hxxps://pixeldrain[.]com/u/49VrEeRP

Analysis

max time kernel
569s
max time network
569s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
26-04-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://pixeldrain.com/u/49VrEeRP

Score

8^/10

bootkit evasion persistence ransomware trojan

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Drivers directory 6 IoCs

Processes:

MsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-17\SET3A33.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\K4W-21-17\SET3A33.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-17\klif.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-17\SET3A44.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\K4W-21-17\SET3A44.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\K4W-21-17\klflt.sys	MsiExec.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

656 netsh.exe

pid	process
656	netsh.exe

Executes dropped EXE 11 IoCs

Processes:

CodexAndroid_Emulator.exetmp5CE0.tmp.exetmpB5CC.tmp.exetmpB5CC.tmp.exestartup.exestartup.exetmpB5CC.tmp.exetmpB73B.tmp.exetmpE169.tmp.battmpF7FF.tmp.exestartup.exe

pid	process
1912	CodexAndroid_Emulator.exe
2728	tmp5CE0.tmp.exe
2600	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
3936	startup.exe
4532	startup.exe
3916	tmpB5CC.tmp.exe
13080	tmpB73B.tmp.exe
13272	tmpE169.tmp.bat
6336	tmpF7FF.tmp.exe
10228	startup.exe

Loads dropped DLL 64 IoCs

Processes:

tmpB5CC.tmp.exestartup.exe

pid	process
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
948	tmpB5CC.tmp.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe
4532	startup.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

182 8056 msiexec.exe
Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

startup.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast startup.exe

flow	pid	process
182	8056	msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	startup.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

tmpB5CC.tmp.exestartup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tmpB5CC.tmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe

Drops desktop.ini file(s) 7 IoCs

Processes:

wmplayer.exe

description	ioc	process
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

unregmp2.exemsiexec.exewmplayer.exe

description	ioc	process
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	unregmp2.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

Processes:

flow	ioc
17	0.tcp.eu.ngrok.io
96	0.tcp.eu.ngrok.io
111	0.tcp.eu.ngrok.io
132	0.tcp.eu.ngrok.io
157	0.tcp.eu.ngrok.io
161	0.tcp.eu.ngrok.io
184	0.tcp.eu.ngrok.io
13	0.tcp.eu.ngrok.io

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

tmpB5CC.tmp.exestartup.exe

description ioc process

File opened for modification \??\PhysicalDrive0 tmpB5CC.tmp.exe
File opened for modification \??\PhysicalDrive0 startup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	tmpB5CC.tmp.exe
File opened for modification	\??\PhysicalDrive0	startup.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

CodexAndroid_Emulator.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\photo_2024-04-26_21-54-47.jpg"	CodexAndroid_Emulator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qBhNC4i58OE.jpg"	CodexAndroid_Emulator.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\getSmile.png"	CodexAndroid_Emulator.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

tmpB5CC.tmp.exestartup.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN tmpB5CC.tmp.exe
File opened (read-only) \??\VBoxMiniRdrDN startup.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpB5CC.tmp.exe
File opened (read-only)	\??\VBoxMiniRdrDN	startup.exe

Drops file in Windows directory 45 IoCs

Processes:

msiexec.exeMsiExec.exedashost.exetaskmgr.exesvchost.exestartup.exemspaint.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI367C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39C9.tmp	msiexec.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MsiExec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_1.png	dashost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_0.png	dashost.exe
File opened for modification	C:\Windows\Installer\MSI30BA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A8B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3467.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C04.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Inf\oem0.PNF	MsiExec.exe
File created	C:\Windows\Inf\oem1.PNF	MsiExec.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_0.png	dashost.exe
File opened for modification	C:\Windows\Installer\MSI2911.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5f24b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2870.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI31B6.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSI4C68.tmp	msiexec.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_2.jpg	dashost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_2.jpg	dashost.exe
File opened for modification	C:\Windows\Installer\MSI2A3C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BC4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3196.tmp	msiexec.exe
File opened for modification	C:\Windows\installer	startup.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI28B0.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_1.png	dashost.exe
File opened for modification	C:\Windows\Installer\MSI29CD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E57.tmp	msiexec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_3.jpg	dashost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Dlna\DeviceIcons\17b7783d-d7bc-4321-bca6-ad73a7207f0a_3.jpg	dashost.exe
File created	C:\Windows\Installer\e5f24b7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{316E069F-B459-3A14-9721-D616E6BD04FF}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI33AB.tmp	msiexec.exe
File created	C:\Windows\Inf\oem2.PNF	MsiExec.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Installer\MSI28E1.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

dashost.exemsiexec.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	dashost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133586346310170888"	chrome.exe

