Resubmissions

23/02/2024, 13:06

240223-qcaxlagh64 7

23/02/2024, 12:51

240223-p3xnlsgf64 7

23/02/2024, 12:34

240223-prvd4sgc56 8

Analysis

  • max time kernel
    721s
  • max time network
    727s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 12:34

General

  • Target

    PollyMC-Windows-MinGW-w64-Setup-8.0.exe

  • Size

    36.6MB

  • MD5

    77f098ad333889de410f665e4f9a8702

  • SHA1

    6b8e8abe6a374f02a88058961f180818cfcf7670

  • SHA256

    1c04ed11ce29fcfc3186144f0f907b70296132eb3db89044463cb14b97eb87d0

  • SHA512

    711326a015e02dd4789023fbefeaedc769d0ef33668497c107cb3c512a2acc2fa312d3cd5011d3a510ccb87ce236bfe0fc1d4b253b332c2e6ecd9ff6e7c6af9c

  • SSDEEP

    786432:2KQbhz5LGoCjmcE/ppyp22HaxvPAXkFeOLV61DDKr0wlqDIgtQ:2FLCjmphS2iSvfJLQxKr0wlw2

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 55 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies registry class 7 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PollyMC-Windows-MinGW-w64-Setup-8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\PollyMC-Windows-MinGW-w64-Setup-8.0.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    PID:3788
    • C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM pollymc.exe /F
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:632
    • C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe
      "C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:4792
      • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        3⤵
          PID:1308
        • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
          javaw -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
          3⤵
            PID:3408
          • C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
            3⤵
              PID:1632
              • C:\Windows\system32\icacls.exe
                C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
                4⤵
                • Modifies file permissions
                PID:548
            • C:\Program Files\Java\jre-1.8\bin\javaw.exe
              "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
              3⤵
                PID:4568
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
            1⤵
            • Enumerates system info in registry
            • NTFS ADS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3236
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffcd13946f8,0x7ffcd1394708,0x7ffcd1394718
              2⤵
                PID:4500
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4628
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
                2⤵
                  PID:4880
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
                  2⤵
                    PID:376
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
                    2⤵
                      PID:4680
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
                      2⤵
                        PID:4700
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
                        2⤵
                          PID:4016
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                          2⤵
                            PID:1048
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
                            2⤵
                              PID:3908
                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4148
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
                              2⤵
                                PID:760
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                                2⤵
                                  PID:4684
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4880 /prefetch:8
                                  2⤵
                                  • Modifies registry class
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2796
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3476 /prefetch:8
                                  2⤵
                                    PID:4980
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                    2⤵
                                      PID:3328
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                      2⤵
                                        PID:2288
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                        2⤵
                                          PID:2488
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
                                          2⤵
                                            PID:1676
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
                                            2⤵
                                              PID:1168
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
                                              2⤵
                                                PID:2080
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6036 /prefetch:8
                                                2⤵
                                                  PID:4456
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
                                                  2⤵
                                                    PID:1780
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                                                    2⤵
                                                      PID:3004
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6588 /prefetch:8
                                                      2⤵
                                                        PID:3184
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
                                                        2⤵
                                                          PID:4084
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                                          2⤵
                                                            PID:752
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6480 /prefetch:8
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:4272
                                                          • C:\Users\Admin\Downloads\JavaSetup8u401.exe
                                                            "C:\Users\Admin\Downloads\JavaSetup8u401.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:4760
                                                            • C:\Users\Admin\AppData\Local\Temp\jds240645171.tmp\JavaSetup8u401.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\jds240645171.tmp\JavaSetup8u401.exe"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5076
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3024 /prefetch:1
                                                            2⤵
                                                              PID:836
                                                            • C:\Users\Admin\Downloads\JavaSetup8u401.exe
                                                              "C:\Users\Admin\Downloads\JavaSetup8u401.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:3492
                                                              • C:\Users\Admin\AppData\Local\Temp\jds240660609.tmp\JavaSetup8u401.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\jds240660609.tmp\JavaSetup8u401.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:1880
                                                            • C:\Users\Admin\Downloads\JavaSetup8u401.exe
                                                              "C:\Users\Admin\Downloads\JavaSetup8u401.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:3984
                                                              • C:\Users\Admin\AppData\Local\Temp\jds240661000.tmp\JavaSetup8u401.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\jds240661000.tmp\JavaSetup8u401.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:3272
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,15666735005034742888,1644469770588826466,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
                                                              2⤵
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:728
                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                            1⤵
                                                              PID:1580
                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                              1⤵
                                                                PID:4456

                                                              Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • C:\Users\Admin\AppData\LocalLow\Oracle\Java\jre1.8.0_401\Java3BillDevices.png

                                                                      Filesize

                                                                      27KB

                                                                      MD5

                                                                      8e52efc6798ed074072f527309a1ba25

                                                                      SHA1

                                                                      347d4c6b4f92e7315d9b199a97dd5cf7d86b2431

                                                                      SHA256

                                                                      12491ebc4eb99bf014d3bc44f770114bde013e84cbec2633303559a8c6e5f991

                                                                      SHA512

                                                                      0653c6e7f94ac36fe555db3eda8465f99d17cdbab91ea6413c6bd68dbbbb4db5df06e5d62768f6f4dfcef8d207d771e0b6924adfe403b92729bc4c5689e4fca7

