHA256
9214c9915814d0b0508bff871c01e1ceead8467457087154db68beab13e8c5c1

SHA512
eeaa30e969e81309a2f6cbddb5cd8e7ea4e58d070eef862484f6d07195fda5b52bec55fbc3d5a1f296000d6b83fd47c0e08576a88c40120310687b243c6ec9de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b0ed688a0790c4a20fcb1b67226a6ba

SHA1
08f297ebf7d7c94011d6a65e595db260c807cc3a

SHA256
25978137531695cdb89c68b6f64441aaed67193984a2a2cbe6299cabcd663ee0

SHA512
5bb825a0c4417cd578426c8199ddeb3db933127e08af1922a631c11a2a300f50443f58253dc99159c22f4086d199581d7767e0f6c1e4264e237ac8c4528fb356

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
27ca61d0e27df8085d662b7a86a58250

SHA1
118f5422e0a25bfc6b32ebb5ec3dafc0684968b0

SHA256
324c3d4f386dd8b3c5f332df4775c0fc05ae0f7c7a25cfbef9e45ee2d7f6ab4b

SHA512
a27e87713ff8cdcecb7b0ebbeff5a84f6d32d1796bc9e4199095b25e885013d3254db9f174cf9a1d047d982d0524a6058c30d08f261e8aeacbe32f6d81ab7db0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
1934b7584d65d4a639f52becdaefb0a5

SHA1
e5cbdcc19bff37e72dc44d81e99742116ef5a664

SHA256
03004892df75f5bd4a13dbcbe67742c7f9e47f590e251cd67952138e8e07c8d8

SHA512
a673fe3acc7fbfc304bf9f542cd7c7e7bd17a1e31dace42a84a20a0f1bf340362c81b3780a7a26c3763359a8852e1a7348de392d4f6cd8b3a0985bdeb2817f1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4844455dc0c1d8450e18a7a7ed7333d4

SHA1
b83b7cd1511cea105b631e023741bed0fe529896

SHA256
c864b4fe478778af595fcb456eeea4feaca2c9de80ee5ae58a2ece286433a944

SHA512
9d4f72131298ff68f8da3c15b839041fc31aeb335a160286709ff29d060b447bb1dfcd95bd5a604913685f922fd741a38fcb8d49675318933f6dd48e0a489a15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
178KB

MD5
c210d0b68db6bf3bd3d11dda1fb5af3c

SHA1
e0f6a1541d62c006cbb5c81a55fe9843c7b1b302

SHA256
1ee4a8ecc44e5f76f83ad31e64fe6ba07aecae9daf2c8a0bbd8d61d4a0d1a0ac

SHA512
b4ff37317a731fbc4b3fee62c455c9b3dbbe942cbf0c3568b70096591e6f1914b83206ff6b75071fea935771a418a17a07e735c1bb39f028a69dbe14f15cf8e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\cca26886-1a47-4b45-a528-7aeb5aa1cb87.tmp

Filesize
178KB

MD5
3c1dfadda5b3b654ffe1e6d1c0f01025

SHA1
34d45eb7802b7cb1a288d58108cf8d9dcb4e117a

SHA256
4359ef2f34962b1b9d26cb3e05d1ed153676ada46bdf11b9d3b4c8ca9405b480

SHA512
5a26bafd872da931f05ec72c0def6507c874e92677b0d386bec215bba5e94f8cf3d7f355fe5a06f992c6ab4870c3cabc32b1af6851aa244d271b04b1b1e25c90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{12D8E931-26CB-11EE-B86C-7E694F6CA729}.dat

Filesize
5KB

MD5
b73419444ba4951ad51ea732166dce21

SHA1
b04b0ed9c2af78c39a8f37ca91a8753e18a187a9

SHA256
466bd2ed19c57f55e5409ef2728c8e2d84289a94b40daa26e3bd774277ffc5f6

SHA512
edc9adefcdb57bec09e249b187766ef0e3d488ffa0286d01ca8d3c71f9f7c52231e267af9a2d4730c17f45e63dd547e74f0c15e6bb9118c12d60282fc35ee9d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ba0y71l\imagestore.dat

