hxxps://illegal-services[.]github[.]io/Illegal_Services/downloads[.]html

Analysis

max time kernel
1060s
max time network
985s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
07-03-2024 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://illegal-services.github.io/Illegal_Services/downloads.html

Score

8^/10

evasion upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 3 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4656	attrib.exe
408	attrib.exe
1036	attrib.exe

Loads dropped DLL 30 IoCs

pid	Process
3192	bookmarks_parser.exe
3192	bookmarks_parser.exe
3192	bookmarks_parser.exe
3192	bookmarks_parser.exe
3192	bookmarks_parser.exe
4000	bookmarks_parser.exe
4000	bookmarks_parser.exe
4000	bookmarks_parser.exe
4000	bookmarks_parser.exe
4000	bookmarks_parser.exe
4984	bookmarks_parser.exe
4984	bookmarks_parser.exe
4984	bookmarks_parser.exe
4984	bookmarks_parser.exe
4984	bookmarks_parser.exe
1180	bookmarks_parser.exe
1180	bookmarks_parser.exe
1180	bookmarks_parser.exe
1180	bookmarks_parser.exe
1180	bookmarks_parser.exe
3640	bookmarks_parser.exe
3640	bookmarks_parser.exe
3640	bookmarks_parser.exe
3640	bookmarks_parser.exe
3640	bookmarks_parser.exe
4952	bookmarks_parser.exe
4952	bookmarks_parser.exe
4952	bookmarks_parser.exe
4952	bookmarks_parser.exe
4952	bookmarks_parser.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-409-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2224-433-0x0000000000400000-0x00000000004A5000-memory.dmp	upx
behavioral1/memory/2224-436-0x0000000000400000-0x00000000004A5000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
80	raw.githubusercontent.com
91	raw.githubusercontent.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4936	timeout.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

Process Discovery

T1057

pid	Process
3260	tasklist.exe
1732	tasklist.exe
3604	tasklist.exe
3416	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Illegal_Services-main.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
4608	msedge.exe
4608	msedge.exe
4368	msedge.exe
4368	msedge.exe
4964	identity_helper.exe
4964	identity_helper.exe
3540	msedge.exe
3540	msedge.exe
3060	powershell.exe
3060	powershell.exe
4372	cmdbkg.exe
4372	cmdbkg.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3768	msedge.exe
3152	powershell.exe
3152	powershell.exe
3200	cmdbkg.exe
3200	cmdbkg.exe
492	powershell.exe
492	powershell.exe
1312	cmdbkg.exe
1312	cmdbkg.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	3260	tasklist.exe
Token: SeDebugPrivilege	1732	tasklist.exe
Token: 33	3104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3104	AUDIODG.EXE
Token: SeDebugPrivilege	3604	tasklist.exe
Token: SeDebugPrivilege	3416	tasklist.exe
Token: SeDebugPrivilege	3152	powershell.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe
Token: SeSecurityPrivilege	1888	WMIC.exe
Token: SeTakeOwnershipPrivilege	1888	WMIC.exe
Token: SeLoadDriverPrivilege	1888	WMIC.exe
Token: SeSystemProfilePrivilege	1888	WMIC.exe
Token: SeSystemtimePrivilege	1888	WMIC.exe
Token: SeProfSingleProcessPrivilege	1888	WMIC.exe
Token: SeIncBasePriorityPrivilege	1888	WMIC.exe
Token: SeCreatePagefilePrivilege	1888	WMIC.exe
Token: SeBackupPrivilege	1888	WMIC.exe
Token: SeRestorePrivilege	1888	WMIC.exe
Token: SeShutdownPrivilege	1888	WMIC.exe
Token: SeDebugPrivilege	1888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1888	WMIC.exe
Token: SeRemoteShutdownPrivilege	1888	WMIC.exe
Token: SeUndockPrivilege	1888	WMIC.exe
Token: SeManageVolumePrivilege	1888	WMIC.exe
Token: 33	1888	WMIC.exe
Token: 34	1888	WMIC.exe
Token: 35	1888	WMIC.exe
Token: 36	1888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1888	WMIC.exe
Token: SeSecurityPrivilege	1888	WMIC.exe
Token: SeTakeOwnershipPrivilege	1888	WMIC.exe
Token: SeLoadDriverPrivilege	1888	WMIC.exe
Token: SeSystemProfilePrivilege	1888	WMIC.exe
Token: SeSystemtimePrivilege	1888	WMIC.exe
Token: SeProfSingleProcessPrivilege	1888	WMIC.exe
Token: SeIncBasePriorityPrivilege	1888	WMIC.exe
Token: SeCreatePagefilePrivilege	1888	WMIC.exe
Token: SeBackupPrivilege	1888	WMIC.exe
Token: SeRestorePrivilege	1888	WMIC.exe
Token: SeShutdownPrivilege	1888	WMIC.exe
Token: SeDebugPrivilege	1888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1888	WMIC.exe
Token: SeRemoteShutdownPrivilege	1888	WMIC.exe
Token: SeUndockPrivilege	1888	WMIC.exe
Token: SeManageVolumePrivilege	1888	WMIC.exe
Token: 33	1888	WMIC.exe
Token: 34	1888	WMIC.exe
Token: 35	1888	WMIC.exe
Token: 36	1888	WMIC.exe
Token: SeDebugPrivilege	492	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	WMIC.exe
Token: SeSecurityPrivilege	4952	WMIC.exe
Token: SeTakeOwnershipPrivilege	4952	WMIC.exe
Token: SeLoadDriverPrivilege	4952	WMIC.exe
Token: SeSystemProfilePrivilege	4952	WMIC.exe
Token: SeSystemtimePrivilege	4952	WMIC.exe
Token: SeProfSingleProcessPrivilege	4952	WMIC.exe
Token: SeIncBasePriorityPrivilege	4952	WMIC.exe
Token: SeCreatePagefilePrivilege	4952	WMIC.exe
Token: SeBackupPrivilege	4952	WMIC.exe
Token: SeRestorePrivilege	4952	WMIC.exe
Token: SeShutdownPrivilege	4952	WMIC.exe
Token: SeDebugPrivilege	4952	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
2420	Illegal_Services.exe
3624	cmdwiz.exe
1892	cmdbkg.exe
4372	cmdbkg.exe
3988	cmdwiz.exe
4164	cmdwiz.exe
2224	extd.exe
3580	cmdwiz.exe
2736	cmdwiz.exe
248	cmdwiz.exe
1564	cmdwiz.exe
4072	cmdwiz.exe
4336	cmdwiz.exe
4772	cmdwiz.exe
1888	cmdwiz.exe
3584	cmdwiz.exe
5096	Illegal_Services.exe
3192	cmdbkg.exe
3200	cmdbkg.exe
4864	cmdwiz.exe
3992	cmdwiz.exe
728	cmdwiz.exe
4700	Illegal_Services.exe
4912	cmdbkg.exe
1312	cmdbkg.exe
1952	cmdwiz.exe
1104	cmdwiz.exe
3260	cmdwiz.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 1752	4608	msedge.exe	82
PID 4608 wrote to memory of 1752	4608	msedge.exe	82
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 3064	4608	msedge.exe	83
PID 4608 wrote to memory of 1008	4608	msedge.exe	84
PID 4608 wrote to memory of 1008	4608	msedge.exe	84
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85
PID 4608 wrote to memory of 3588	4608	msedge.exe	85

Views/modifies file attributes 1 TTPs 6 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
408	attrib.exe
2616	attrib.exe
1036	attrib.exe
1564	attrib.exe
4656	attrib.exe
668	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://illegal-services.github.io/Illegal_Services/downloads.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc43b83cb8,0x7ffc43b83cc8,0x7ffc43b83cd8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1428 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1816,2837233335859215830,1755396091176852646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1996

C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\Illegal_Services.exe
"C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\Illegal_Services.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\Illegal_Services.exe" "
  2⤵
  PID:3512
- - C:\Windows\system32\attrib.exe
    attrib -s -h "C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat"
    3⤵
    - Views/modifies file attributes
    PID:668
- - C:\Windows\system32\attrib.exe
    attrib +s +h +i "C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:408
- - C:\Windows\system32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat"
    3⤵
    PID:660
- - C:\Windows\system32\findstr.exe
    findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat"
    3⤵
    PID:3528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp
    3⤵
    PID:4656
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:3788
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c copy /z "Illegal_Services.exe" nul
    3⤵
    PID:4592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
    3⤵
    PID:3700
  - - C:\Windows\system32\forfiles.exe
      forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
      4⤵
      PID:3624
    - - C:\Windows\system32\cmd.exe
        
