hxxps://proapkcrack[.]com/helium-10-crack/

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://proapkcrack.com/helium-10-crack/

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
388	Ful_Activate_Setup.exe

Loads dropped DLL 13 IoCs

pid	Process
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
4616	fm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 388 set thread context of 656	388	Ful_Activate_Setup.exe	141

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Videos"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Videos"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupView = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByDirection = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\IconSize = "96"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000462eee34ab64da0181b1079baf64da01a741f536a666da0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\Mode = "1"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Videos"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000900444648b4cd1118b70080036b11a030300000078000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5FA96407-7E77-483C-AC93-691D05850DE8}\FFlags = "1092616257"	msedge.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1580	msedge.exe
1580	msedge.exe
4224	msedge.exe
4224	msedge.exe
780	identity_helper.exe
780	identity_helper.exe
1028	msedge.exe
1028	msedge.exe
5516	msedge.exe
5516	msedge.exe
2776	msedge.exe
2776	msedge.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
388	Ful_Activate_Setup.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
656	netsh.exe
656	netsh.exe
656	netsh.exe
656	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5480	7zFM.exe
2776	msedge.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
388	Ful_Activate_Setup.exe
656	netsh.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	6068	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6068	AUDIODG.EXE
Token: SeRestorePrivilege	5480	7zFM.exe
Token: 35	5480	7zFM.exe
Token: SeSecurityPrivilege	5480	7zFM.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
5480	7zFM.exe
5480	7zFM.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
4224	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1116	4224	msedge.exe	50
PID 4224 wrote to memory of 1116	4224	msedge.exe	50
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 4916	4224	msedge.exe	89
PID 4224 wrote to memory of 1580	4224	msedge.exe	90
PID 4224 wrote to memory of 1580	4224	msedge.exe	90
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91
PID 4224 wrote to memory of 3684	4224	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://proapkcrack.com/helium-10-crack/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa520046f8,0x7ffa52004708,0x7ffa52004718
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2424 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1376 /prefetch:8
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2676 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7232 /prefetch:8
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6836 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2776
- - C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\Ful_Activate_Setup.exe
    "C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\Ful_Activate_Setup.exe" C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libX11-6.dll
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:388
  - - C:\Windows\SysWOW64\netsh.exe
      C:\Windows\SysWOW64\netsh.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\fm.exe
        
        C:\Users\Admin\AppData\Local\Temp\fm.exe
        5⤵
        Loads dropped DLL
        
        PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,311805577073548477,1489702124461275175,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8 0x470
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5356

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\!Files-P@sswrds__6644.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af9fbc1d4655baf2df9e8948103d616

SHA1
c58d5c208d0d5aab5b6979b64102b0086799b0bf

SHA256
e83daa7b2af963dbb884d82919710164e2337f0f9f5e5c56ee4b7129d160c135

SHA512
714d0ff527a8a24ec5d32a0a2b74e402ee933ea86e42d3e2fb5615c8345e6c09aa1c2ddf2dea53d71c5a666483a3b494b894326fea0cc1d8a06d3b32ec9397d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
aa6f46176fbc19ccf3e361dc1135ece0

SHA1
cb1f8c693b88331e9513b77efe47be9e43c43b12

SHA256
2f5ba493c7c4192e9310cea3a96cfec4fd14c6285af6e3659627ab177e560819

SHA512
5d26fdffebeb1eb5adde9f7da19fe7069e364d3f68670013cb0cc3e2b40bf1fbcb9bdebbfe999747caf141c88ccd53bd4acf2074283e4bde46b8c28fbae296f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
195KB

MD5
873734b55d4c7d35a177c8318b0caec7

SHA1
469b913b09ea5b55e60098c95120cc9b935ddb28

SHA256
4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

SHA512
24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
328bd48896406ed6b617e4d6da1db4c6

SHA1
a5003481cab35b32b09e61517cf4c17d44c67302

SHA256
ee5a73caf4d487769be1dcc85da8279fed378a4ca7177e521ffc040ffde46765

SHA512
dd3ca624b0a39d66b0ac2cdddd7743f9e4d2e45c7e9ccfea42c94d18f0d794c3536c9b39c51b281c0e2ebf4fd4b59e9254b53f9fe6bda0a86d60a9512112208a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
387ab1a8a0e566d20719313a897f7de1