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ecce2d6-1c82-435b-9df3-8f2720c07c89.tmp

                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      3bc291ee848f49e79b7e8ce40e02bd95

                                                                      SHA1

                                                                      5d69162d852da694f9af303a971963554b613b60

                                                                      SHA256

                                                                      1c438cd5457d957604d9d1686b8950852318727fd8e3749971feb8fc1254995e

                                                                      SHA512

                                                                      c46c757a415eec7bf330a332e377e3353ef919bb894f273eb24954fa77eefd168a0bb44fec64935ad3365b93bd86389665583752273fba62c978af38b88f347b

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      d4c957a0a66b47d997435ead0940becf

                                                                      SHA1

                                                                      1aed2765dd971764b96455003851f8965e3ae07d

                                                                      SHA256

                                                                      53fa86fbddf4cdddab1f884c7937ba334fce81ddc59e9b2522fec2d19c7fc163

                                                                      SHA512

                                                                      19cd43e9756829911685916ce9ac8f0375f2f686bfffdf95a6259d8ee767d487151fc938e88b8aada5777364a313ad6b2af8bc1aa601c59f0163cbca7c108fbc

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                      Filesize

                                                                      152B

                                                                      MD5

                                                                      343e73b39eb89ceab25618efc0cd8c8c

                                                                      SHA1

                                                                      6a5c7dcfd4cd4088793de6a3966aa914a07faf4c

                                                                      SHA256

                                                                      6ea83db86f592a3416738a1f1de5db00cd0408b0de820256d09d9bee9e291223

                                                                      SHA512

                                                                      54f321405b91fe397b50597b80564cff3a4b7ccb9aaf47cdf832a0932f30a82ed034ca75a422506c7b609a95b2ed97db58d517089cd85e38187112525ca499cd

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\194a0346-d7b2-456f-be43-ae1e82661727.tmp

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      3f560408ac0b432a50b91500ea3f756b

                                                                      SHA1

                                                                      81a28a65bbdbb8dd4010a8ab4f50864646c2619a

                                                                      SHA256

                                                                      fbee3b9243e9fa1bc1dcad89b21b4cd3a11dc309b8aaac0fe8664f39170cb887

                                                                      SHA512

                                                                      3112c09f76b98afefb516cf95037085340f0e93bce40d969639635ee327bcc40b0c09d51cb63ad2e4f029f8259159605c3afd11aa60ccd6fccd5049553c4ab50

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44ba394e-1a05-43cb-921e-bbfcb84fa2f6.tmp

                                                                      Filesize

                                                                      6KB

                                                                      MD5

                                                                      f10bdc07e7478de50ca493d6c058c0de

                                                                      SHA1

                                                                      a728b0b0b85a59252f39508af0c850f9c6d4b2a9

                                                                      SHA256

                                                                      a55ad5e45c17cc867439d4f7a24f1879a949ee814a800fa39b8406e73af8c5b6

                                                                      SHA512

                                                                      c26f21445c08a749d5a12097ae8b9531d37d8031fbbc4c6837f5d75fb716b130b7200e39ce62aa55a28ed2180941eeab9c896c5be91964ac7b74fd663195a262

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c34d31e-ff20-4a79-a5d8-eb65181918dd.tmp

                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      096724b5fed052745d9044edc9db9cea

                                                                      SHA1

                                                                      76be411abd1ed886782b03c1c828339bf71630f5

                                                                      SHA256

                                                                      2b15855a751bd05017cf65388e8a9f1b0293caf2617f6b568386361622c685cb

                                                                      SHA512

                                                                      4be3d2acbf242a8ebdc19c6f2c745487352dd6b554a0b851db7839c37416e135251bd529a2dfd3a78bf9190266817f5bfa0331d9e2558c72bcd7d78f3cc7ee4a

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                      Filesize

                                                                      2KB

                                                                      MD5

                                                                      d95890859071eb18dbd45e13f70a95d2

                                                                      SHA1

                                                                      41ed0502a306ba1bf3d88b2575cdc53fb6c3a320

                                                                      SHA256

                                                                      485ef2e6507cb58cccf4bfc0b2f28a439bba3f1e75fcfc6c8982d00f828eeca1

                                                                      SHA512

                                                                      688d229967aeab92ba84c2366deb959494d0f928b91efea22010b34f28847222c1c28ed69da3b901e488a069d166fb6278931f4871c1c511cd10619b9add2068

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                      Filesize

                                                                      111B

                                                                      MD5

                                                                      285252a2f6327d41eab203dc2f402c67

                                                                      SHA1

                                                                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                      SHA256

                                                                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                      SHA512

                                                                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      968e284258fff9989c9b9416e9a78626