        /c echo
        5⤵
        
        PID:248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c set
    3⤵
    PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
    3⤵
    PID:560
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
      4⤵
      PID:1076
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
    3⤵
    PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v "InstallLanguage"
    3⤵
    PID:2004
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language" /v "InstallLanguage"
      4⤵
      PID:3604
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language" /t REG_SZ /d EN /f
    3⤵
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
    3⤵
    PID:4816
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
      4⤵
      PID:1416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
    3⤵
    PID:2032
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
      4⤵
      PID:3240
- - C:\Windows\system32\chcp.com
    chcp 437
    3⤵
    PID:3388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell /?
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:4916
- - C:\Windows\system32\where.exe
    where mode.com
    3⤵
    PID:3528
- - C:\Windows\system32\reg.exe
    reg query "HKEY_CURRENT_USER\Console\%%Startup" /v "DelegationTerminal"
    3⤵
    PID:2300
- - C:\Windows\system32\find.exe
    find "{00000000-0000-0000-0000-000000000000}"
    3⤵
    PID:4932
- - C:\Windows\system32\tasklist.exe
    tasklist /nh /fo csv /fi "imagename eq WindowsTerminal.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- - C:\Windows\system32\find.exe
    find """WindowsTerminal.exe"""
    3⤵
    PID:3592
- - C:\Windows\system32\mode.com
    mode 125,19
    3⤵
    PID:2040
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe setquickedit 0
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username"
    3⤵
    PID:2184
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username"
      4⤵
      PID:4108
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username"
    3⤵
    PID:3168
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username" /t REG_SZ /d "Admin" /f
    3⤵
    PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username"
    3⤵
    PID:5012
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username"
      4⤵
      PID:224
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Username" /t REG_SZ /d "Admin" /f
    3⤵
    PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul tasklist /nh /fo csv /fi "imagename eq Illegal_Services.exe" | find """Illegal_Services.exe"""
    3⤵
    PID:2148
  - - C:\Windows\system32\tasklist.exe
      tasklist /nh /fo csv /fi "imagename eq Illegal_Services.exe"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1732
  - - C:\Windows\system32\find.exe
      find """Illegal_Services.exe"""
      4⤵
      PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul dir "C:\Users\Admin\AppData\Local\Temp\????????.bat" /a:-d /o:-d /b | findstr /rxc:"........\.bat"
    3⤵
    PID:3416
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir "C:\Users\Admin\AppData\Local\Temp\????????.bat" /a:-d /o:-d /b 2>nul"
      4⤵
      PID:744
  - - C:\Windows\system32\findstr.exe
      findstr /rxc:"........\.bat"
      4⤵
      PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul dir "C:\Users\Admin\AppData\Local\Temp\URL????.url" /a:-d /b | findstr /rc:"URL....\.url"
    3⤵
    PID:2276
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" dir "C:\Users\Admin\AppData\Local\Temp\URL????.url" /a:-d /b 2>nul"
      4⤵
      PID:3992
  - - C:\Windows\system32\findstr.exe
      findstr /rc:"URL....\.url"
      4⤵
      PID:4936
- - C:\Windows\system32\where.exe
    where curl.exe
    3⤵
    PID:3076
- - C:\Windows\system32\curl.exe
    curl.exe -fIkLs -X GET -o NUL "https://1.1.1.1/"
    3⤵
    PID:3068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Proxy"
    3⤵
    PID:3060
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Proxy"
      4⤵
      PID:2736
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Proxy"
    3⤵
    PID:2084
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Proxy" /f
    3⤵
    PID:4092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl.exe -fIks -X GET -o NUL "https://github.com/Illegal-Services/Illegal_Services" -w "%{response_code}"
    3⤵
    PID:1888
  - - C:\Windows\system32\curl.exe
      curl.exe -fIks -X GET -o NUL "https://github.com/Illegal-Services/Illegal_Services" -w "%{response_code}"
      4⤵
      PID:8
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Proxy" /t REG_SZ /d "https://github.com/Illegal-Services/Illegal_Services" /f
    3⤵
    PID:3052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant"
    3⤵
    PID:4984
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant"
      4⤵
      PID:5004
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant"
    3⤵
    PID:3400
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant" /t REG_DWORD /d 0 /f
    3⤵
    PID:516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant"
    3⤵
    PID:2184
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant"
      4⤵
      PID:3168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl.exe -fkLs "https://github.com/Illegal-Services/Illegal_Services/raw/version/version.txt"
    3⤵
    PID:3604
  - - C:\Windows\system32\curl.exe
      curl.exe -fkLs "https://github.com/Illegal-Services/Illegal_Services/raw/version/version.txt"
      4⤵
      PID:2088
- - C:\Windows\system32\where.exe
    where chcp.com
    3⤵
    PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c chcp
    3⤵
    PID:2616
  - - C:\Windows\system32\chcp.com
      chcp
      4⤵
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
    3⤵
    PID:3124
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
      4⤵
      PID:5024
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
    3⤵
    PID:3320
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency" /t REG_DWORD /d 1 /f
    3⤵
    PID:5016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
    3⤵
    PID:4148
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
      4⤵
      PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
    3⤵
    PID:2220
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
      4⤵
      PID:2784
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
    3⤵
    PID:3076
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled" /t REG_DWORD /d 0 /f
    3⤵
    PID:576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
    3⤵
    PID:4916
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
      4⤵
      PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
    3⤵
    PID:4228
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
      4⤵
      PID:2300
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
    3⤵
    PID:2880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency" /t REG_DWORD /d 10 /f
    3⤵
    PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
    3⤵
    PID:4932
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
      4⤵
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
    3⤵
    PID:3760
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
      4⤵
      PID:5004
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
    3⤵
    PID:3656
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper" /t REG_DWORD /d 6 /f
    3⤵
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
    3⤵
    PID:3632
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
      4⤵
      PID:3200
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
    lib\cmdbkg.exe lib\backgrounds\background-6.jpg
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
      lib\cmdbkg.exe lib\backgrounds\background-6.jpg
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4372
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 500
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3988
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe setwindowtransparency 10
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning"
    3⤵
    PID:3380
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning"
      4⤵
      PID:4816
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning"
    3⤵
    PID:3912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning" /t REG_DWORD /d 1 /f
    3⤵
    PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning"
    3⤵
    PID:3196
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "UntrustedWebsitesWarning"
      4⤵
      PID:4004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice"
    3⤵
    PID:2644
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice"
      4⤵
      PID:2168
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice"
    3⤵
    PID:1912
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice" /t REG_DWORD /d 1 /f
    3⤵
    PID:1148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice"
    3⤵
    PID:4936
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice"
      4⤵
      PID:408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /bc:"[First Launch]=" "lib\speak\EN.lang"
    3⤵
    PID:1624
  - - C:\Windows\system32\findstr.exe
      findstr /bc:"[First Launch]=" "lib\speak\EN.lang"
      4⤵
      PID:2784
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\speak\extd.exe
    lib\speak\extd.exe /speak "Welcome to Illegal Services. My name is Rose, and I will be, your personal voice assistant. If you wish, you can deactivate me in the menu that appears."
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2224
- - C:\Windows\system32\cscript.exe
    cscript //nologo "C:\Users\Admin\AppData\Local\Temp\msgbox.vbs" "Do you want to disable Rose voice assistant ?" 69668 "Illegal Services"
    3⤵
    PID:4864
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistant" /t REG_DWORD /d 1 /f
    3⤵
    PID:4784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "VoiceAssistantChoice" /t REG_DWORD /d 0 /f
    3⤵
    PID:3896
- - C:\Windows\system32\tasklist.exe
    tasklist /nh /fo csv /fi "imagename eq extd.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- - C:\Windows\system32\find.exe
    find """extd.exe"""
    3⤵
    PID:900
- - C:\Windows\system32\tasklist.exe
    tasklist /nh /fo csv /fi "imagename eq speak-x64.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- - C:\Windows\system32\find.exe
    find """speak-x64.exe"""
    3⤵
    PID:1252
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4936
- - C:\Windows\system32\mode.com
    mode 125,29
    3⤵
    PID:1560
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3580
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2736
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:248
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1564
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4072
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4336
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4772
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1888
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
    lib\cmdwiz.exe delay 5
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3584
- - C:\Windows\system32\mode.com
    mode 125,29
    3⤵
    PID:5004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
    3⤵
    PID:1480
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
      4⤵
      PID:1072
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
    3⤵
    PID:4332
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch" /t REG_DWORD /d 1 /f
    3⤵
    PID:4116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
    3⤵
    PID:1484
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
      4⤵
      PID:1516
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\Illegal_Services.exe
    "Illegal_Services.exe" IS_BOOKMARKS_PARSER
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5096
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8I250UNM.bat" "Illegal_Services.exe" IS_BOOKMARKS_PARSER"
      4⤵
      PID:200
    - - C:\Windows\system32\attrib.exe
        
        attrib -s -h "C:\Users\Admin\AppData\Local\Temp\8I250UNM.bat"
        5⤵
        Views/modifies file attributes
        