Modifies registry class 53 IoCs

Processes:

PaintStudio.View.exechrome.exeOpenWith.exeMsiExec.exechrome.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Pictures"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43338FB7-0141-4f90-9789-094256BEC456}\e24332e2c36c2b36312429291720272a2a3115202b212c2b22	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache	PaintStudio.View.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	PaintStudio.View.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	PaintStudio.View.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{43338FB7-0141-4f90-9789-094256BEC456}	MsiExec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

tmpB5CC.tmp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	tmpB5CC.tmp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	tmpB5CC.tmp.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	tmpB5CC.tmp.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

PaintStudio.View.exe

pid process

10364 PaintStudio.View.exe

pid	process
10364	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exetaskmgr.exechrome.exestartup.exemspaint.exePaintStudio.View.exemspaint.exetmpF7FF.tmp.exe

pid	process
2824	chrome.exe
2824	chrome.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
2332	chrome.exe
2332	chrome.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4532	startup.exe
4532	startup.exe
2428	mspaint.exe
2428	mspaint.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
10364	PaintStudio.View.exe
12860	mspaint.exe
12860	mspaint.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe
6336	tmpF7FF.tmp.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

CodexAndroid_Emulator.exeOpenWith.exe

pid process

1912 CodexAndroid_Emulator.exe
11884 OpenWith.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

636
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

chrome.exe

pid process

2824 chrome.exe
2824 chrome.exe
2824 chrome.exe
2824 chrome.exe
2824 chrome.exe
2824 chrome.exe
2824 chrome.exe

pid	process
636

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeCodexAndroid_Emulator.exe

description	pid	process
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeDebugPrivilege	1912	CodexAndroid_Emulator.exe
Token: 33	1912	CodexAndroid_Emulator.exe
Token: SeIncBasePriorityPrivilege	1912	CodexAndroid_Emulator.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeCodexAndroid_Emulator.exetmp5CE0.tmp.exetaskmgr.exe

pid	process
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
1912	CodexAndroid_Emulator.exe
1912	CodexAndroid_Emulator.exe
1912	CodexAndroid_Emulator.exe
1912	CodexAndroid_Emulator.exe
2728	tmp5CE0.tmp.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
4244	taskmgr.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe
2824	chrome.exe

Suspicious use of SetWindowsHookEx 54 IoCs

Processes:

chrome.exeOpenWith.exemspaint.exePaintStudio.View.exeOpenWith.exeOpenWith.exemspaint.exe

pid	process
4524	chrome.exe
340	OpenWith.exe
2428	mspaint.exe
10364	PaintStudio.View.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
11884	OpenWith.exe
12792	OpenWith.exe
12792	OpenWith.exe
12792	OpenWith.exe
12792	OpenWith.exe
12792	OpenWith.exe
12860	mspaint.exe
12860	mspaint.exe
12860	mspaint.exe
12860	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2824 wrote to memory of 4116	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 4116	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 2232	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 4456	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 4456	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe
PID 2824 wrote to memory of 68	2824	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pixeldrain.com/u/49VrEeRP
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa5f7d9758,0x7ffa5f7d9768,0x7ffa5f7d9778
2⤵
PID:4116

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:2
2⤵
PID:2232

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:4456

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:68

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:1424

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:4572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:3144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:3468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5108 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:4092

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5172 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:2640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4992 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:1580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5476 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:3644

C:\Users\Admin\Downloads\CodexAndroid_Emulator.exe
"C:\Users\Admin\Downloads\CodexAndroid_Emulator.exe"
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1912

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\Downloads\CodexAndroid_Emulator.exe" "CodexAndroid_Emulator.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:656

C:\Users\Admin\AppData\Local\Temp\tmp5CE0.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp5CE0.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2728

C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe"
3⤵
- Executes dropped EXE
PID:2600

C:\Windows\temp\35D4E3B07040FE11297FA42741D5BDE9\tmpB5CC.tmp.exe
"C:\Windows\temp\35D4E3B07040FE11297FA42741D5BDE9\tmpB5CC.tmp.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies system certificate store
PID:948

C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\au_setup_0B72C133-0407-11EF-92F7-4A72145DDB9E\startup.exe
"C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\au_setup_0B72C133-0407-11EF-92F7-4A72145DDB9E\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe" /-self_remove -l=ru-RU -xpos=270 -ypos=58 -prevsetupver=21.16.6.467.0.5.0
5⤵
- Executes dropped EXE
PID:3936