                                                                      SHA1

                                                                      048030018f4d2ba71b208268f1caf8f532ebd436

                                                                      SHA256

                                                                      086bd0cbbf646056bb2c4d01f7c36d0d5f0c7a40628c25200e053ed5d0f56e25

                                                                      SHA512

                                                                      432000aa1ce4266ab4a121a884b1ad0cfabb9c1068bd2c9e5678c868525b5a8908b93f45141c01e576634a381c20f9853685843ebb84c4c895d7a30f12ca9b07

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      2019f086636361b0ebf95def5845f9a6

                                                                      SHA1

                                                                      c79821491c4bd19c1f233805eaf60fbbbf5dd2e4

                                                                      SHA256

                                                                      83ba3c81de47c9af8e044595f57b3cd2771ce66a42cad124082985c8e15f524c

                                                                      SHA512

                                                                      5329647fc99e966adca1a51d0fe3d58706f7ee6b5236891da656ab95a031eac221ed8ae9709518f08a1861d3a2a357a833f03d5b5304ad2f35513e9b1a374623

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      5efb85d82e3989c47fccc670cc7f84ac

                                                                      SHA1

                                                                      d5cac607c58b0eec5736cc6d71ea7f0082a3b7b3

                                                                      SHA256

                                                                      806c542398d4eadb1aeba40befe25b8b7358211a74f79ed5ef27586c903f9db5

                                                                      SHA512

                                                                      7d5deba478a4494e0f2b8367766b7caedaab29a1b649128330726ab0dc60ceb644b4f6a77787c31dc77e77bd7460da1d6fb307f024852add1cfd0727d0e490bd

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                      Filesize

                                                                      1KB

                                                                      MD5

                                                                      b3e9a853b42d14163196186ce8758c7c

                                                                      SHA1

                                                                      0551aef7fba6741a83805f25b6caae4773f25595

                                                                      SHA256

                                                                      c889c53fb3f71da64c8d73d65615eecd37f39ecc225a592edcd36f15e40e0041

                                                                      SHA512

                                                                      c518a05b24c10d23d7570b912cb03edae3642caa6f4ed4cc4a5aa250719e94b12231c58a336cb617f968a866f6638c872859564c7a001bc9a25437145c6ebf2f

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a0c4.TMP

                                                                      Filesize

                                                                      870B

                                                                      MD5

                                                                      d4cfaa5bedceb1f99f13530ba478aa97

                                                                      SHA1

                                                                      c14586ef82df2efc0bddd3e124615407f3dbeccd

                                                                      SHA256

                                                                      977ba25cf4963703bf0ac0fda8e48196e56dee42a6512c2ce151490c46b54d33

                                                                      SHA512

                                                                      96e8cdf93b8874699e99012323065027f4e9a176a6f65d91b5ce778a783b02adf5a5e5ba0b47a009a11092eb0eb69503fe2832105beecce3c482d82cfe4becb0

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                      Filesize

                                                                      16B

                                                                      MD5

                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                      SHA1

                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                      SHA256

                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                      SHA512

                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      e63b8d5e665ab0525588e0dd3345d0a7

                                                                      SHA1

                                                                      d84750703081baa95613286516026a303749d5a2

                                                                      SHA256

                                                                      d4125d543a28410b684aa8d772d7b4f075b7a0c69dff88f549222e53c35bf4ab

                                                                      SHA512

                                                                      39897563bc9dd3b98f708f3d41b7c68cf67f8e437b1ac3f5f07305c93ab4ec450d6694826a66d2aaae165797e8cf25a4f7409f279b757f94ae1a98d9db598bfe

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      295f925322b336e839089f1bcbe7a870

                                                                      SHA1

                                                                      793160c5f33f59e3b75a7c6576e55c6c1a48417a

                                                                      SHA256

                                                                      74cdf67fca21fbbffa367ae48b599b7dc5b99a665c68a673ba9ea459ee3f6e5a

                                                                      SHA512

                                                                      8be6830eec9cbd83da8bd166daa5a51a1a914dd64eb54322cb9ad3a5438b1bf09f37bf45811ce1bf2265bc028a38cfe2f9eb93f0e8708b14b92a44a898e325d8

                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      a6fc556c0f16d926e330cde74b9bae8a

                                                                      SHA1

                                                                      951656e56e9c6dc083cc24de1ebd8807119efecc

                                                                      SHA256

                                                                      5d5288208affa633b8eee96ccfc873eba9dd6e461645e4822ed73674199fb636

                                                                      SHA512

                                                                      3f6b59059b7cbaf968af8ad0ab70f4d5bb78f2f05eadf3ecad567fe6ae307e4337827a0e574faf7d2ea04151f756a7fa9f2b6632523a5cee19426091efcd2375

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Core.dll

                                                                      Filesize

                                                                      384KB

                                                                      MD5

                                                                      d96d3faa17230a98abc9bfc9bd44451e

                                                                      SHA1

                                                                      aa77383560eed940dc5a1183f5bfffe3ad8e3b74

                                                                      SHA256

                                                                      c83c760462cb02bead2d1381db0f1c42b9f859aff4b94141686d7f62a4395297

                                                                      SHA512

                                                                      311d5ec83af6841ec2b40948690b3a67f563e293abd67b843a3739aad737f2ac84023917150e14ad408edafb93a16bc826cb125c8eb308703fc1ac683f152c34