        PID:2616
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h +i "C:\Users\Admin\AppData\Local\Temp\8I250UNM.bat"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:1036
    - - C:\Windows\system32\findstr.exe
        
        findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\8I250UNM.bat"
        5⤵
        
        PID:1148
    - - C:\Windows\system32\findstr.exe
        
        findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\8I250UNM.bat"
        5⤵
        
        PID:4796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c chcp
        5⤵
        
        PID:2276
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:4220
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3228
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c copy /z "Illegal_Services.exe" nul
        5⤵
        
        PID:2560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
        5⤵
        
        PID:772
      - C:\Windows\system32\forfiles.exe
        
        forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
        6⤵
        
        PID:5088
        
        C:\Windows\system32\cmd.exe
        
        /c echo
        7⤵
        
        PID:4380
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        5⤵
        
        PID:1888
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
        5⤵
        
        PID:3592
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
        6⤵
        
        PID:836
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
        5⤵
        
        PID:4224
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
        6⤵
        
        PID:1072
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:3088
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell /?
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3152
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3176
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:1180
    - - C:\Windows\system32\where.exe
        
        where mode.com
        5⤵
        
        PID:1344
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
        5⤵
        
        PID:3232
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
        6⤵
        
        PID:916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
        5⤵
        
        PID:2284
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
        6⤵
        
        PID:4768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
        5⤵
        
        PID:3980
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
        6⤵
        
        PID:3012
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
        5⤵
        
        PID:1372
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
        6⤵
        
        PID:3184
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
        
        lib\cmdbkg.exe lib\backgrounds\background-6.jpg
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3192
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
        
        lib\cmdbkg.exe lib\backgrounds\background-6.jpg
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:3200
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe delay 500
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4864
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe setwindowtransparency 10
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\cmdwiz.exe getconsoledim
        5⤵
        
        PID:5016
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe getconsoledim
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:728
    - - C:\Windows\system32\curl.exe
        
        curl.exe -fIkLs -X GET -o NUL "https://1.1.1.1/"
        5⤵
        
        PID:3016
    - - C:\Windows\system32\curl.exe
        
        curl.exe -f#kLo "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" "https://github.com/Illegal-Services/Illegal_Services/raw/downloads/IS.bookmarks.html"
        5⤵
        
        PID:1624
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:2560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 8
        5⤵
        
        PID:4656
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 8
        6⤵
        
        PID:4592
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:4772
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:4072
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:1576
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul wmic os get Localdatetime /value
        5⤵
        
        PID:772
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Localdatetime /value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1888
    - - C:\Windows\system32\reg.exe
        
        reg add "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "DBLastDownload" /t REG_SZ /d "2024-03-07 21:42" /f
        5⤵
        
        PID:4032
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "DBLastDownload"
        5⤵
        
        PID:1384
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "DBLastDownload"
        6⤵
        
        PID:4256
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:2984
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:716
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:1400
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul certutil -hashfile "lib\bookmarks_parser.exe" SHA1
        5⤵
        
        PID:4160
      - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "lib\bookmarks_parser.exe" SHA1
        6⤵
        
        PID:4000
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe -h
        5⤵
        
        PID:1484
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe -h
        6⤵
        Loads dropped DLL
        
        PID:3192
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        5⤵
        
        PID:2916
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        6⤵
        
        PID:4656
        
        C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        7⤵
        Loads dropped DLL
        
        PID:4000
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set root_path_[
        5⤵
        
        PID:2612
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set untrusted_website_[
        5⤵
        
        PID:1252
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set url_[
        5⤵
        
        PID:4148
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:4404
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:4952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "Doxing" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        5⤵
        
        PID:1312
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "Doxing" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        6⤵
        
        PID:2276
        
        C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "Doxing" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        7⤵
        Loads dropped DLL
        
        PID:4984
- - C:\Windows\system32\mode.com
    mode 125,29
    3⤵
    PID:3912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
    3⤵
    PID:2124
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
      4⤵
      PID:1560
- - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\Illegal_Services.exe
    "Illegal_Services.exe" IS_BOOKMARKS_PARSER
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4700
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CTC4DVRX.bat" "Illegal_Services.exe" IS_BOOKMARKS_PARSER"
      4⤵
      PID:3096
    - - C:\Windows\system32\attrib.exe
        
        attrib -s -h "C:\Users\Admin\AppData\Local\Temp\CTC4DVRX.bat"
        5⤵
        Views/modifies file attributes
        
        PID:1564
    - - C:\Windows\system32\attrib.exe
        
        attrib +s +h +i "C:\Users\Admin\AppData\Local\Temp\CTC4DVRX.bat"
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:4656
    - - C:\Windows\system32\findstr.exe
        
        findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\CTC4DVRX.bat"
        5⤵
        
        PID:4592
    - - C:\Windows\system32\findstr.exe
        
        findstr /v "$" "C:\Users\Admin\AppData\Local\Temp\CTC4DVRX.bat"
        5⤵
        
        PID:3992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c chcp
        5⤵
        
        PID:1148
      - C:\Windows\system32\chcp.com
        
        chcp
        6⤵
        
        PID:1036
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4796
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c copy /z "Illegal_Services.exe" nul
        5⤵
        
        PID:4952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
        5⤵
        
        PID:1648
      - C:\Windows\system32\forfiles.exe
        
        forfiles /m "Illegal_Services.exe" /c "cmd /c echo 0x1B"
        6⤵
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        /c echo
        7⤵
        
        PID:2800
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c set
        5⤵
        
        PID:2600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
        5⤵
        
        PID:4072
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "Language"
        6⤵
        
        PID:1992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
        5⤵
        
        PID:836
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Personal"
        6⤵
        
        PID:3640
    - - C:\Windows\system32\chcp.com
        
        chcp 437
        5⤵
        
        PID:772
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell /?
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:492
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4792
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        5⤵
        
        PID:1516
    - - C:\Windows\system32\where.exe
        
        where mode.com
        5⤵
        
        PID:2328
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
        5⤵
        
        PID:1344
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundBorderTransparency"
        6⤵
        
        PID:1180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
        5⤵
        
        PID:1640
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundDisabled"
        6⤵
        
        PID:3600
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
        5⤵
        
        PID:3004
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundTransparency"
        6⤵
        
        PID:4728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
        5⤵
        
        PID:3312
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "BackgroundWallpaper"
        6⤵
        
        PID:4160
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
        
        lib\cmdbkg.exe lib\backgrounds\background-6.jpg
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdbkg.exe
        
        lib\cmdbkg.exe lib\backgrounds\background-6.jpg
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:1312
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe delay 500
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1952
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe setwindowtransparency 10
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1104
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\cmdwiz.exe getconsoledim
        5⤵
        
        PID:1996
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\cmdwiz.exe
        
        lib\cmdwiz.exe getconsoledim
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3260
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:2916
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:3416
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:3092
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "DBLastDownload"
        5⤵
        
        PID:5016
      - C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "DBLastDownload"
        6⤵
        
        PID:2184
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul wmic os get Localdatetime /value
        5⤵
        
        PID:4796
      - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Localdatetime /value
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:3940
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:4936
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:2880
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul certutil -hashfile "lib\bookmarks_parser.exe" SHA1
        5⤵
        
        PID:2600
      - C:\Windows\system32\certutil.exe
        
        certutil -hashfile "lib\bookmarks_parser.exe" SHA1
        6⤵
        
        PID:5004
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe -h
        5⤵
        
        PID:4072
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe -h
        6⤵
        Loads dropped DLL
        
        PID:1180
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        5⤵
        
        PID:3260
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        6⤵
        
        PID:5104
        
        C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-folders --list-index --extended-parsing --folders-path --quoting-style "'" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        7⤵
        Loads dropped DLL
        