C:\Windows\temp\A527C7E07040FE11297FA42741D5BDE9\startup.exe
"C:\Windows\temp\A527C7E07040FE11297FA42741D5BDE9\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe" /-self_remove -l=ru-RU -xpos=270 -ypos=58 -prevsetupver=21.16.6.467.0.5.0
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Windows\temp\A527C7E07040FE11297FA42741D5BDE9\startup.exe
"C:\Windows\temp\A527C7E07040FE11297FA42741D5BDE9\startup.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9;4532"
7⤵
- Executes dropped EXE
PID:10228

C:\Windows\temp\35D4E3B07040FE11297FA42741D5BDE9\tmpB5CC.tmp.exe
"C:\Windows\temp\35D4E3B07040FE11297FA42741D5BDE9\tmpB5CC.tmp.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9;948"
5⤵
- Executes dropped EXE
PID:3916

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp2A4C.tmp.BAT" "
3⤵
PID:5528

C:\Users\Admin\AppData\Local\Temp\tmpB73B.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpB73B.tmp.exe"
3⤵
- Executes dropped EXE
PID:13080

C:\Users\Admin\AppData\Local\Temp\tmpE169.tmp.bat
"C:\Users\Admin\AppData\Local\Temp\tmpE169.tmp.bat"
3⤵
- Executes dropped EXE
PID:13272

C:\Users\Admin\AppData\Local\Temp\tmpF7FF.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpF7FF.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:6336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3036 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4508 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3352 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:4176

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4828 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:4200

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=3028 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:2408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5700 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:1
2⤵
PID:4332

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:1440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 --field-trial-handle=1848,i,9450664949442940056,3811013641523444449,131072 /prefetch:8
2⤵
PID:3916

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:700

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4244

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:4240

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
2⤵
PID:3176

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\ExitExport.mpeg
3⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:3988

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
2⤵
PID:312

C:\Windows\System32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
3⤵
- Enumerates connected drives
PID:960

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s upnphost
1⤵
- Drops file in Windows directory
PID:4304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\TestHide.cmd" "
1⤵
PID:1108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\TestHide.cmd" "
1⤵
PID:1288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2736

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:340

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\photo_2024-04-26_21-54-47.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x420
1⤵
PID:3008

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:10364

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:11176

C:\Windows\system32\dashost.exe
dashost.exe {6f8df306-dd41-470d-b72f499921c83db5}
2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:11220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:11884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:12792

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\photo_2024-04-26_21-54-47.jpg"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:12860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:8056

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 62253757E3393AAD9B6F5BB83E1070DB
2⤵
PID:8216

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 9515F55B74414DD744DC4948FC4D2838 E Global\MSI0000
2⤵
- Modifies registry class
PID:2040

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 0472B86799B19AA6C88E85D168EDCFFB E Global\MSI0000
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:8752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Kaspersky Lab Setup Files\KIS21.16.6.467.0.5.0\kdscrl.rdb

Filesize
3KB

MD5
79a78149e4ef2e6e09cc061338c7b151

SHA1
99505d2461a18f16d4d185603887c60e226347ee

SHA256
e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd

SHA512
a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\au_setup_0B72C133-0407-11EF-92F7-4A72145DDB9E\startup.exe

Filesize
4.3MB

MD5
17e399ee04b420ba28c8d252cb8f10e4

SHA1
ffc9cc3e03764d6ee335226ecc74a1a7333df667

SHA256
70ef2156702f2b2c93e2281087b5ba291e00046e8488cdfc234fea08163c3704

SHA512
9d61795a2d0289ccc1ee0325119825398d62bcbd6cec41eea25d698018bdaf7353aa547769c0664e999aa7080819c6eeabd80b330c34f760203c5034bfe75db7

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\common.z

Filesize
12.3MB

MD5
0a0e55c46740925131996eed38dad1de

SHA1
3edf1c184c59c7dc76c79118287661e479a9c55d

SHA256
d1fa81eab3860ca4bf5bab10d2f1c0e64260bfc6575f68ceb6d08143669ecae7

SHA512
fb7ab904bfdb9d5953ab86a48300a302d1f54809698b325076f04aa4ba0daac84dadfb937246e89e72dfa96cd83e5aafd6fcb9c1c199dc462d2d587ff10180b9

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\corebases.cab

Filesize
138.0MB

MD5
ce245be45aa5aa32d7b82f3f9cfb327f

SHA1
b6c32fbd2f9a269d23ec79be1cf8047338c256de

SHA256
a6dceb3215414a648eb1c9315142965790205da2a227112d7a4fcb88f8b339fe

SHA512
eb5563bf581ef0d50ea6d531ff53bc6c7bd868501be1633e36644c4189cb4dbd53426f283086d1035fec99decb9c70fea2744ca5f389c1349f1b086f2c7e9360