SHA1
f75d7bff06321be5618dfc44ebccdf9df40df8f0

SHA256
76185ffdc336d8e3fd7601686abbbf2d9eb6bbfb483d23c54ffe714b2df8db3f

SHA512
e6c2825abc76be73543dc44dfdb2d01aad27590620739550991097c4a404d719bb897eb3b94b63dbd40553105c7b8ff35d9850ad95175dcfbda517ff8e32391b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
263e78e7ee1141d31b097144be9a8714

SHA1
5a6deee6e55260260a35e172b79194a720e72304

SHA256
d254549eb248e4f9af27866b077d77d1e5d9bdd151978c3bb828521083d49f78

SHA512
4d6e02d9a26a5b3cb2b2fdd3e3de1d2903c28e82a0c9d9c76faf50a49d0f15e7b6e43d6fb64d8f33b68007536475dff1b7bf0977403ef6c7aa76f27895089965

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
dd4623348a32eb557f1d30fc270bbe1d

SHA1
3195a548456ee3b1989dd17c5c5d588669ebe406

SHA256
31c259487297a75f8ce5656617b0720b3d152f26f3ad67424b95da24ccf6ecef

SHA512
6561bffdcfda26ccebcc1c5e8e244a54494d76fd3cb09892f73a25ec9ca1da62f935355041fd4b790f6f7dcc1e42c7577e0edddba95df21538f268dea1f6125a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
fc4562a8af1d0b4f6e6dd926737d4654

SHA1
2f6b6060f031fafc09a7406e21646f7932547f66

SHA256
f2e9ccb4baf5f16c77ca68c26d9fe0ecce19965e6bfc2db474f66f83f5cc2508

SHA512
34628a7311346b9c7873a298f79649e2916d292886befaa9ec0501f390c52f8643aa4cdfa1a7d89d5a2b94b1765c8fc26f48cb5d7bd26ff66c80dcf249de840b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
071ddbee27f27233ccc8979ed3ba0757

SHA1
843d565ec35b56aff4908299499885ddbd6726ca

SHA256
fcf1722cc3726ac14b62ab671a65df8e8014aa33db72160df780947df98cacda

SHA512
c24611b8eddd30cf2c8b0bcf810e9c6a4fa3eb94c6a95ca41e7bd2841624e56f3c890f197ab937c49aa367b6d86a82bdc632f1f4203c6ac0e9c49160a805a49f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e351657c661397fe398c34e403552431

SHA1
464cabb11e4b5dc6b69362a7538b2911bf62d9d6

SHA256
47100f569f230fabad83d4197632b93cca8d5a6d5f853d147a0f797f465c9f71

SHA512
b534c084cbe531898416bb6dc40e15e03b8fd8188306f5bb7ec8a4d7dde8ba2a20e05675851986fa8110c4750937d5684df232d186f80faed3a125e09af13310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
22ab457dc994bfd101ff4c696ec774a5

SHA1
8744ecaba84eded7538cb81bc75f7ed3a2f8c41a

SHA256
91a48471161a75fb7df0450ee68a3e8c275c3598a50c5a12b747a5f2347c6b35

SHA512
a10cb06c6d3ce25b2bccf9c735328422ae1558265d0dcb52bfc32012fb6c7a81c01b1a9518fa3298af093864ba1c717409dfe1192322ac20ed4e1291dae0ce1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
d8588891031fc56788e2542d313333c3

SHA1
91272a6b13c51b0b796d1571c5289710200ba17c

SHA256
2e5de6e23b032596babcac44b64bb543c50cebc950f8412e4c39bc2af88f6b35

SHA512
80af8303fa569aae97133d69f33e04bf937e040d2de04d6b3abd902efd36075be329a266ea3ee4e9c9d7a88be6fe54dba2e7d0374380426209ca6a8611d68364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8b22ce92b7ab3a0d23b0d55f0d283252

SHA1
22d45325a4efb8653bf17eba46fc78b7b755f0d5

SHA256
e1b792b8624ff70d98d77a0da972687f9c8776380d0011c907fa452b2f3fcf2c

SHA512
3ea5f511e738695333ed698eb8787fd434b84ae730801562382bfcc8c1922e0b15ab5ccee1d8cac212c3a9dc089a10c7e2014add6b1f7814b0422dd0ec7556bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
dff3f2fbca2fe63af6ab5ed0c8c12cd9