Filesize
4KB

MD5
d28317535b4990dae3a6e22b81b221e6

SHA1
3132e23f26f4f308c5d37010df9929b7faee2826

SHA256
12702478469ae068ad2b266861216962b18d4a4924e76326ad770d16b9402cfa

SHA512
998ac4383118413c89e839f19cdd8a91923205292646babb9853e2afcabb76fce578275022071e808dfb89691bfde536659829346d1c9f77ef03fecdc3c11f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\Logo_sobre_moda_femenina_minimalista_neutral__8_removeb

Filesize
25KB

MD5
aed62a7a6dd0903f0143209bdb696369

SHA1
19551a4c0108ffd0fadfaff6693dbaad5843e623

SHA256
4f62f564e1d1b308723db9c457cb906d14109ecd9c727df7b34c066a1c6fe118

SHA512
545e1ae7ed7394e97fdb061cf6a3248a8e78f247e12b67ea8a06ebae36f28fe4dd9c8cfa8a49296cf499ce49c8ca3e075a02bf3eeca6b43adc83cce7dee4afb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\PrepareDlgProgress.gif

Filesize
24KB

MD5
f550f449baed1315c7965bd826c2510b

SHA1
772e6e82765dcfda319a68380981d77b83a3ab1b

SHA256
0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d

SHA512
7608140bc2d83f509a2afdaacd394d0aa5a6f7816e96c11f4218e815c3aaabf9fc95dd3b3a44b165334772ebdab7dfa585833850db09442743e56b8e505f6a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\ProgressImage.png

Filesize
173B

MD5
6bbc544a9fa50b6dc9cd6c31f841548e

SHA1
e63ffd2dd50865c41c564b00f75f11bd8c384b90

SHA256
728c6cc4230e5e5b6fdf152f4b9b11ac4d104fa57a39668edea8665527c3bcc2

SHA512
2cf43d3a3f2e88805824e4c322832af21c4c49d5309387aa731ddbea8cc280a6049cab4526e20b1c87c39c8781168c5ff80083c94becf0984b94593b89ab77f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\backbutton

Filesize
404B

MD5
50e27244df2b1690728e8252088a253c

SHA1
b84ad02fd0ed3cb933ffbd123614a2495810442b

SHA256
71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3

SHA512
ba3d3535bfd2f17919e1a99e89fdb1c9a83507ff3c2846c62770e210a50aee1281445d510858d247cc9619861089aaf20f45b0b7c39f15c0ea039ac5498fa03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\background

Filesize
134B

MD5
a0efb0e7b9cee25b09e09a1a64e96ba6

SHA1
0c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39

SHA256
f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787

SHA512
7e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\browsebutton

Filesize
253B

MD5
9554be0be090a59013222261971430ad

SHA1
9e307b13b4480d0e18cfb1c667f7cfe6c62cc97c

SHA256
f4302ee2090bc7d7a27c4bc970af6eb61c050f14f0876541a8d2f32bc41b9bab

SHA512
ac316f784994da4fed7deb43fe785258223aba5f43cc5532f3e7b874adc0bc6dbcd8e95e631703606dfaa2c40be2e2bb6fa5bc0a6217efe657e74531654ea71c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\checkbox

Filesize
1KB

MD5
0b044ccde7aa9d86e02a94030d744ac2

SHA1
0594ebb3737536703907ba5672ccd351c6afb98a

SHA256
bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3

SHA512
dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_bottom_left.bmp

Filesize
66B

MD5
1fb3755fe9676fca35b8d3c6a8e80b45

SHA1
7c60375472c2757650afbe045c1c97059ca66884

SHA256
384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

SHA512
dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_bottom_left_inactive.bmp

Filesize
66B

MD5
821930553ef406b0c82d9420d3351c78

SHA1
8511c65f0048f8f30797a13b3d7d8264c314cbd4

SHA256
d5e9f3533cb7d727611aafaa5af22fa07efeaec0391a011ecf9803bed867de7a

SHA512
9d55bb01e40bb411321e60fbb1e60748a7243392456030d81f853448af0af75e27ef87455ad1eebf96af754e803aabd1a82f0653deda52832769f5b74171d9cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_bottom_mid.bmp