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Core.dll

                                                                      Filesize

                                                                      3.4MB

                                                                      MD5

                                                                      810c13ba0c74eb6589d26ce18bdb54e7

                                                                      SHA1

                                                                      27770493a50ed9d1a9e371b9543ef45eb7c416f7

                                                                      SHA256

                                                                      733326e03f7db3b29ee37f3f589cf9db3c0cbba61384bf61535ecc60fd6ea86b

                                                                      SHA512

                                                                      29e7ec7c5f4fdddc6643934a688755d20eb8bd0718a59d02fc26e286a3f61668b568ea59f00c8d24e713bbd3cddaca7cd636481e8967c315bffccec7f96dc8d8

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Core5Compat.dll

                                                                      Filesize

                                                                      408KB

                                                                      MD5

                                                                      ab88dd4c87ff60a81b698c5b194d0d92

                                                                      SHA1

                                                                      a5c114e642297ee477db5f38286d5e24eafe1920

                                                                      SHA256

                                                                      792cdcf3a9843bd46e1af141029e714464ce125a45b74582b5de1d7ef01801b5

                                                                      SHA512

                                                                      43089e7cd5bb983af01413d2774febfefebfc85cccdcdfe7097eedc8bb571c5b90ffb269a6c5e029b8db8aca96d32c2cf9c216211dfe762db5167e6e52f66f3c

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Gui.dll

                                                                      Filesize

                                                                      320KB

                                                                      MD5

                                                                      2dac4be9f1020bdf2f0b4b88fda2c35c

                                                                      SHA1

                                                                      606e6325128e7c91793b3971b41a4c7df892cc58

                                                                      SHA256

                                                                      966cf7895626d7b37889d541ddcfc35bbc9e9552c9b97956b8f7cc066bb1ca33

                                                                      SHA512

                                                                      48fc522221c63cc1a1547f49205a47fe1c0582202601d23d1eef2011d9732bbf12e6ad710b8afa55a4387615b871f254f94617dd724bd7ca64553835c3952002

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Network.dll

                                                                      Filesize

                                                                      320KB

                                                                      MD5

                                                                      53009463c90bad2a966547048154e83c

                                                                      SHA1

                                                                      87f14771ef5a33b6473709b6eb768f9202d30908

                                                                      SHA256

                                                                      16b26514406b48242cf872a4f8594218cc0dc665e6e0ad3c611389462b516729

                                                                      SHA512

                                                                      895e7bad3c136f3d1f7e6cec9111ed2357b67bb945ce9534a7a743fbf4d1504ded5a0bc25ff0ca9e38b7ea70be7768be1416115c57403e9fb747195c79627a52

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Network.dll

                                                                      Filesize

                                                                      2.0MB

                                                                      MD5

                                                                      0f315a61e5d7a8693c55458f9576f292

                                                                      SHA1

                                                                      8a9e1caea0f3f629f3def7d05e047a9bf0173942

                                                                      SHA256

                                                                      ee860831eeaf34792d403b1d42fb5313fc0b3396c370f8b36924491f159c85f8

                                                                      SHA512

                                                                      de85ac62c0d596e5f147770d0b6ef2df9ffce2d51331e36110838816da49150c52ee33e2eda961d7749274ff20ce6ac10e10e421662a4c92e7190c2e771df397

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Widgets.dll

                                                                      Filesize

                                                                      3.8MB

                                                                      MD5

                                                                      d4a5ca9f2e0eda47509adfacbd804a7b

                                                                      SHA1

                                                                      5212338cb3d0437bb1219ddbb5ac6c5a1c35bdff

                                                                      SHA256

                                                                      dbbb93d49898e4dff746ae69e06ac425cf27500c69e359d6456171bd351b2146

                                                                      SHA512

                                                                      22e9a61855d6d69f012a969c2e5cf272ba2889ac767c453ce10b10719d12b5428ec8eab8efbfe623342ae49a0800053c1c054d66db964b0e182369c0db5d1732

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Widgets.dll

                                                                      Filesize

                                                                      3.5MB

                                                                      MD5

                                                                      3fefa6aa74b9c47902cb52a8d93257bc

                                                                      SHA1

                                                                      7a7cf62b7f2bc51f8fbfdce70766a22cb8fae35e

                                                                      SHA256

                                                                      e5395ac714f0b7a836b74c547a18cc3672ca956f8ebd1405fc61c5ea9e4d95d6

                                                                      SHA512

                                                                      2827ab0c459f6fa50907a8f7e99281bb9a12c65cad9d6f334983e2521fc2cc0d7d437e2a51b8a46d5c02dc1bf80c3e9ad8e7c9100dedeab23007a69a6db705af