SHA1
082859c754865cae507b4b3114766983bff74146

SHA256
69de7d91a3666fc83a73a329163ff4b6dd1c710e9ec10721cc40b1537f47eef4

SHA512
0666a1df5282e1c98c765166242fc6ac79c7160c140656caf21b1c40a701df1f4d1b892c6890eb46a58bd22c5060c62ee0977e4037ccdb22985cd9159a75fc9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
75a00c179259dba39e425c5b118db1f9

SHA1
cb87d1f5739b1a8a16f9d037569a0e7607f148f4

SHA256
13ba96a5d393944ee5c50d5acb151f9c4d7da2e6e2587e7948c9dec927b3f614

SHA512
c4be60ad9816497d7ff18f0006be500ba81c7d8979599857ed8c6bbc447a2f93e8c041666ea04e6b81f93b9a62cace2313d741f46d8633bd70a10b1719939b0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
932ba7298b445e6f1444b68e9891e2e7

SHA1
0318e0640289a32905bb69f359d3359be901b22c

SHA256
5f3be9fcb490a4069b621eda8bd734786b6d13dbdfb3bf8ac7f03a59875ab4b0

SHA512
65b8c38a50a127acc207bfab0f969a529cfc213d167a055700986e3466365b309b2569a5356e4a90b5be0f53a15ae8c906793d5a8b57c9880f7e7688149790ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d4f3.TMP

Filesize
48B

MD5
99d3571e3f449e2f4dba0457d91ebe65

SHA1
1e208ed291aafd34b97351288c8e06d552aee41c

SHA256
993cc7047791cbb0d2cd88a1627b843138eef598bb403bfa700a50c894a8a749

SHA512
8d09113bf43a473f71e3ff00f7daaffec003f9e62d30a6f9d7c217a44371c45ad8446a2f611dec7b7248c95d6f1420ff6f0cb0e744ac1c61a8761f94a6cfb110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fa0c15efc12331b3b5d0566b3ff917fe

SHA1
08a5087c90fdce492f71a76c55cb61cbdfb6f6b6

SHA256
f5d19a8ba9e2422eb90e49efdeda9b79c51b295137229c6224c431c2a5fc912d

SHA512
550b681b25b59ef749ce2af49adadc47aaa79526af8f8dd69c32ea0c820048033fad1a3aa68718b45d120ce50177c7a1224033b86299616512d70eb714711c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5796c2.TMP

Filesize
1KB

MD5
e821a86540c013e6bf4f6e4e2327fe9b

SHA1
af7ba97b17fffd75ed20a9e267eb51deb38ecbe4

SHA256
65f4470e98a73c48adf05851b28f2ab5907d3794f3a5838802f097a6f14a33c6

SHA512
af5a52924f6fa75b61b90a22428f2eb765ed3c82ff154427f091dcd601bd2a83ae6075f4ede159327c58151f0b67c1d57dace3f8c0650ccb5d75bc5995196e6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff6e94ce-07b8-426c-9a62-840cdbb09e6a.tmp

Filesize
1KB

MD5
ee95ec5b28ff40376a325eb37e1a57e1

SHA1
b6008378669a0f1a208afcfbbc18cb78a249738d

SHA256
7416555261329670cc7fdec4c0d1d9574dd96a494b8d3c81f76601a5c201a83d

SHA512
033270a5411bb544c14a9fbccbca12819e034e2b7bfc923e2ec7e12c63bda0ffa979a008cc991994050d54c9de902b93c25ef4de769e7278ea7e411b37229f8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
18089a1b7ec127019e6b38a44cdd1469

SHA1
61274156deaab1533377aa19c894d9ed4bf7eb51

SHA256
894dd1bd386a8a6f17ad2b3a37756761a1a4a6d80104bc960c4ffa4e4c9578fc

SHA512
1ec87b22fb76604f1b740b426e0795118118f3e8a3aae75aad907444328fee8cc829ec87a99d1c90d0ed966b0f02be052eb739947094deabb4b7e1885e8fd5d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
ab54cbd846981c315eec469e17070cb7

SHA1
1d6d9396bc5a9e875928697ebc83f847eae0a84e

SHA256
16a2d578070cc3ae9f0306ffe4189a6aa92e13ec7d524a8fc8b64373672389a7

SHA512
584eccd24f6d114a36e1b47997d5214a5b4e3cd9b518202e666cda4e728d0e518d0f7ae2bc7642e0589101ed91266a379c9e56e2e22ac12cfc06e7d79628db28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
44876cf863768668a12c29aafe1c3301