Filesize
66B

MD5
71fa2730c42ae45c8b373053cc504731

SHA1
ef523fc56f6566fbc41c7d51d29943e6be976d5e

SHA256
205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd

SHA512
ea4415619720cc1d9fb1bb89a14903bfd1471b89f9c4847df4839084aae573d49b4969d3799ad30ff25b71f6e31f8d9f30701e1240d3cd6a063819c04873f21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_caption.bmp

Filesize
206B

MD5
8641f45594b8d413bf1da25ce59f1207

SHA1
afebb23f5a55d304d028ca9942526b3649cddb52

SHA256
0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707

SHA512
86a5f959f8462f866466dc706d3ae627b1fb019b8a33ee7fe48e3b69f92bf33dc0f1417c0d5116552b25b488bcb5d9050a33773e6883ebe08410267d95b2353a

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_left.bmp

Filesize
66B

MD5
30384472ae83ff8a7336b987292d8349

SHA1
85d3e6cffe47f5a0a4e1a87ac9da729537783cd0

SHA256
f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a

SHA512
7611f930a0a1089cc5004203ec128c916f0c2aedae3a6fcc2eaffa8cd004dcbf154714e401947921a06896ca77c77daec7f9bda82369aacd3bb666f8a0331963

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_left_inactive.bmp

Filesize
66B

MD5
4b84f29fbce81aab5af97a311d0e51e2

SHA1
60723cf4b91c139661db5ecb0964deca1fc196ea

SHA256
c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55

SHA512
775eadccc44fddbd1e0d4231bc90d222f0a9749199e1963449ad20285ea92941a5685cdc12c0cd8c0ef0a21e10bdacaf139e5c69cd5e402cc110679323c23df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_top_left.bmp

Filesize
154B

MD5
1966f4308086a013b8837dddf88f67ad

SHA1
1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

SHA256
17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

SHA512
ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\frame_top_mid.bmp

Filesize
66B

MD5
4e0ac65606b6aacd85e11c470ceb4e54

SHA1
3f321e3bbde641b7733b806b9ef262243fb8af3b

SHA256
1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee

SHA512
7b28bcb4e76af3b863a7c3390b6cd3316c4631434e1d1e2df8d6e0eb9987a61a4f1a24de59567394e346d45e332403a0817ed0b0b64d7a624dbe48e30db9bb64

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\metrobuttonimage

Filesize
404B

MD5
17368ff7073a6c7c2949d9a8eb743729

SHA1
d770cd409cf1a95908d26a51be8c646cace83e4c

SHA256
16e6e7662f3a204061c18090a64a8679f10bc408be802abd2c7c0e9fe865cbb4

SHA512
cbc3a378335f131d0146e5fe40cea38a741a0754a26304daebfda6f82c394cf0e151654782c6c8c7bbf7c354fcb72a2c66a77a87df528c2a3fa87c88f204059d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\metroinstallbutton

Filesize
520B

MD5
70db38d656afa3778dcf6173d390e61b

SHA1
8b8674d6d70d67943d313d2b74222daa4bd1691d

SHA256
3a0a5b69f9da7cae9fc631326ed8aa97abbaaecf2bf15d0a73169a29f3381e83

SHA512
8888ab493c7342f69b33279eaec4f99c41a906929d65503c48c7059d199fbab267ba9ad6ef6e57a7a56d2a321c01e46008f770afe67fa99ec7b7676ec2376c05

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\nextcancelbuttons

Filesize
404B

MD5
583580e2c651f5c230fb3235b7ca0e3b

SHA1
a9bd6aeef43a6f4c0c00d1ecd98a585d7eb0aaa3

SHA256
65172283ee04f2fa18d0e57b21471be2e68017d1f61816aaaa6be070b446346f

SHA512
6c61e6c06c883113a7a0efbd352120354c070f5c17d770b6b821c42cb9d9ca895992842b29b51bd3e569b0c95e93709dd7c1c2a26bcff0ad425079f5302670ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\runapplicationbutton

Filesize
18KB

MD5
f5a120b564fc7823d1c269b7a6e70473

SHA1
1b85466c12f83b7872214f787390614df50eaddb

SHA256
c178ed81de4aa8b049efcf0670c10cf2043a51c6be1144ee95d09c1c2afd6087

SHA512
96d285759f8a8c5d17d7cac4ef224995dfa09554a3687c7f34e63651888c98a9c60095cd1a71c82030781ff6e7d58b7d49068bd9f53126ff7b775579d3368ace