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\Qt6Xml.dll

                                                                      Filesize

                                                                      187KB

                                                                      MD5

                                                                      63e76c8c687df6aec9f41e3d8a1d0746

                                                                      SHA1

                                                                      7577d4d681c012a3ded924e2f30aa6969ca5e815

                                                                      SHA256

                                                                      04ff3840b3a84ae2ed1b4a388a5e6ba5e7fe05f64bde8919d10739a7fcb8917e

                                                                      SHA512

                                                                      e4a65b254b0e7b2c1cd0f19d6c3b7df5b044ed7f90aa08e8163f93998624f6ffee13715796f55c5a780b77ac2c900fd2070dbf9b2799ba43f3b0d8fc7cc5b141

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\libc++.dll

                                                                      Filesize

                                                                      1.4MB

                                                                      MD5

                                                                      0314b68d4684f7fa62c9273df902bced

                                                                      SHA1

                                                                      c8cd94d2a41c66c56b3dd465868c800bfd201a83

                                                                      SHA256

                                                                      7c2515f1a68339b2f100a56aa69c2fbd1223a1e649caaf220e3b81c779a1b08b

                                                                      SHA512

                                                                      de5219e3e2d415b1c02b64191b4de51ae6080059495f8109bf01a88365a27ac1691012a11ffddb81279fab792453f67a148def4aa52c012a8a9b6a7fecf4fb25

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\libc++.dll

                                                                      Filesize

                                                                      320KB

                                                                      MD5

                                                                      c42087a277a4b821859cf843836ab723

                                                                      SHA1

                                                                      931c0438d24ef726fd2d904d692e4219807d570f

                                                                      SHA256

                                                                      c6dfc8dd0d725a598c1030970c4f405f1c59c02058aacef4474001f7f216b31b

                                                                      SHA512

                                                                      73290e78fca0d612f81027c151094b38a677c075c7dfa07cd10288c2e819245b9059c1e691473082b6b1d7513358820ca18cef03843cd3b304bd4c59722c1f75

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\libcmark.dll

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      20bc39efead1fb6238b18b4c89bdcd51

                                                                      SHA1

                                                                      ae0f84a694cce1a8a7546d16c1b05aa29af1dc92

                                                                      SHA256

                                                                      64a28e8b2ddf3a3899260202ceed027c87334b3a53dc866c4dd7387b58ec7cd3

                                                                      SHA512

                                                                      3ea643fb35f09991bae04e5195e75048e3b9ee01bc521e056c8a402179c2c495d05cd098a741e81d6128394030ade8be978113bcb379dab4e757d90f2797a23d

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\libquazip1-qt6.dll

                                                                      Filesize

                                                                      250KB

                                                                      MD5

                                                                      92fd1c7887462c3e2d8c4b75329c14d5

                                                                      SHA1

                                                                      3305b83190612b47a90f34e20687fc2159d8f7e7

                                                                      SHA256

                                                                      3f06ff804caff1aa10da61ff9b3c8e060b1a9ad54cf336e582bf7422f7ea639e

                                                                      SHA512

                                                                      61a25ff7ef8f7651c4798659a17f9fdd2111752e9cc5da13488d54da8e90fd3e1259dac69342a19cf2f2b882df2442d290dcd72bee2ec7fc6c610c3fe0f99fcc

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\libquazip1-qt6.dll

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      798f4ba444d85d9552ba3a43d59d502b

                                                                      SHA1

                                                                      2328f76036230c1a45a3d5a1678294dcc7a2f43f

                                                                      SHA256

                                                                      919baf2cf28412c294561078addb0def462597de29415ac8d8a6ac5e49f6760d

                                                                      SHA512

                                                                      3c66143b5a2f628dd7d8eaaa6ce6aebc91ae1f291bf8f09ff5e6f7db4999cdcab4b6f35adc1392059dbcc33d9f214ea040e3ed9593aa601e19430550a92c8ccf

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe

                                                                      Filesize

                                                                      15.0MB

                                                                      MD5

                                                                      7e16ac22948dde905e026a5d90ec0769

                                                                      SHA1

                                                                      6557efdbd738f4f599f31cb237161cd02002131a

                                                                      SHA256

                                                                      1c036bf953ab1a11047fa460016b7f768e71cdea9ddc2c7bbef62ab2e93f9a35

                                                                      SHA512

                                                                      ce14f12b9d78a1a38f08154568e38fc5ce807c31c1e5125b2f766467c9bd29bb25b4ef51486b34dfa7647ed4c4fe505ef4f407e4183985d88a54c5f1f6925faa

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe

                                                                      Filesize

                                                                      448KB

                                                                      MD5

                                                                      562e3d1795a21a1787a2e825be45e097

                                                                      SHA1

                                                                      6d113b40bc0fb2aee4ceb0c15aa3701d222356fe

                                                                      SHA256

                                                                      304d948690e58dff2aa924e2f75c8c97516ff9c247a6ec9a3b280326cef61dfa

                                                                      SHA512

                                                                      423e2d144d0c7508aa36274cb9b3bc902a3395fe9c46845aa051ca71fbcfb23876554f227c1a0c8b0c195bc104d00aa787df756ce6ea1805d429e98f534b180f