SHA1
3c7028bc44ea9841d5f8b14e8c4d90950d7d4142

SHA256
538fb62a5597d717dc593ccb1a118cf3cc402e3819c655c3e00571fc3771f6f0

SHA512
b67687868327f2acf285f494c0329188cb7b2679c6c39f7cc8a1aa5d9837a0bfcfaf110fb7eb1450447e555b8c247b2266e11b002564f5bc9c1431a1666609a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db

Filesize
28KB

MD5
07a7e72ec3a44f9bacc599313c8f165a

SHA1
81a80eaff90f0e1502616c1417d5324af48a7f0c

SHA256
bd76891a88fb99aff3017d6ac409dac40963369e19d5dca43d3090e5221355db

SHA512
bfec4be6837ff92305a5e0a7d2c2eb80c9ec70e1a0aaeaefe5b8ce64b26fcd654d260a3afff0f9ee4d91ca51aca78d10cdb8b191b19c085e302336d7307a1d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\53b4a05a

Filesize
1.9MB

MD5
d1250ff01302de08df9481dc2ad950b3

SHA1
8613f2b44d1ae31b2940675fada5c7fd2ff4ab87

SHA256
761fcab7c085b8a7e92b07a4c61664bdc75d5a34d18df8a7f6aef8afcdfdef3f

SHA512
8e3caace0c68a3e2f063a61848ba2dc600fe0bd346c426121ba71d733d185d0678972aa417a203f20294f40fe7355bb4bb440a302408f64f5409f3be3f610f9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\fm.exe

Filesize
994KB

MD5
de0ea31558536ca7e3164c3cd4578bf5

SHA1
5cc890c3ade653bb1ed1e53dabb0410602ee52df

SHA256
6e599490e164505af796569dce30e18218b179b2b791fe69764892b3ed3e7478

SHA512
c47299cd5f3b4961f423c2ca1fef5a33eb4b0f63dc232af70ef9da39f6f82270406061dd543461de7e47abd1244e26d6190de6035120211b27d4c23f97a25aba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
ba94e43ae14f4a0f7f8986bcd1012f39

SHA1
84dfa5679c951efc67b2eba21de224d081e741ea

SHA256
3e7cc0a69c524830c52ea061c8432101028e83a41f104d1d168829a942a81ec6

SHA512
bf50e3e21562f307a5c5c6d7227e48cc81f3b7d31cb29a105de75e938760eafda840f52ba927dcf9a1817473ecd9cb735baa3240055097fb8b8593934e33efa3

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\Ful_Activate_Setup.exe

Filesize
3.3MB

MD5
55076afc8f8de2df8f91fb2742bcda61

SHA1
c848bb01e859163b08ce4f58994b3d814dfdf700

SHA256
e3cb1b8edb969533e9299c4169b12df17a01d7516df943b486a785c986ceda30

SHA512
70bf3d76b86b28aa4209a51469a4b2161c4253313849217b5e1267cb17f6279235b9ed18cd975aa48227401b48887f594b3be149531750638091afc51a425d26

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\equilibrator.tar

Filesize
84KB

MD5
f07f53569c594f04b5b15ca6dbe4b455

SHA1
0cc33a3154349fad167f56f24d768177291383e2

SHA256
6a052820e39dc91e9fbbd96f8b5b2180d63266bf156dd3d2dd94af98294c715a

SHA512
75ff71afc83d2b499bcea82034691d1d9707c6a525e8ed24f7469934b7a1fbd607cc8e0a36dc1ebe58c97706dbc8cf7052a4aee49858caa5b18c04cb9486e2bf

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\floe.txt

Filesize
1.3MB

MD5
2f5d924201d8eba70849be648ef80b31

SHA1
608200540445253e34b37d6ef7b590bc82a9f566

SHA256
ab73afc73f2dfb83e424c6805058cdb8e403c09a31b7c0481986ecfa65185331

SHA512
c010affb8170974dc93ae5c7a93496da6e42ac4aa7eb38a2f91ec9a8456f5ce651a6757151ad232495d28cba42c53590bc5e3ddd5a203c9b0d6087ab507a91e0