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_close_down.png

Filesize
273B

MD5
f6a5e71e9cbe8d3654a2cdf91aae98fa

SHA1
8871a1ae25cff6c5a3e6288a58fc5f4d7a92409d

SHA256
4801d63bd9bdc6279765ba785b0da9e10730764a9c3645934a46c691547c0612

SHA512
1b3146dfdef9c46123f27fa355790036f296d600bb10fbad12363c71c8e3a840863512f4a581daa18ffabb3ec5a3720a6337c4bac54be8b9b49d161b9459a1c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_close_hot.png

Filesize
276B

MD5
17242d201d004bb34449aab0428d2df1

SHA1
77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

SHA256
15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

SHA512
605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_close_normal.png

Filesize
225B

MD5
8ba33e929eb0c016036968b6f137c5fa

SHA1
b563d786bddd6f1c30924da25b71891696346e15

SHA256
bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

SHA512
ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_min_down.png

Filesize
205B

MD5
5e947815d865acf099fa753283e09179

SHA1
7d98046d20a73439c53044e0ebb5f0b34afaeea9

SHA256
c1d0663131fe901d890cdd9f18af8f9a553bee4848cbd978f5122e8383b5534b

SHA512
b22e31c37d84128b271c5e5a70fdce90a3bbc02059d1bd032841b3383dbeeca56ec9abe6335453abc8ded1de84e6fcafb648d76d4dcc79246339e9a5eb6d5270

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_min_hot.png

Filesize
180B

MD5
1a883668b735248518bfc4eefd248113

SHA1
1112803a0558a1ad049d1cac6b8a9d626b582606

SHA256
bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

SHA512
d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_min_inactive.png

Filesize
175B

MD5
a2c4802002bb61994faabda60334a695

SHA1
0a2b6b0ceb09425080c5ba4b9cbdef533cf69eba

SHA256
a3b59dbc5a39d551455ff838e71b5820560ca3484c6411b9d69df33d8113619c

SHA512
34e130edc650c3de6020f2d2b5dc1404b7aee0105eb7e315c15c5aa61398d174377e9b6a2aecc55f79f54c04812b8745c6739a201539e291538979e6b024da31

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\sys_min_normal.png

Filesize
238B

MD5
516172d0ebf941237cef32fcee8cdf43

SHA1
6bee117996c16c7413be876dfc15978d14813091

SHA256
56e64eaf6349ece08005e6f7299de413ed00112d53518215d90690be2b2a4f1a

SHA512
46477a58aa7e9eeae29e1c1d826bf045422709b7c8f428985c617b366012c58121d4404523a75efe77fc6d8e061a6bb209743d0a2af81545898f51c8855728ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_2668\viewreadmebutton

Filesize
2KB

MD5
c288a7a350a1a5a5eee9ada36cb6011c

SHA1
d1174e488d08dc4ab9bba3fd7653724d5553898f

SHA256
030e5bb7b7fff395c38433516cf96988939cb794d9d62d550d7eab9cef7d2b2e

SHA512
dc7f9486699b4eb4b8295590112b540ed619c2b956948eec3b72fe86226740f43392dd1898d5f27d553e775351c527ac316f4606389b92bedfc996845649a859

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBCFA.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9962.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9B28.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9BB5.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9BB5.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9C42.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9E85.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAE9C.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAF29.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIAFD6.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDF7.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF10B2868BCC95B1C4.TMP

Filesize
16KB

MD5
c77870391bb0438c7f772bc3635fc467

SHA1
f4a701721a6cf679713fda14d9a3a7926be413c7

SHA256
11e1f15092e71dafa4bbd18620d4a2e92330940ea4766aa618f78aaac2266dda

SHA512
421449cb2b16c2c4e0573eec6690b3eefacda9d85b1dc14c9c97a7e49bcee2843724ffbe2233895ce58105151be2f9b6a8140763914e56f7884a3c725cb5e786

Download Submit
C:\Users\Admin\AppData\Roaming\PatsimaOS\SpeedWin 1.0.0\install\SpeedWin.aiui