                                                                    • C:\Users\Admin\AppData\Local\Programs\PollyMC\zlib1.dll

                                                                      Filesize

                                                                      64KB

                                                                      MD5

                                                                      b90c185c715c2b2ce68cefc8db82f254

                                                                      SHA1

                                                                      2399e58d0aa0787309a2d7cc355a6cf048474a51

                                                                      SHA256

                                                                      417ba013bf0aae808c58cde7991efa8c436bf6ce7323fb2de8ebdc135f2dfe71

                                                                      SHA512

                                                                      3f539dceb19843c1cfce88dbfad6744feda5ffe85f6529e755629e1dc940ccbcfd452c811131501dee46e91e5782c4a3ee4462c42de1aa36b19de565e4d0ca46

                                                                    • C:\Users\Admin\AppData\Local\Temp\jds240645171.tmp\JavaSetup8u401.exe

                                                                      Filesize

                                                                      1.9MB

                                                                      MD5

                                                                      24ca1c45b2830c06a9bd61e0158d9953

                                                                      SHA1

                                                                      d18e796dcf31fc4f8a176f80f4140b7e128718ca

                                                                      SHA256

                                                                      0e6c46fc45d9a7a8ddd13f67ee05cde85212c8391a09c917aceb375c26adccdf

                                                                      SHA512

                                                                      5171c318fb069f82e14c1a73b4e011e846b1dabab5e8b8cbdb1d830e7a98a5c3af25e2bdb9172e512ba560a04fcb8311e10c3c42e17536fdec345a400d4174d9

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      154KB

                                                                      MD5

                                                                      5984954c805ab4a1669303ccee55e7d1

                                                                      SHA1

                                                                      5a5507b6ba9a0b36c72e6f8e8b33a7d1d596b409

                                                                      SHA256

                                                                      c1a5a1fe905945feee3b7aad03048b5c6e8bb6e247d7904564ae77369d0d31aa

                                                                      SHA512

                                                                      657300df5d1e827cf3d8bd95b04fc97babb87a3fc54c0cd52dc1eaa8578b34784bf8adcaf288e37979c1bcd4dd7b15ccecac5fb03ff3b0fe4a59c222980719cc

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      155KB

                                                                      MD5

                                                                      edb4743187dedf9d0c6731a99aa969db

                                                                      SHA1

                                                                      322f63d3413c4f872554f7f6d0e585622967570b

                                                                      SHA256

                                                                      0ce007fc27da85fc06889dd2c3256f8c8f52ff92c83c06a7049ee4fc4aa15739

                                                                      SHA512

                                                                      e7bfd4e2bbd2346cb14079e5f0a5d032b451a1a4d4d0bf7f0e5ec6b8bb6b63dce6f538a4fb2da4c8e1a1cef7a5105f012b5dea80b750081fc1b851d60fe5ecb9

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      182KB

                                                                      MD5

                                                                      2de1b43fc057200d83a20ec17ba789f4

                                                                      SHA1

                                                                      30bbae5fb264b83b05e197fb9d48ba1d249a81a5

                                                                      SHA256

                                                                      ebe2121c1b00211339bf4d74b24b3f64eab2077da0e0d6365d671d7ceb2639e1

                                                                      SHA512

                                                                      58ad510ed22c9001317837a4291ffb5fa52b954668ceaee6117a544c6525ed45a2935aba5704c5d3ac8690274182899798e7e1986851dbc73444b0e6ec0c5715

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      188KB

                                                                      MD5

                                                                      2c5727c04da42327307a266bf6caa3b0

                                                                      SHA1

                                                                      3ede98be053fed84c65a99ce195ac52af1be4e92

                                                                      SHA256

                                                                      4fd6fc24476a79c3f10d00b558a91e8960a493d23d537c2d338e0bb23cdd78d8

                                                                      SHA512

                                                                      d34fed63f08969a209865b31b585629024ed50fdf77dec34f4203c2cf1741ace792616b6b5686bd8e2f6f5950ca9d7c7413720db9eb73e5201afd85f37379288

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      199KB

                                                                      MD5

                                                                      03ebf11e4643fedddcdb152696b889be

                                                                      SHA1

                                                                      9eace9e19fece91f998262486d391644e9f09425

                                                                      SHA256

                                                                      06c88866bdb5f986231b22692a349777a31af7ce4c4d8071585dd5048fc2c2c8

                                                                      SHA512

                                                                      a5374d99ff8d73eee2e29a8890fb2d9576bb6a04907c6d02f5837368aaab9de53030fc85f734c76f4aae0e8b362437827f3ce2367efbeda9f4b17361861b1e7c

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      204KB

                                                                      MD5

                                                                      129c5496d5af7225c54a30697c11381d

                                                                      SHA1

                                                                      64045cda34445867629f179a7c3fe9ef31949de3

                                                                      SHA256

                                                                      22374119ad2e09be6ab6aba72dc25bcf599bab9de2233129e5e720a37a5309c6

                                                                      SHA512

                                                                      30b65718c03ba16ecd3919155366014aeee138720499ba14ece5eaac61824cb4b40eeb32a30b36e7f9cd9bb2bb126496863a62c102c9a5f25a0e55dfdb9ad391