        PID:3640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set root_path_[
        5⤵
        
        PID:2312
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set untrusted_website_[
        5⤵
        
        PID:1640
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set url_[
        5⤵
        
        PID:2240
    - - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "lib\binread\x64\binread.exe" 0
        5⤵
        
        PID:3004
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        5⤵
        
        PID:4256
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\binread\x64\binread.exe
        
        lib\binread\x64\binread.exe "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html" 35
        6⤵
        
        PID:4160
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "IP Denial of Services (DDoS)" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        5⤵
        
        PID:2784
      - C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "IP Denial of Services (DDoS)" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        6⤵
        
        PID:2056
        
        C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\lib\bookmarks_parser.exe
        
        lib\bookmarks_parser.exe --list-index --extended-parsing --folders-path --quoting-style "'" --folders-all-case_sensitive "IP Denial of Services (DDoS)" "C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html"
        7⤵
        Loads dropped DLL
        
        PID:4952
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set parse_untrusted_websites[
        5⤵
        
        PID:4812
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c 2>nul set parse_untrusted_websites[
        5⤵
        
        PID:1348
- - C:\Windows\system32\mode.com
    mode 125,29
    3⤵
    PID:1408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c 2>nul reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
    3⤵
    PID:2124
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\IB_U_Z_Z_A_R_Dl\Illegal Services" /v "FirstLaunch"
      4⤵
      PID:248

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0e04c74727fbfaf6d31eb28de212bb60

SHA1
1829716a822437f478f6b0481084143a24944554

SHA256
5226da3506c85d2ed701bea411ebd415b99b848935a0ecd50ad7fb0fd913ba05

SHA512
f8ad65f30fdcb4d96f360d780fb411474fa1d7aaa146cb9382a5dbce23751291ba597e74826cfaf44f85b6a7db2525ad06c1378f5486b61e94f7f4b14c8053da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
12b71c4e45a845b5f29a54abb695e302

SHA1
8699ca2c717839c385f13fb26d111e57a9e61d6f

SHA256
c353020621fa6cea80eaa45215934d5f44f181ffa1a673cdb7880f20a4e898e0

SHA512
09f0d1a739102816c5a29106343d3b5bb54a31d67ddbfcfa21306b1a6d87eaa35a9a2f0358e56cc0f78be15eeb481a7cc2038ce54d552b9b791e7bee78145241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce319bd3ed3c89069337a6292042bbe0

SHA1
7e058bce90e1940293044abffe993adf67d8d888

SHA256
34070e3eea41c0e180cb5541de76cea15ef6f9e5c641e922d82a2d97bdce3aa3

SHA512
d42f7fc32a337ecd3a24bcbf6cd6155852646cae5fb499003356f713b791881fc2e46825c4ff61d09db2289f25c0992c10d6fadb560a9bea33284bd5acc449f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cacf2e98fc300a870a20398bfd024812

SHA1
537dc7ee86676bd5c23d7649267dac451af2d148

SHA256
8662934a6200a238be6de55383a69f497e9977b6fc93ee8e6bd1f62a5df1a395

SHA512
ca35a26af900aa6ca784f0aa765862e23e54ad842739fcf5f6d746f42466dbbdebfb69bdd5f1154cdae257c4aa12c67b68e452120244542dab4fd429d1ce0349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
82de40cd3a79591868e2ca7272fbb2a7

SHA1
b8e6c84ba10de3a33659d1fdff668049b9010b8f

SHA256
4b592d255fa561df9f6c381005936ca6fd68b251d3a7a07040bf03412ca5ebbf

SHA512
3a96d9f4c0b96ddf9f2e1edf82748fe34d81eb17ef857bd6a6f4b8b500889f852c33c9a4002593c5b85a1ca824df4da81909d11255d8fc4c2fe7ac1d44c63bc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f7f92a9d79367039e3f5331c6e17b314

SHA1
747eedae32b7e798e32d082a9de33a4c06b233e3

SHA256
672902ea0818a3c8d71bf4d8dfb685d64ad767623633605202079958d57f225c

SHA512
7019296abdb474e90f598abe4ca59b07f8da5ac421aafe70d118797239c424bbd0cde4d2ec084aea987515aa1a511114539f9c31b7bdf7f9e4c71cdb9d59d2e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
dd795545956a5c242a316218dbf431aa

SHA1
dafcbe23a5d50dffa3cd48638f93b6afa112dab1

SHA256
60a5278695bebf7459fea990e5f504621152ec9cfdc96b3f49006a0c019a5619

SHA512
a9f3a551fad2e0c645a94e9f649214751be07b476584635e9377c361e19d21c42eeebaf924775c15e13a164183a2d30f5e078e13d28098de4dfca8f6eb109544

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
508b53d95d259f196da9a866a7fba941

SHA1
090be53401c5618058a34d029f0165dc5508e78b

SHA256
fed9eac9a37c13c0a1247cdb3974efde0e9d1ac83655ab1ab2b525c0c86b1bad

SHA512
7b4c6e87d409ca395329523628f9890b98ee19d51751c1dae8fac62a07332598833b7b3b623c731b092562b7b30cbf8b7bd5201d570048ce81eb2c3ef683856b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9df8e70f8a6c31e243d5f90ac58e1dcd

SHA1
ac53fa56e8f09cc65f972d60c16d44cb5b486b2a

SHA256
4ef4afd8c43f4b65c007e235df13064dce5bcb413db6bb65df18921c787b10eb

SHA512
6a3ec86bb4994fda84ffe76f6f51156ae5c6fd783d49ef03f418c23629ebd3f20bd24e6bbad07e3b620d633026e07ada209e8cf15586876880f9d3f81c586c70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18d929440a054040ca12d2c9408ad435

SHA1
daec2355020f26ea2bc019872e72796e13fe766e

SHA256
361bf62f370795c191658d8b81b24f5e4e0a8b785ab7eef2bb2f93436e23f658

SHA512
b00636edead95d3041160d335d6b098cfd8274dc7ec99cca7d2fc7baf4fee86ac345870c1e662f58cda3be2b38c793170bf63be0352c5c11ebc5626de93a8ef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
731433bdb192476df363d73b6e0db603

SHA1
c6ab4588b28e571b9c356c7e2337a8964f667fc3

SHA256
6f8ea54f01c4ee35e1d0e233754a174fe3f4f5c616f4aedbb9a9756baf6a9bf1

SHA512
920c1b81ecc695ef98e0909353444ea7f33297169464d4e1b0a0f6d76d59686db41ec9e9d1eb18133424c5b46df05f59ebf857ec6bc7c8dbd623eeb57fdb2b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fef965c6f2d685aa1adf367f064d2ce8

SHA1
b18744bb91c8937f24fddbbd39748bf496103447

SHA256
b2f06ca551a6f9579612d5fb8be9d110b4ffcaf55d950506f1b03aae50819d8d

SHA512
a8c16bc7c2e4f1b5264365fb5c12faa83f7d8fd0851562052c26b4ad71d8dea11437c25540430a87e422ed5d5065e1b9fff83f6a6bb0e0695811f3e87a07e40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
214572f46e2613fbbe56d17738568898

SHA1
fe0647c2f600dd6cdb12eaa65517bcd65198bc44

SHA256
fe5a06d166e105a0ddb968f48e63931e5bc4b0e1b978b3bc4323436a8d57b159

SHA512
05f0b7fe67d0d732c6f7626230a7b0907c9589026b87da8b7ba120a95fe3a1f588570ffa2de8bcd0fd0439c045c4a7832bea40340c7c84d8857386fce860613c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe588558.TMP

Filesize
48B

MD5
39e6f3d418c27eab64218cbcd109f4c6

SHA1
84beda78cde9e7248bfc3126b692236b5fb6ad2d

SHA256
ba747403cc0deb913334de4901557691c2ce1e826891ba3fe8274323350c8f87

SHA512
1d3875d7270d6e0fbfb13e302afccf8207c3a0c5eb7f39862ce45b504878077a8c476b4e5307829caf8a8b8a72b6822effb90a10d6d41604c25309cd07c0cfef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
11b79d53a5d64c950dcd007b3da9f47f

SHA1
23aa74f900cb53e1f81beeee96bc2eed157cc312

SHA256
ad5494935bb22f3a4fb311948485e001f02f55fca6bdabef8e6bc65e0ff36217

SHA512
e0d6a9198df9f5047db7ad8a997c523d771f143a6aa1e7827d52b73794ca9d39b6a24854cb94e74039e828e44949016f544188d19c450e0e341892fee247c308