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\info\level4.resS

Filesize
128KB

MD5
64d183ad524dfcd10a7c816fbca3333d

SHA1
5a180d5c1f42a0deaf475b7390755b3c0ecc951c

SHA256
5a666340f42f0f985772024d90a83d15c9a241a68d58205cd4afbb1a31f1621a

SHA512
3cab59dff09981f49d1070fba06a781439bb1ea2dae0cfcb937d9875bbe9e866be2c951cfc6a3ca4a92aea79dd3e9c4792a765f5a06f230a57dabcab2f0b3c1e

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libX11-6.dll

Filesize
1.2MB

MD5
3cd9af46753f2a618d15157372d0d2bc

SHA1
f2a1781b1a6d33338db4d9725b28f15d8a410903

SHA256
497471497886f18ca16f7facab7d76dc9bfadd69deb9c6e4ea9bdc0869a15628

SHA512
925097106554f6eac698ba933e32fb82c1405c7ccfe284b27f1558e9ab46139506b1e981721aeafaf2e0d595dbdfce3587c4056c6920fdffb0b2f2bdbdcdb38d

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libXau-6.dll

Filesize
20KB

MD5
b6f0655bed934503621fcf94ba449a19

SHA1
f0a5d9eefff5f3bcd2e23b9db748c50cffc1c6e8

SHA256
0da1f856d92d6b95f10ed8c3f629cd15468c906de9352fb4ae629139d1412eed

SHA512
77a10ae1748e5d76288c59933f3f41d4dc7a690b1f2bc9bff0b761f9f2c5331f868dc0259ffe4c4672e1806c33f3f9d0fe0a8b09b10e06333d2590f623c5b284

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libXdmcp-6.dll

Filesize
28KB

MD5
7d4f4d3bc6ab6c3ea2097a7ecd018728

SHA1
2434fbad089ac85eda43c0b0e911ab437b4dfe63

SHA256
7705851ba047a8154402aca92621b60be0e0e9d9b52b19bf8be540305bd53dba

SHA512
f9b64cbcd7c7c7b4e942c3da74fb280762d038f974fc23d1e0431b15787aefc87464cda121aa8fccf499af46e345dd65aa5fb5cfee1cb45dba6e5dd79b01a1d8

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libdl.dll

Filesize
17KB

MD5
ed925bdab51f49813686b62eb82fb4a4

SHA1
bc7c742b92a5b47089e0b400a8a80bb217e775fe

SHA256
e1646c7778c24407a17881908037a49ecfcb5a980d155212d544302653a3ef62

SHA512
5be99a6b0e2091fe37ff50d5a9c4fa789db27b5ba108801e4d18e99ae584ae1bc91ba3339916dff8a323155815e660f43ca54ffcc7c14c1e3f90600aedb54bd8

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libgcc_s_dw2-1.dll

Filesize
114KB

MD5
d35376c0d447108b2f9d64d4c40014f8

SHA1
c68129e8bf6cdaaa318c5aad8974efbc2b7ce39a

SHA256
c7544e1f9927afdf6e8cd7063020b572e60fe8f00af39227eb831d331df38225

SHA512
c46af0bbd3bca6e12125750a5b1ca4f17f85f84729b1c1c01ee76de3704bcdb090212202cf449458833f8ee92e9a46c8758cbd069747de534e2984dccbe9f24d

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libwinpthread-1.dll

Filesize
96KB

MD5
e40b7acdd7654c071b0f2c17eb91fddd

SHA1
6f7f65cacb44a378169cb9066099dccf96f51426

SHA256
b53329b607a4af6d59ce94c2ef79abad5bea6ff7045f53af721f5ca09e6f5840

SHA512
dcdddf8601e733947e76c6c5dca0cd7ffd2eb373ef771e43d411da3ee6d3da40f0a8f34e7599a3b7a6399fb4ee26d501d86acb08b889acc07e95a9a1d6b17a4e

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libxcb-1.dll

Filesize
132KB

MD5
a4212be49e5ce8f3bf3950ca32c4bf14

SHA1
53f8e986e5fa3844eb73f063ed01772b53bc2504

SHA256
394d2d862f2ddce71f28d9b933b21a7d6c621c80ef28652574f758f77f01f716

SHA512
74520d3b3749d2b61e8a970c1fb29c588f98ce477eac4ced8837420153a6e739303aca15ed7d1e070125afa7f3ee32e452815ef1af135f8ed39ef2fce9d333ab