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      215KB

                                                                      MD5

                                                                      a10662a647e89194fbd55eaccbb344ef

                                                                      SHA1

                                                                      4a66075e56ac24514f4bb07ca2d2a86b7e10138b

                                                                      SHA256

                                                                      5986fac7e16ca9e35378d50fca52582a57b559d8e66b96fd4ca4509fae2357c9

                                                                      SHA512

                                                                      0c416de4a0a89234e142831fde4b53cdb76903a96c9af55e56e97c39b3397b8983c717650c597310809f33fd07b4092960b22dae992c01c7d6fd254c4da09323

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      215KB

                                                                      MD5

                                                                      a2ead8584ca1873ea811a893a6e4f9c1

                                                                      SHA1

                                                                      04d7d299c5627151009ce610630ca191e216b2d4

                                                                      SHA256

                                                                      451839d3057ccc1dcb30021de4dd534162259116559be62e6a35cbe3d941f07b

                                                                      SHA512

                                                                      833737310b872f24ec55973af4cab4a7fb8369af06faf7d1addc4ecbc6625ba0d5613733c3f3f722f4f654a008dbab25d5f21ad608cd69b0bbc6d43c19b6dfc1

                                                                    • C:\Users\Admin\AppData\Local\Temp\jusched.log

                                                                      Filesize

                                                                      216KB

                                                                      MD5

                                                                      18fd73b954953aca278638c9fb667a85

                                                                      SHA1

                                                                      35f943452b28e0b90d576840a5df8e5dfda42c8c

                                                                      SHA256

                                                                      353cffe7b9cd764c0a5ff4da74c1058b535ac2a99c546a749402accd2d42d820

                                                                      SHA512

                                                                      a4d52b6cdbf04edf24c47a5eb874dbf40b8793fb7d7923e2014c38e2badd4e9d269891b3d9f843c5a420f259079816746767284d17870b0e90afdbca35337848

                                                                    • C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\System.dll

                                                                      Filesize

                                                                      12KB

                                                                      MD5

                                                                      cff85c549d536f651d4fb8387f1976f2

                                                                      SHA1

                                                                      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

                                                                      SHA256

                                                                      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

                                                                      SHA512

                                                                      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

                                                                    • C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\modern-wizard.bmp

                                                                      Filesize

                                                                      25KB

                                                                      MD5

                                                                      cbe40fd2b1ec96daedc65da172d90022

                                                                      SHA1

                                                                      366c216220aa4329dff6c485fd0e9b0f4f0a7944

                                                                      SHA256

                                                                      3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2

                                                                      SHA512

                                                                      62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63

                                                                    • C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\nsDialogs.dll

                                                                      Filesize

                                                                      9KB

                                                                      MD5

                                                                      6c3f8c94d0727894d706940a8a980543

                                                                      SHA1

                                                                      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

                                                                      SHA256

                                                                      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

                                                                      SHA512

                                                                      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

                                                                    • C:\Users\Admin\AppData\Local\Temp\nsk3903.tmp\nsExec.dll

                                                                      Filesize

                                                                      7KB

                                                                      MD5

                                                                      675c4948e1efc929edcabfe67148eddd

                                                                      SHA1

                                                                      f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

                                                                      SHA256

                                                                      1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

                                                                      SHA512

                                                                      61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

                                                                    • C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg

                                                                      Filesize

                                                                      116B

                                                                      MD5

                                                                      30da12d95284de0729a8ab4951f516fa

                                                                      SHA1

                                                                      334ae8d4c458af7a10132382caf635072520189a

                                                                      SHA256

                                                                      845b2fd27e9ce966fc6789435fdbbb62facaec4295122323ed331c1640ca7e6c

                                                                      SHA512

                                                                      18d4a478795ad3202aa54efa5db0496c6338fa19803c137bf9c1d6d1f6481a365904ddf89ee854a553c55d4388fa95de575498bbfb368928f1e08a28e7d8b661

                                                                    • C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg.TcasOn

                                                                      Filesize

                                                                      151B

                                                                      MD5

                                                                      fb5c1c74372450388b3d734f8ff0229a

                                                                      SHA1

                                                                      dfd51c18accb781158eb8c7097ec229be7e85100

                                                                      SHA256

                                                                      a45b320941050c5efd4d442833231cbace70f0e595c983a2d7f74f294715b9c3

                                                                      SHA512

                                                                      ecadd19337a7401e79089bf19df188688fcc93109058bbe699ebd7c24e9d155ebd2e8739e338844d5971b541b1c5330b6f341b26973a6b6b8f8a677a19fb92ac

                                                                    • C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg.lock

                                                                      Filesize

                                                                      60B

                                                                      MD5

                                                                      06c2cb3604ac0cb0958665c5ddaecee0

                                                                      SHA1

                                                                      f709bd09a8732c68cc2ed834dee79dec9704c746

                                                                      SHA256

                                                                      1ac4f5f359e7965d202e920d80b7c021dfd30c50d640d1212c469d61e71681ba

                                                                      SHA512

                                                                      a7a26cb6f56066e0ad3ffe13398684b21f495b54a9205a50161fb9da348da3cb456df8998349609169cca7a6e04cb9ca293d105a12d95b122794eef60f363685