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58396a.TMP

Filesize
707B

MD5
e9b14835dfa4dc809676a965abccfeae

SHA1
05fab6181a4ed91dae41453544ad42201f8a9002

SHA256
7aac0d0344fddcecc19436e514b14e1b28a4062738c6f8b205b0504b3513c964

SHA512
b91ea5aa9e08fefd05cc0b148d1ed92d3e9e0ceded534784eff9e31d85462457b6fd3b48cd01a38babe13751d26b8e8f149813d62f4db683b714e092bd432650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5c4d80a568e65d323c77e68183735dfa

SHA1
03bfe2040c3e5e285fd397850f5b70280053f043

SHA256
55c800e92964304f501d13d927dbb8b9c0957bf1402fc96d477653492b6415ee

SHA512
d8a9ec8804a06415df1a898ed6fdea48cce574de39e4d7ea238fb799b1a181ca6d6badf1573225fbef8b369f59825ba68b6435e151fb079901bc57f1e4748ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
74b801f2e11da6a1856709abffe04f4a

SHA1
7b9c3506879e26d9ebe44bb3783ec80654bec84f

SHA256
ecb3f26191e9e3710b3b0a4d05db27aa5b3ce9a631d27b91c6ab50dd647fe3a5

SHA512
d7ab6c98f5fc61db1a0abd00c55fdcd44941405f0375c38086d52db458c6ea7b3cae9a7786381b2e72da767c37d3d5fc5f2727476a1b82ec0918c28dab4d339a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
de8a3eaea199421d74e55f4e39e536e3

SHA1
c9da8def00cddee0746ffdc59d87eb339e7ec2ab

SHA256
7106d11416ffbc8e2ddab7a09742e5950bb49c2ac4ca5cd54baa8e35185b729e

SHA512
004ca67d127ec0e875334c27f473d1b030210f98b7c5214170de7f791e4a60212007e2c374ca8c6c57d4bae918a41bd0abd0daa1ba1839e904fda2cce3446cb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d74efa789d09d85b2af489357fcc8573

SHA1
b94fc61334c71a6dd1c7e126d0410833539b0b85

SHA256
81bed7085f993fa5d9e68cf5166fd72ce870cb154e47e500b1a9692a1a4b6f53

SHA512
98ba9858cab0f68f84662fa6ea9a1f7d2098d98ab733be6ba72cf642409aac57e21d59b53f566820ad0b25a74402a5b442d06a4ff62245e1c9f6e64a39c686bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\40RA4A63.bat

Filesize
265KB

MD5
598ba6708a1c06f0bb11fedc03853f98

SHA1
a66aa6c50201202fcd91dd68a5f00cb818d2fd9f

SHA256
2a2bf04251618e31c24379d3561ea75158235b1ef370ec2de9bfc1b576e376fa

SHA512
ba94a96816f55b56c921a8da7145f04e2a85ad2cb6a9403139a516d57343bd8996eacc6b0a15017b2421e0e9dd437c5ec8fa6618ebb57a7542a905ffd83ef47a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\VCRUNTIME140.dll

Filesize
81KB

MD5
5116fd80399d5af500badb186c866cde

SHA1
8dfbcdd296383aebc039058101aac1ae408e5152

SHA256
1e5dc86e122379740724621890a1ba1b18252c745631a6dff862aa7723a1f99a

SHA512
e41b71380fa49743f1efcc920276dbf1b2f7f5db5771f64a4d2ff18039c124efdb3b7d3fa66eda2c47b21012abe1186eade388b38dcaa7e8417707be546c65d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\_bz2.pyd

Filesize
70KB

MD5
69571f3b3b8a1101515e4aee7f080cd1

SHA1
67cbcbac47499b15a60343b67a80cd16c4a9c197

SHA256
7a9c1b992529281ffc38944580dd858e85d4a76620c768839fb7fb7c21771989

SHA512
5b110ce65a93e03205fc4bac5fb2c83e3f67aae1e84a1d5503589ce43e843c29a31379c013e43533c84e70c0a82e5db8fbe63a678e20b8cefa515199bc599c6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\_lzma.pyd

Filesize
137KB

MD5
76677f460125603976656f78b8af6b56

SHA1
0664d710ef55f5c58178ce44c185a4c0ad10a31a

SHA256
a8f71849e92ef2455488b5a9334bd0c378b92f75b089b3eddb284c0ca545060a

SHA512
60a8d0c95553700ad5c18f4c5fc5475e22c8d42ccbe7bc26530649695e18cecf2202c55bd4c7d3a943a018f6737b9ef262f52cf75c5e8df63d72eca40fcff442

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\base_library.zip

Filesize
1008KB

MD5
3c39f09efc25551e8d79d60ac23d205c

SHA1
c965fc04fbf09de3cf012dd8171c707d717da537

SHA256
52e1825807e78e761671a757848e3eac5f1c19fd26b1e238846b4086d0b01809

SHA512
63323c079dd880058c3a1af8c6dd6df969d3b662a358b1b09273c401cd7cf2e0c1dbfa6cf65b5df201aaaa11c46188a2e13ec909cdfd8e1263cb1b129ddd06ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\python38.dll

Filesize
3.5MB

MD5
21af5002786204a0fce0ebab2643f12a

SHA1
b9920ca2c11205186e77b8d35021137c474abe91

SHA256
d65d664fca161565b20e114a6b6ddb0cec7cfcb7d6f04d431fd64cdbeeed48b7

SHA512
76ed9de199ac156853126ea74016dead74a14223fdf9688bb7cf2be191caa76c70fcc4d8577264b98f386270b56a83454636581bf06f7f905e8ca1dea6386cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI14842\ucrtbase.dll

Filesize
893KB

MD5
a924b24d71829da17e8908e05a5321e4

SHA1
fa5c69798b997c34c87a8b32130f664cdef8c124

SHA256
f32a61d91264aff96efd719915bed80785a8db4c8d881d6da28909b620fe466f

SHA512
9223ec0e6e0f70b92473e897e4fd4635a19e9ca3aff2fe7c5c065764b58e86460442991787525ed53e425ecd36f2881a6df34c35d2a0e21b7ac4bc61bf1cbeab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\_hashlib.pyd

Filesize
28KB

MD5
7ae973045e6db984fa95d092131347dd

SHA1
9c96f1ae1b51efa7ff920ff5ba731f10d8d16090

SHA256
f311d51efd30d289d40ee00b0d6df18bba7e2a8c948f232c276328affe4fdca5

SHA512
65d745b3322e112c59b877a425fe5f0fc074740a0acaf13aa2e52c51c928c9a0391c89a75cc3432f8182d8e86087d8ef8c9ae7c2cda64debff350f6e28a9b39a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\_socket.pyd

Filesize
60KB

MD5
435ebda3a4e78e356ad08382dfbdd86b

SHA1
610e8059b1ce8e7ad980900198d6526bfac06e35

SHA256
237bfd60aa9fdc366fa54dc5727b34e79f184683a077a199e0f1690fec1f4f06

SHA512
904475159a1e749e84145d93da64b31d9c70e1160769a9545cf4f58b6503efb03e517cb7371bec1eabfec563bc06ce128566e5b1ea25f7cdcf74bee9f9a063f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\_ssl.pyd

Filesize
128KB

MD5
2304fd4f920e33265c32ed57ff48ce7e

SHA1
45687ccdcae54216a1ae889fd7e3238a9f497939

SHA256
e53c9b6541f2d5225d3b1566fb873a7092a6c193727f9d1966c24b28afe2db9d

SHA512
32631d139bdc433cec7830edc049155cf2764d6088aa28961c03b05625b73979f499f3a8a6cd59aec65fd4f9cf44112dac44f250cecd5809c284113e0d0a8315

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-console-l1-1-0.dll

Filesize
3KB

MD5
2b99760530fa474fc6c36451acb9f445

SHA1
6fda8692eead43139ce78c8a8165f035b7096a25

SHA256
09c2fd7338a4cc2796deef0b73c4786b806cf2b5366e396d6231de263842e283

SHA512
3e43f28cbd887522012cb7799386a516bc074ae7fb58317910695dc9adf4fb7d2daf47c41bdac05e7a2381975d09ee76b89d0f11ab56dc6cc0661cd6feae293a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-datetime-l1-1-0.dll