Filesize
3.3MB

MD5
b46a7ca9a8816ff2852cf29c63bcf8ee

SHA1
4927028912dfd6e4abc514e7bed9848835abe267

SHA256
5152371fa065a7f78605b96a97bf1c8b8f9e00f8cceec409656daf3481eebb5f

SHA512
332a0dcb98b04e20545bf833d25eeb75f5d85a381a9d62e0761c3da5e3756d9fefc70e07c2cbee22294614e46aaa8c71d06452ef34517260f4f916f7bfc8311b

Download Submit
C:\Users\Admin\AppData\Roaming\PatsimaOS\SpeedWin 1.0.0\install\SpeedWin.msi

Filesize
2.0MB

MD5
d1d4b50a15264d43fbe983d8f4448270

SHA1
2e5fb602b175e7452480affc37833255617c1129

SHA256
731914ceca85244f80e6972aa490fea65aa0510053bcddb95dea2cdd06f5a7bc

SHA512
d184c26932d3c6c8f8dd3f1291d656712c0754bcb03de766d154aa5da915a930ccd902bb375c07cc33428d4df728ea66d8b294111b9651bbe04462833f552aa5

Download Submit
C:\Users\Admin\AppData\Roaming\PatsimaOS\SpeedWin 1.0.0\install\SpeedWin.msi

Filesize
2.0MB

MD5
d1d4b50a15264d43fbe983d8f4448270

SHA1
2e5fb602b175e7452480affc37833255617c1129

SHA256
731914ceca85244f80e6972aa490fea65aa0510053bcddb95dea2cdd06f5a7bc

SHA512
d184c26932d3c6c8f8dd3f1291d656712c0754bcb03de766d154aa5da915a930ccd902bb375c07cc33428d4df728ea66d8b294111b9651bbe04462833f552aa5

Download Submit
C:\Users\Admin\AppData\Roaming\PatsimaOS\SpeedWin 1.0.0\install\SpeedWin1.cab

Filesize
8.1MB

MD5
c6851bf4cf684c89c6c2439f491c0414

SHA1
f9b5a6f3d2a4fc0dbdf376e9b58861043aa57bff

SHA256
320e20c49a13a04697df3db702ea27fdacdc1081f1d52cfcf145fcaf2c025016

SHA512
a8142680948a657ed42b797fffe9f8feffc20585d787938392995fe8d3c66526d4567e613f59461b4516f002cb5209272b4d4106dde6e568daae1be903e2a434

Download Submit
C:\Users\Admin\Downloads\windowsdesktop-runtime-6.0.20-win-x64.exe

Filesize
54.7MB

MD5
2dd697493474c5b7329f012364580ad6

SHA1
ac76529b02e3c2704eae53229051dcab00508296

SHA256
b812dbd07dec698b2b4b97d68643b2f494659c1c0c13b215abbe077c0facaa09

SHA512
eefd2e2dabb633b0d6c7e523dbdf072c9634088cc6d38c63aaa17c004e38366bcf2dcf5305093b5279a7366c11e177366ceb9d48c14600e140f2efef6caa6308

Download Submit
C:\Windows\Installer\MSI1B39.tmp

Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSI6B22.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Windows\Installer\MSI6D74.tmp

Filesize
709KB

MD5
9863ad412fa5529d5a712ef228ac6e2b

SHA1
bda741fd705277c29379b01100a162e922f76583

SHA256
502ccbe31fe0f984a2fa0610ee6385a3e478cd866e19208e229b6ef8fcfb2934

SHA512
8f64b1ac2423eb6ebbd2853a985711c030f54279599382b3cbc3de4ebb90a98a0273172a85d65e5e78cae419e928fb787715ea9f2c8285662c89b25d6b584cb0

Download Submit
C:\Windows\Installer\MSI7DF8.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
C:\Windows\Installer\f7769d4.msi

Filesize
25.8MB

MD5
078ade8de5dc7e407a286ab952031389

SHA1
00811c7dd80e71a7d97fc1ec9f6c56cced81d33e

SHA256
bc6b4599371da2ab6cc19195dbb5d7ec30b4f9b1535bfee8056da9e1855689e7

SHA512
cf5d5330c279b7c9d721db873409e5b0a400bbfaa175dd7db251b8b7a6969249f847739acc5c6df00bc58191d2c6964c31f4dffa1b720715e027188c942ab591