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libxcb-image-0.dll

Filesize
25KB

MD5
a3718d24f0e6eae9d6121a1219381ae9

SHA1
a3377f64d8fb6162f6280d3d924626c1fc6a2fe7

SHA256
cb220267fb0116b298bab6a09a764420d630c52026f7d750f8ffca4818389327

SHA512
43f9c760be222490d43cbd9589b4afbc64759919993a1957a13a753cfcc9d94059dba0b5400a745c377c7bea1f02f4f8f6f952bee5b7ed33f6a49efaec62e9f6

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libxcb-shm-0.dll

Filesize
19KB

MD5
557ed85a1d8a3308e552a77a9902e8cf

SHA1
a9acf7a1db500a734e95038b29c0bd90f7af59e7

SHA256
e102c9c5b22ceb60dc516ab4124bea8ec8e808b08eec48ea7ac674d13fca82ef

SHA512
110acfc0b886a1ff77b5452e2f813213630ba2eb4610e06942a59da78e516e05893b049c0d1ddcc077ebabb3a9490cf84fb41f31b62822c9365b60a1b38fd4b8

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\libxcb-util-1.dll

Filesize
23KB

MD5
ee6788d3d3750421e01519a27f86634e

SHA1
48f4c7dc7bd1208f07e4176e78f035d36682d687

SHA256
b5acf358ff97127eac9ef4c664a980b937376b5295ef23d77ee338225de10d60

SHA512
12ef0ac4cf9c8461044317e693bcfabdb4beb34a222b635ba50f6652b5a91b92ff20cb19e916ac60dca3e8314b7d8cec710a1c730374bb8f260b8d94f57c9775

Download Submit
C:\Users\Admin\Videos\!Fles-PAsw0rd__6644\Setup_Main_Files\zlib1.dll

Filesize
90KB

MD5
7e507af32ca219d2f832cf8d90ca805b

SHA1
4eb56c6f4184efc5a6bb5c7cab46547cfa769744

SHA256
3668c6749db59a6cbc5293d0a4f904f76d6fb5048704449dd53894916f408a57

SHA512
d19c6a0a0798db42490631aa9e30da4200e0b687250daa5ec8bcfe68ae2589a523adeacb6c77544488ddc7610fa84be7477a92c2a27605537a0caec2449c87f1

Download Submit
memory/388-1124-0x000000006DAB0000-0x000000006DACE000-memory.dmp

Filesize
120KB

Download
memory/388-1030-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/388-1073-0x000000006E010000-0x000000006E02C000-memory.dmp

Filesize
112KB

Download
memory/388-1031-0x00007FFA60D90000-0x00007FFA60F85000-memory.dmp

Filesize
2.0MB

Download
memory/388-1075-0x000000006C370000-0x000000006C4B3000-memory.dmp

Filesize
1.3MB

Download
memory/388-1071-0x0000000000400000-0x0000000000787000-memory.dmp

Filesize
3.5MB

Download
memory/388-1076-0x000000006DC50000-0x000000006DC5D000-memory.dmp

Filesize
52KB

Download
memory/388-1078-0x000000006DC20000-0x000000006DC48000-memory.dmp

Filesize
160KB

Download
memory/388-1077-0x000000006DBD0000-0x000000006DBDE000-memory.dmp

Filesize
56KB

Download
memory/388-1114-0x000000006DBC0000-0x000000006DBCF000-memory.dmp

Filesize
60KB

Download
memory/388-1123-0x000000006DBF0000-0x000000006DBFE000-memory.dmp

Filesize
56KB

Download
memory/388-1074-0x000000006DDC0000-0x000000006DDE0000-memory.dmp

Filesize
128KB

Download
memory/388-1125-0x000000006DFD0000-0x000000006DFF3000-memory.dmp

Filesize
140KB

Download
memory/388-1126-0x000000006DBE0000-0x000000006DBED000-memory.dmp

Filesize
52KB

Download
memory/388-1045-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/388-1068-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/656-1168-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/656-1169-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/656-1172-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/656-1135-0x00007FFA60D90000-0x00007FFA60F85000-memory.dmp

Filesize
2.0MB

Download
memory/656-1072-0x0000000075340000-0x00000000754BB000-memory.dmp

Filesize
1.5MB

Download
memory/4616-1201-0x00007FFA60D90000-0x00007FFA60F85000-memory.dmp

Filesize
2.0MB

Download