Filesize
3KB

MD5
9afd83f00f9e720056de6aee2d45f600

SHA1
6f2100489b0567eb5a0f910ea7ca583be13e49a5

SHA256
0c8488229f4baa1b3870eae63f72564e4b3e81aabeb0e00f7644842cd2dd371d

SHA512
3d53c92b6585e314feb40939c71ad25be21e48d854715e4edfd4c4ea3fbc439261d27f66d772c8006b04a91641815edf38fb6103109ca3856110c2a010625def

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-debug-l1-1-0.dll

Filesize
3KB

MD5
49728a8faff8f34d41f46898def1d3c4

SHA1
3eac0e3f5c94bfd784ffe8a04668dab4b4d01b6d

SHA256
a1bcd2e6710a7866f2d171bbe9d0d10d49b58f9e57d290ec0e2551c439582055

SHA512
2d075af63f9f16d25dc125a7c8280f84b7d0ddcc91415a0861c3dbaaf4c1d92b43da33358ea1eb06d2e146ab6c7cb0ade542bd543e6a1bf8b414967d63ad272e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
3KB

MD5
b2f0e7f35dc2ec87310f118bc695a16c

SHA1
7ccb32e18aeb30544fe4c3839990fb56fbfd5b8a

SHA256
d621fc2712d61640cda9dec78a5c6c669c999bfe12f49efd6af7f4c493b4781b

SHA512
3ce7a02a9cf64b5a5f959a7f31a1309adc27068086792cbc6d0295b12a7520397fe789a267784cefa12de1424544ef280568a51a33ea5d48c270ffec5249f56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-file-l1-1-0.dll

Filesize
5KB

MD5
2a1466dc3582c648644ac01c2d63266d

SHA1
6194d631c1a04100a1962b5871fbdb02b91b14ee

SHA256
160222a049433788dbd0febc5f419f10f54afaf6bbff3579afa4806250d664cc

SHA512
d62c875ab47b82a30eec0bb4b34903461920bf843d0b236a38e7b4c4d458dedac1958414f43cef2557d3f08b7e7ea6bf4b2a007a76060880af75b756752784b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-file-l1-2-0.dll

Filesize
10KB

MD5
5576fdd1f244be3f29072f3d0ef710e1

SHA1
653a08eee34c6391ce6bc3786875505578058a29

SHA256
26c712d65bd2d3621dbd75ec9cd9c25b5a43035137171c64c101c66f6943daa0

SHA512
d9e08ef90645037fbb06e7e6c98a5d66837de1c1f51381a4ec0473ef2dc3085838d90ed69d9f0902cb2c6e41b603c7061637eb79655c1131d33c2a7c67a2f9c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-file-l2-1-0.dll

Filesize
10KB

MD5
718b88fc6f158a62309419cdc7c511ed

SHA1
294701dfa10801bf6bf8e8d6e3ec471ea81255d4

SHA256
8cd67dbc62070c1288e83d5789f41664951fb0c120070ab5334ac7719a5c8ac9

SHA512
8d41158b776fe31f9b2e785c9e1c90f86d69fe85ec777c171fd5063b73faf20a7473cb3ff4afae9666c6e4473210b94a837b847a0d2455fec2516e7ca6304c56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-handle-l1-1-0.dll

Filesize
3KB

MD5
27c0ce3d2c97e9c2c0c62e07d3e26a13

SHA1
91ebde8f9bfffa560f1b685cbfb917dc711441f6

SHA256
5f836cc29fa461fcbce74e646ab9a8961e245bb8ebf23218b6b90e2add19feef

SHA512
534b8460b408434a52cd332c03fc3ee37c7534a41e9a575a274a93d8179d834320406ef68557e0d23b881192d6145e7a7406114f49ae5323da9d61e96dc77a89

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-heap-l1-1-0.dll

Filesize
3KB

MD5
94f10418c4cea9127363e881efa4d271

SHA1
d58be5831e4765fd27c35bcd5b326d09137abfcd

SHA256
96cf72d654e6c99a3fcfc56f2934764b40872a884c7fa34219bac254b95630af

SHA512
0fe6d8614dfcadee0996d92218e0cdee95f3f65c8385e163c7525cb4c18b26dbf081b71b6cf98ff9bf00538b69b45987b92f9f8c80b20e1b72428eb5e021903f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
3KB

MD5
2434af3d661b56a4f167a5229c24f6e5

SHA1
d6ae86c707ce42629c38865f464523dec03ba80c

SHA256
ff17128f59d6c46a265b55d9cfeb95be6361ed9893f93a19bbe931511a149159

SHA512
9c7224dd344271d9a78e51da15119590cfed75e652a8e7e78b30531541a33168c2ddff0c52f077adecea4af17afbe4e7810ce2a10053f899ce1ee2036e1dff0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
3KB

MD5
fa72cab1143ead3b78723ca849ffeb64

SHA1
6d417596f4df6f1d02e3f301b0a4957f4cf9a71e

SHA256
32df6db88c05106ab74c5df744ef4201b9f4762481a857cb32d6719fb281b67b

SHA512
1810383018daf7735e4c03bdf0d04f9f6469058f262be309cd19010c990547db296e2c44d381bfe66c88ac943bd65ef8165358b339d63ac3fe4d046f0ae43719

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-localization-l1-2-0.dll

Filesize
13KB

MD5
a28c593b3efad3870be8c59957a65ca5

SHA1
fe90b4dff833d2a488e36c02d8cd0da1e9eb4bdd

SHA256
7ff7b17ecc55f978dab562a5bd26826085d9f80131ed415cee7c3b95c95b246a

SHA512
b34230e6ae04335975ee9bb8759767a8e74bbd1e220fa17568d95c755b3f959291a45a45cd27f845d38b940b2062145c21fabadd1985ec92b49e4761942bd90c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-memory-l1-1-0.dll

Filesize
3KB

MD5
23324abef38b990024180a4a9f899a21

SHA1
a0070c48efb8a7c4d1d7d52b1fee79b81c259cdb

SHA256
70f18c2cd6f33f182d640773adcc0d700404a6057538ff672928d5a2522d509b

SHA512
f61cf350cc5dd3174ecec07b36501fe106a027cd704de6159ff23c5e7353f8b0f768bb0874c0ad4ca84b324f38c695fb0054dc3fe44508e2efe4d900d36e8e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
3KB

MD5
ffdf67d2e77f5fbdcc621753d3662ece

SHA1
ffb398989431c7acab0bd53b9c300efcd433b12d

SHA256
239fd031c7998174f8526e2e7700274d6ab05d83e4cfd6f67bbb46082ebd25b1

SHA512
ca62b778cc98eb4feea66c83c30847f5b357f85b25104c06311f6f877873708852c342adf2b77a57665cfd60e6dd1f4573a67291d113ad31645276a89d1a78b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
3KB

MD5
a60c0c4d3c272968d6fa0713c50e43fb

SHA1
9ec54f4f5fcdd7ca59cbea2cbe531df0b7b767a9

SHA256
d617b06556e662a86af738c80473a4295152b8305750bf0d387c41467a32f02b

SHA512
68168748e66adb7c45a72416d881100695485fa24e65ee42939739e75ecb1c25e6f868747437449e7a7287f1199c6ef00d4b94c0a81092268b215f8430a7eaa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
4KB

MD5
be5cbc1d1cff18e377525d4426c5afa8

SHA1
7a03e3a9baa3e2a7cb9c3f129b04d7b14beab608

SHA256
9761a785f4764d94b97a3b7fa709cc551d7d8963645ed5a12137a6ed007baccb

SHA512
f9a7c1873863cfa11bf859f8cafa1d5fd29f6248480e43dadb0faceab7e2e5908048e1da45ffc8ad57ed4ce32974a16626041988002ff1c5304c515de9e84905

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
eba234a05bd7fa9650ef9184d67554f2

SHA1
ca1d5a8e1cbbf741baced4040aa4b57131f2737b

SHA256
c51565cc52ea3e372acca10ffad2cd2ae43eaa8bca18742b045c7e99919b775f

SHA512
0f3bb6bbc8d865d2c5261509ee4480953c6d89526ceca67b36eb96d0430f56e9d4b8dbd236588ac150a1219c36e412a3916dbf0719f75e984aa65fbda1821dea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-profile-l1-1-0.dll

Filesize
3KB

MD5
a35cd77dba1c817be05065e84524946b

SHA1
442c7dcbfbbca3efd2ecb80ca7324d0be8d698e7

SHA256
e9cbfbd8ad61fe008718057d30d0348cc0b3789c70b4e187fad2c87fd27c9b6e

SHA512
05d57b37e793f3f9917521c7f36fe5a68b5f495564ae7921fb6e73bca18b2e6005e1aaa813ffd27594fcea16af4f8d3c71a77b1ac604b9b86e9c814849b21ca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
3KB