                                                                    • C:\Users\Admin\AppData\Roaming\PollyMC\pollymc.cfg.sXvShN

                                                                      Filesize

                                                                      30B

                                                                      MD5

                                                                      a6dc16331f06bc5831e5ddc9799284ec

                                                                      SHA1

                                                                      d344f83d549df8c3e2c959182ba37f8c81d885a5

                                                                      SHA256

                                                                      9da99b49301ba83c33387e75d2028185562479e677b6afb110b4f8b098465807

                                                                      SHA512

                                                                      43e498eab5c6f9b2f70c01e0abd4e63edb2651e498f267b53c7f62f2ef9c1eb68fa4783967fdba1880722a8bcd6e58065108f42773f0f47c04c9e54e809b1c14

                                                                    • C:\Users\Admin\Downloads\Unconfirmed 646718.crdownload

                                                                      Filesize

                                                                      2.2MB

                                                                      MD5

                                                                      6b561cdbb5c764d8b7d1b2dd583e1fdb

                                                                      SHA1

                                                                      e6ab66aa100f8a04b183d188193c693d01122f76

                                                                      SHA256

                                                                      936cee4941ca401e556ece5206dc4d9fc70c3660aaecf27cdb6c4d1ca5252ee3

                                                                      SHA512

                                                                      9aa375f24e3b63937c2d9b0231d356a395b81438dbf723af712c61baa87d3760319b977fdf8e060f1f38a2a5a12d302e3aa21826d3d0b4983d7a48e4e3ac1d1e

                                                                    • memory/1308-1009-0x0000027D16CC0000-0x0000027D17CC0000-memory.dmp

                                                                      Filesize

                                                                      16.0MB

                                                                    • memory/1308-965-0x0000027D16CC0000-0x0000027D17CC0000-memory.dmp

                                                                      Filesize

                                                                      16.0MB

                                                                    • memory/1632-986-0x000002226B8E0000-0x000002226B8E1000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/1632-1002-0x000002226B900000-0x000002226BB70000-memory.dmp

                                                                      Filesize

                                                                      2.4MB

                                                                    • memory/3408-1001-0x00000250A7690000-0x00000250A7900000-memory.dmp

                                                                      Filesize

                                                                      2.4MB

                                                                    • memory/4568-998-0x000001B968C10000-0x000001B968C11000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                    • memory/4568-1003-0x000001B96A4C0000-0x000001B96A730000-memory.dmp

                                                                      Filesize

                                                                      2.4MB

                                                                    • memory/4792-897-0x00007FFCCE090000-0x00007FFCCE35F000-memory.dmp

                                                                      Filesize

                                                                      2.8MB

                                                                    • memory/4792-917-0x00007FFCC9F20000-0x00007FFCC9F74000-memory.dmp

                                                                      Filesize

                                                                      336KB

                                                                    • memory/4792-916-0x00007FFCCAFA0000-0x00007FFCCAFB5000-memory.dmp

                                                                      Filesize

                                                                      84KB

                                                                    • memory/4792-934-0x00007FFCC9D80000-0x00007FFCC9DB7000-memory.dmp

                                                                      Filesize

                                                                      220KB

                                                                    • memory/4792-904-0x00007FFCD1A20000-0x00007FFCD1A4C000-memory.dmp

                                                                      Filesize

                                                                      176KB

                                                                    • memory/4792-901-0x00007FFCDD360000-0x00007FFCDD3BC000-memory.dmp

                                                                      Filesize

                                                                      368KB

                                                                    • memory/4792-902-0x00007FFCE4940000-0x00007FFCE497A000-memory.dmp

                                                                      Filesize

                                                                      232KB

                                                                    • memory/4792-903-0x00007FFCE4910000-0x00007FFCE493B000-memory.dmp

                                                                      Filesize

                                                                      172KB

                                                                    • memory/4792-900-0x00007FFCD1A50000-0x00007FFCD1BBA000-memory.dmp

                                                                      Filesize

                                                                      1.4MB

                                                                    • memory/4792-899-0x00007FFCCE980000-0x00007FFCCEF38000-memory.dmp

                                                                      Filesize

                                                                      5.7MB

                                                                    • memory/4792-898-0x00007FFCCBA10000-0x00007FFCCC14D000-memory.dmp

                                                                      Filesize

                                                                      7.2MB

                                                                    • memory/4792-896-0x00007FFCCDEC0000-0x00007FFCCE086000-memory.dmp

                                                                      Filesize

                                                                      1.8MB

                                                                    • memory/4792-895-0x00007FFCCE980000-0x00007FFCCEF38000-memory.dmp

                                                                      Filesize

                                                                      5.7MB

                                                                    • memory/4792-894-0x00007FF6D1330000-0x00007FF6D2014000-memory.dmp

                                                                      Filesize

                                                                      12.9MB