Download Submit
C:\Windows\Installer\f7769d5.msi

Filesize
804KB

MD5
08914d16e9173ec7bcfa9efb2429b3e9

SHA1
8891064db8b6f55f932c62e5f13af5fdfbae382a

SHA256
52c21d71e67fac67115385d7066a9f80e3cf63ce55e2ff5645006c7dd5d68d2b

SHA512
33fce38ae2229f31552dd391c6afbc9c7ff688f029c31cde0915d032e32f7ee6a7e2b6083747d1c55db5d2004796a35c0de854e6a073baaed333aad5d95e8128

Download Submit
C:\Windows\Installer\f7769e6.msi

Filesize
28.4MB

MD5
f8c53e111c603e5895109b0105bb015e

SHA1
5ba1b3ecc1395a7bcd51b122351abb4101e6785b

SHA256
96eaca7ff6f73dd5ff6c6588f023b1ea462bc98893175452c0ec96e265ace9b2

SHA512
66e5b00f1e63cb3c04b166bb466d56598b2047f55eba0d5b049bf01957fa88e23e0fbc3c95a3a3899e57d713f58ec2c7d5e93b9d0ba7563253889eeea5278a50

Download Submit
C:\Windows\Temp\{E8BB2B50-DA9D-4A6E-A79B-EAD63C1E220F}\.ba\bg.png

Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{E8BB2B50-DA9D-4A6E-A79B-EAD63C1E220F}\.be\windowsdesktop-runtime-6.0.20-win-x64.exe

Filesize
610KB

MD5
4f0d17ee48ebf364bab9e4ecc004503c

SHA1
18728133071f8dc3587504b5c6da8ea286c4dfd2

SHA256
99f2a911a6c616555db73fa88bbc7917ee61e3e5b1df8c0e1990552469104849

SHA512
d62dc58299b84fe3bf9a929c7ac112988e8c6876625144590f7345c1c30b531c683d89dd4dd498f7e3334230526df6079a3aeebb8d7339a3368370a749f45cfa

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Program Files (x86)\PatsimaOS\SpeedWin\SpeedWIN.exe

Filesize
156KB

MD5
5cac0ca4a55da0c890dc862043eb4062

SHA1
b8e922103841fa6c00b404a5159a54f0ddf31b67

SHA256
c73d04eb074949a2b10cd2b5d909302d27d8be3aac35bf1709706543cd514b9d

SHA512
a566a05ffe6753fc2b200a0d79cbb179cea312982854b739d9b5fbd18e1ea889d9480d11310bd5de7bcf2f0dc7bcb2a338ec1e110c0110aeb5127e7578f6ce44

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9962.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9B28.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9BB5.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9C42.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSI9E85.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSIAE9C.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSIAF29.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Users\Admin\AppData\Local\Temp\MSIAFD6.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Windows\Installer\MSI6B22.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
\Windows\Installer\MSI6D74.tmp

Filesize
709KB

MD5
9863ad412fa5529d5a712ef228ac6e2b

SHA1
bda741fd705277c29379b01100a162e922f76583

SHA256
502ccbe31fe0f984a2fa0610ee6385a3e478cd866e19208e229b6ef8fcfb2934

SHA512
8f64b1ac2423eb6ebbd2853a985711c030f54279599382b3cbc3de4ebb90a98a0273172a85d65e5e78cae419e928fb787715ea9f2c8285662c89b25d6b584cb0

Download Submit
\Windows\Installer\MSI7DF8.tmp

Filesize
588KB

MD5
a9941233b9415b479d3b4f3732161eab

SHA1
cb2d99af52b3b1c712943b13e45d85c80c732e57

SHA256
ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2

SHA512
cfd6c425587e5e7c57b6f4655e2a48c871313e2bacf63cc0955ccae1a384610644f26aa76bee0a2a327cd77c2ae7def8ea9cb0c7c7c87fab1c8196bac82037f7

Download Submit
memory/2008-4278-0x000007FEF5740000-0x000007FEF5C3E000-memory.dmp

Filesize
5.0MB

Download
memory/2008-4281-0x000007FEF5740000-0x000007FEF5C3E000-memory.dmp

Filesize
5.0MB

Download
memory/2136-4279-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2136-4280-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2136-4282-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2136-4283-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2668-54-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2668-305-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download