MD5
c54961c9c9c3d48006208196e2105de8

SHA1
4ab2eaf1f541924d1a86dc9d675a359cd91be6eb

SHA256
0ee1e3b028390da9f875e0929743111e2840e21f61d35a6e44018ca33d4819de

SHA512
24159c8aab3612562f0f38c9a696b8ecde78d70841c4355334d6013cfe2ad37ecaff88fcc8e90533f2b54f3b093d4c2f6b04070355c47605d6a386af949921bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-string-l1-1-0.dll

Filesize
3KB

MD5
a4c806b9f0c62e91b9f6012fb7ee689d

SHA1
569eb4ea7aced211222740f29b1fb4af62590685

SHA256
4cc985b9e61a69fdb6969bee48573f85a1dbab4b22216651564c3f8ad5c57fd6

SHA512
0a341b487a7dc647a45c31f246ff2a33b3de16875835f08acbed1bb0564bc347b877f0a59f133896d64802895a2029d0463b19d65aef0c4ae649598be5cd2dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-synch-l1-1-0.dll

Filesize
4KB

MD5
5d8b0ea7413765d09ce7857cd511d964

SHA1
e5aea2ea33959497f12c986afec86a7113b4812c

SHA256
8269652f977f362cbd4495dcedcd101d974ec54c21d49b75bbec0dab841075b8

SHA512
5d283c44138af809b7354f65802fa817721c2f087f864fa064f7d99ec0c79035db198d389d042a785277b844820c265985973885e413368a4b379b766409cfd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
8165f2defdff0f2897f2da1169116659

SHA1
63831dcd6f9b439c4b081dcccac43d131e5a01a6

SHA256
a2f1957b595acab2bb360ffaa522a6a6c47fa5f88bcef088509e5cb6830103cd

SHA512
bc43281f9975ba797258ad114ca46e044ed06df1e00ab1b734278fb56349ff4ef398a635c4914bba1503f10575cb5dd1507805d4f7224a92005c659a761ba53c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
4KB

MD5
61b10137b1462e5667787c8f00c3a84e

SHA1
693c163476bdb4d09cd1e506b2e5db32add57277

SHA256
7855e2fce7d1d8c515409b29fac9706fdda9b347614f0e263d26391e8cd7bc98

SHA512
e52c8a417a0be5200bafef0b0ad3bdfd02ede09c0826488a0b049fc903747f6e995e8dc31892206381b57683fc6d612e2d2f47773c536ea6b9818a822a5c6ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-timezone-l1-1-0.dll

Filesize
10KB

MD5
f605bbc701e9a9ac82d5fe9533d46ebd

SHA1
e3231c03659dcd4edaf1869849e1b5060c8a9481

SHA256
b4d6282b721ec240ccf03c396e0aa589d113e6e5d49942ac7e1d9bedc50561e4

SHA512
c158db8a931fad6261673142cafec366d1c70bd962788dde99b7895b2057b29aa26fc07e2ee7bfc2a8204ea07d1faf03cd313bc4836cdbb642226babd9bf4f2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-core-util-l1-1-0.dll

Filesize
3KB

MD5
5d8c4fb5d4e6f3aa9653b6e4e79dcce8

SHA1
d8bee8fa817ecfb90038c51fdb077bcac444a81c

SHA256
71f1d3fd3e9ad7f5b1f9a3ff6795d7a64b53903d4f705a796a77e2440ca88513

SHA512
93902982612fa780936a7858fffda631649c3ecf4924f393d155262bcdfca9369258e4246d191f2d0ef571dbcd3bb05f911f67fafb5c8bc3d72cef574b732164

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-conio-l1-1-0.dll

Filesize
11KB

MD5
4be787d220b988d8936584b1c534b9a4

SHA1
e06f728abcb6ee4892d6ce4075a72d6567560c26

SHA256
b0fc7123806fbc54b32584cda425ab8c7553ca6d1fe382c8c137bbdd5872c5f1

SHA512
32204579e3f27b31d5043b08e7d014d00774f4008331b53134012be194eb8c696dfd3690d09b4ec6685c99b6b7801be1ec9dc234fee1088e961022344dfd902c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-convert-l1-1-0.dll

Filesize
14KB

MD5
c4a790e9b5371d5179bff78b3577edcc

SHA1
60d4c670643ca8e0bb6f482b7133efd3c59037df

SHA256
f3334fd8cde800152651200258dc4719271010677e1a55218c5f24bc6e7c7ff5

SHA512
b32df7ab4f4ab53c2357ef1e872740736f34f74a72a1ab07ba889a77f09ff2f7918c572c8255f70365729a1bd3f0ade23c09b08d4c0a44dc4e45318f4515fed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
6f1a2d17995baff500d9a2e2ea4bf493

SHA1
18de93491e362de93f9e61c00f1c94aef2d880c5

SHA256
2ed73364a84581e67b5ce98ee8f69ddc03f49a202a94f367e9855b50eb8ae9a4

SHA512
d56bf9a90f05ba17119886a82218e60b1a2c31dd05396ab4894523658c6299a353aada786b6272ce1fe88886d17ac43f0d71dbef569ddbcc71d1621ff27fe5d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
12KB

MD5
34664ea68d4dc7b94015a90869b55604

SHA1
5bd6abb07694159e4bb9b979669bd674747892ea

SHA256
c45fd7fe182b3edd287f5ae36e8e77198885be931607ca207af7dc8489b60bad

SHA512
4ac1b9caa40988e313e6075445906c372e8f0d6fd3e3092d2358e9584bb0f0c51586c8579ea8c4031d314a6d5ece31bfa8f4025225800f33ef9b290edb8d7dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-heap-l1-1-0.dll

Filesize
11KB

MD5
fd5925326354d9186891eb6da64da666

SHA1
3786f18ffd4b8f2e053f1568529c6b2c4a3d1b69

SHA256
05e695d316b0ab969cc221a99bf6f2581cbe5dadd2b966e811d151dfc9dbaeb4

SHA512
aad816e7c124ab0cbb3d1f5b472ed5e74f568df7b2da14d802d3e25a86fb3bda3c4d1f60ccd89aa07a941d48befabd0506403e4f3a10b770947649c1e234032e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
9a69eb348d7bc3c58e2e30fb2b8dd62b

SHA1
f18b5d1efed27de795207b413f19cf2643d9cadd

SHA256
70e06ed73bec7ac66c43ebaa03a020a2b976eb480ded429db74d31d47933fe78

SHA512
f3a74a7b311884179cefeeb07551c09385f6f5d76a378a4f5be66d5a155c3a8820e256b5a312f5f9ff24a5d87b7ee65db503c7c721149c50e62263b0fc9adf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-math-l1-1-0.dll

Filesize
21KB

MD5
5559d8f37665f327c295b4cd1638a3f2

SHA1
36d1a51b7d1741b0c3659be51fcb5d0c997752f1

SHA256
0c257ab2ba4553470b14c159fea39673fd7cfd02cedc2aa1294ab75618e19f7f

SHA512
aad4b0fe7172c1472deefa1dcd10072af73c14c50cb8e0b6e1b189dc9ce3bb043cf8dbb8306045bf36d0f46c9272d87664ed11670ebccdd16528ef2a35d59510

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-process-l1-1-0.dll

Filesize
11KB

MD5
0691f7dbc96e4f42908e337fc20ffe9f

SHA1
4828f5a36e20e72e7679f0a70061a3c091c4f41f

SHA256
73747a60a92703f2eb0d83826093203357538a72ca321cfadc2e60427a6ed053

SHA512
cb6f40517be63ddca0bdb9649d5da50c11856c53c3200830eb2939e08ace338678455adf346df84ea1f81fd6d0e91e4bfbe58aa5933ce87bc5337442af1bffc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
9eceedbc48924ad17950e0ef64bfc78d

SHA1
8bad15420dceb3e250dc88fe6ec8c5c5fd0953cb

SHA256
9b5dfbb6027d28c1a41cab008148e4a98bcd3d6a6d43269cd08dd8bbc366aa0f

SHA512
f986673bcfd71cbed8ede8e8063d3911d499c9600017781f38ab2014db0e24467b0ebf398400d949219e84c13596248530fb9de297af83f98967f7faee55fcd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
16KB

MD5
6cc5e2392b5617175da2406b7187c6c8

SHA1
055cd8fd422de7630a256774bd90e70b1346a8a7

SHA256
15d2aac51ef02eb8242e7c121d4f405237da415e4a05f41a16b8e3640dc27298

SHA512
6b99ca77f45063ba4ecdaea214f42e8ee3431ce03e54f5119c284385408f438273ba3c881bb71bcf4059f8ae5ce6f05a1cf36fc84a65d9bfa9ce595a0a0be295

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-string-l1-1-0.dll

Filesize
16KB

MD5
8db568b36f13feeefd150da0b63adcbe

SHA1
03bb29284802db358609c2cd10398d8a5077e417

SHA256
8597f9f239b350b86350f3cdb326bdca49cb23022703fe049f838998a8a32cd5

SHA512
8d57fa2975e45c2df82634135e57f29579778a118e033f036bb093e654a9a9d6a0b450c45b24d68fac2232d3255dbe9c88368ea8f6d697a86d035417b9ce61e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
8f5eca7b9be54bede759b2ba2f018bb2

SHA1
f7fb27990f9629332074fe4a3703dd3cdacf78b9

SHA256
9e5d937c72c6d5709b907130cf4c2bd12e3427e44d217a2047d461940c281c1f

SHA512
45de9e9b66303554487016d448c11cc38e6ead5b48b8660cc311c182a7b3cc20a83063eef0f4071ca126341b8083f4a55523445b13e060e5b745527e3b6b44d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
2bc2d1ef644e67c00e139eacd6d6f656

SHA1
56f6f85fc0a8f9f382aadd9768ae777895fcfc60

SHA256
c6acad7eecd63b54c2f12610b273a6bf5b4db737c0f8ce7670e778dd7a394e39

SHA512
ece35c75a697812a113c8fcb625a7e23868e9697bae814665d28cd016af5aedeae21e0d4374f611992bb29e9edb9bba732d5113d7a4a779ee8def28b99509a5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\libcrypto-1_1.dll

Filesize
2.2MB

MD5
f481fc00de7a451fe479c9e53ad955cc

SHA1
8d9f2aa72743d31c2defb366dded6ea059ee428d

SHA256
e498a3f2df1115dc530d39ee7492a7f0fd75b03ee8f0edded6312fc2799df217

SHA512
38660c90972cf21ce6c8214e38787e8e7eb87783c3037567a496c4fe033541ddac4851cec8569be7130c7e3bb32c99c74bec2b499a3c6dd71ed483236c2bbb5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\libssl-1_1.dll

Filesize
533KB

MD5
bce3e91087311d29f741861affddb61c

SHA1
fe63a020048d5933429630f98b9e4252f6452e1c

SHA256
ad857e12f5a589064ba335202c12be839c0fb4b57ecb8eebebd287668a1c1003

SHA512
d7f14399e91ed6c3953660c2f7b762acaeb414ca62b8905306dcf47bb6e27f215cca3554ed608e35611ee09cc0e24ee28015c81f7a7bf3b56dfa0dde03c26d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\select.pyd

Filesize
16KB

MD5
ebc7233b234a0483852c15068d3bdcc2

SHA1
ce0ca76ea19ba638f7ef26a804542d1d35eef6ea

SHA256
15249a438bfeabb40964967ff08a3d76cefccbb2546a7c7a76e72dbe8e6a1350

SHA512
46fa011df4c1e69149934c283413deb552d12f994a074ca8d2f65c1e73b01e1d2486ccc01c7b1d6b60384bc97bbc2f6048422388ff87453146f8a4630382836c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI51042\unicodedata.pyd

Filesize
1.0MB

MD5
1ba1b97f885cb2cd3577049106fd4bf1

SHA1
3d357b8ebf0dfbe1a2b59f762aa9a906b3b56433

SHA256
5327fabb8affb37b3cb474418ce13beabd6950c2b0bf2fac08bed270124fd17d

SHA512
d3353b79a0e2960a8384bae2c57abee3c1fd925a8ff2b8740d25c5c58d31398da66ccf9ce0ee3ce2d31e33eb9652f0c94de15f91c2ee81f6c3280de540478376

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5eqaxz1n.nb0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\msgbox.vbs

Filesize
159B

MD5
90b924c8d449073b02af7b0d83f50983

SHA1
9e3ef2591194004f256146f1632531e8bf846372

SHA256
9317acb89938472a8e7af2fa7d93bd503c5fc95b0f31ea64b558ae859eac36c6

SHA512
0d14616dcf5c39c44b5863d9810abe9ef8fc84744316345d7240d01115d09057f427c870588b1d116bde77e10bffe45fc842c710b54a5db93f420ea2bf78cd45

Download Submit
C:\Users\Admin\Downloads\Illegal_Services-main.zip

Filesize
13.8MB

MD5
7de31f24504d3653227b8c936afba251

SHA1
79bb07ba1a8ac1d0d0c24565c8773aa5c8ed4f91

SHA256
ff0c0fc21fdfc6ce981077a62aaeec378226e27d8e8dd798c68475b02b47eda0

SHA512
67f68e3ad6a5bab23a280bbe616e411923280ff1ee0021905e1443737d5d9e8eaa7520de14f65a731bbd484de3fec114b7d1102abf3aa791f6597c2dd60d2747

Download Submit
C:\Users\Admin\Downloads\Illegal_Services-main.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Illegal_Services-main\Illegal_Services-main\user_data\IS.bookmarks.html

Filesize
1.5MB

MD5
5f77a946fa5a9ebbb41d9ab691d7d190

SHA1
6ed3165ff1f15d75d3a9c42b6763d034ad9f16fd

SHA256
4373b60823f34e5aedcf3f41f6bc1189dcdca3c88751ecb08cd104b2bfa47f21

SHA512
5955961cb92859cb4c6d23cc136a40c16b0a22ed092a5c94e0670287e76e16793eb251c9881812cc89cf4c25820054f525c4f2c9580266777541aecbe0f490aa

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 66567.crdownload

Filesize
8.2MB

MD5
5f986eeab382e69f8859d503da88fba3

SHA1
91ce2a925787bc2e3aa4990366ff4e1e2505b656

SHA256
fde8cbc13c9ec3c1461b72cbffe5d4732a7212652bbe35d2fd121ca1491ebfb3

SHA512
1bde44884e8066d879e770ee4cf6994c66e2825f3edfa3cb5ee4d0aa5a5d1f2b1e67670dcb9742685abb3c293b728d211cf47bef1b9eb6d9bb1b968d87ea6677

Download Submit
memory/248-443-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/492-834-0x0000023A665D0000-0x0000023A665E0000-memory.dmp

Filesize
64KB

Download
memory/492-835-0x0000023A665D0000-0x0000023A665E0000-memory.dmp

Filesize
64KB

Download
memory/492-833-0x00007FFC3FB10000-0x00007FFC405D2000-memory.dmp

Filesize
10.8MB

Download
memory/492-1141-0x00007FFC3FB10000-0x00007FFC405D2000-memory.dmp

Filesize
10.8MB

Download
memory/728-484-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1104-839-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1312-1135-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1564-444-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1888-448-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1892-405-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1952-838-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2224-409-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2224-436-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2224-433-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download
memory/2420-408-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2736-442-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3060-397-0x000001F8F9EC0000-0x000001F8F9ED0000-memory.dmp

Filesize
64KB

Download
memory/3060-396-0x00007FFC3F870000-0x00007FFC40332000-memory.dmp

Filesize
10.8MB

Download
memory/3060-400-0x000001F8F9EC0000-0x000001F8F9ED0000-memory.dmp

Filesize
64KB

Download
memory/3060-401-0x00007FFC3F870000-0x00007FFC40332000-memory.dmp

Filesize
10.8MB

Download
memory/3060-395-0x000001F8F9F00000-0x000001F8F9F22000-memory.dmp

Filesize
136KB

Download
memory/3152-473-0x00007FFC3FB10000-0x00007FFC405D2000-memory.dmp

Filesize
10.8MB

Download
memory/3152-480-0x00007FFC3FB10000-0x00007FFC405D2000-memory.dmp

Filesize
10.8MB

Download
memory/3192-481-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3200-1137-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3200-659-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3260-840-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3580-441-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3584-449-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3624-402-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3988-406-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3992-483-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4072-445-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4164-407-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4336-446-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4372-432-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4700-1082-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/4772-447-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4864-482-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4912-837-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/5096-657-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download