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\corebasesx64.cab

Filesize
340KB

MD5
b4be654654c491adbd5287cad84af066

SHA1
b87c038c869df79904e7744924502b6cefc8ef08

SHA256
31a26020f6fc8bdb5b9d5ba3ea5e2d229085e8d4e4025d296bef7ed95a77edd0

SHA512
7d1ccb17559dae05185dda6e2a6c75eb15772e242cd398faf1527ca28f6a5c1fbc2485ed737efd0ec3d731fcd648f6341e374ff1e6b336502e7c14b3e3ca6f79

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\coreproduct.z

Filesize
41.4MB

MD5
4ad32473098cc24a7193375ba9c3b4e9

SHA1
744010286d0e34c3453b96bc4012ac65565b0644

SHA256
d48760c00b47f85633c3332f21155e3e06d9060d17197dc07fce48fdf001d219

SHA512
ce9310d53178c549d7cb6d60985bd2d87b7f954284179ee436627e9d24f4d04f1e704c61cf727924efc52b414987e057bc8a20b5e3a8f48e9845779ff5f04c21

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\coreproductgdpr.z

Filesize
78KB

MD5
8659e8796f7a80e3df6cbda0f9e46a56

SHA1
c99dcc9125fe6c0395b3173d9f34bed0eeac81d8

SHA256
6fe05f49ed017b5703c6510fcf87f7ae4a3d4e9eb14bec940d99ce4c67f814fc

SHA512
cd96a39019b103277d60a1f1f8bcde5a727225ee1ae91dac23851c10a666dfa81ac611a1dbb145a62e80233935f6bbcfc91a9ed67476c6a9f3963a8657ab23e9

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\coreproductnogdpr.z

Filesize
68KB

MD5
f68ec6f026af944efdf4b6afac8ca5ae

SHA1
b7403d4aab6b3e47f23cd5b1c568009b42828809

SHA256
f0e93e694350bfa674f280f79a19ae0266814d4440aa4e973f29d7731b58dd76

SHA512
17eb6246fc48c042d4638d209e6216a25ecf26ad0cb0a55e8c48fd64f3104f0cf896c00c50c8172721b47871319ea0619354cd81f184db05761badd87ebd7206

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\coreproductx64.z

Filesize
8.8MB

MD5
cbcd8579176c989dfd61c2d0c75ecbf9

SHA1
ce94252436d568ab8615c4406db665aca3e1dc49

SHA256
7e50c3a6edb49caf7b8716631f62b1072a6abeb04127107a63fa433cf515a37b

SHA512
bdff339cd72518d82939048010fd7d4a74fe0c5ba077467ac77f80035ba081736350a685b48e9a3ac9e417085a3d4dbdf45a10076d243fcda0792590127a192c

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\esb-win7x64.cab

Filesize
1.2MB

MD5
53bb37619c2abd017a2a98059cce160f

SHA1
1c06823601c9fb95c9cde94bdc2ca6cfe5c46349

SHA256
a1131a756bd2376c1351673f4e895166e3ded3e0bce32a9baec28cf23edbad3e

SHA512
b9340effdaf90c4db4c87b6cd7765309a2df55ce98b8ea4670a0f34f7731b7d06140dbdb44e17f0e66593b79565f6f25467cf98823dc79732a7ebdb0b1e8c596

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\esb-win8x64.cab

Filesize
1.2MB

MD5
7b98f0b8ea32bafc2d8ad6902ac2bb45

SHA1
9701aa7ebdde2a422e9fd49971c8411c89758324

SHA256
2a2133ceeadee846d80312a93c250681d807d3c1d1d3646d9111177ec175293b

SHA512
1fd42b04986691e8a731c6f12c57a5800ed18e99153a05ad23b1f9a41d63952d331d9da548f81273c567a3d6419f2136aeb9791e21da8e3d344132e2963113ce

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\ipm.cab

Filesize
133KB

MD5
a812a5dae16c53d202f0288d28bd979c

SHA1
9685a709f3b3299b9e056d806e1a16f217890863

SHA256
0b20e7e1dcd014ec622e5f6afe5514b94214be9fc96f837273670ed8e3e1eaa5

SHA512
c13b3cddb37b76f27ecf67f9bc7c5f1ada2da1b2914bd6880ad67433e67bb5dd5c4296b86499da03aa7407b5452d9043f6fe587db2bc3a8a3bd029b9add3c342

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\kdscrl.rdb.z

Filesize
5KB

MD5
2bba1d164c3e753221d404549d2f8f09

SHA1
14164a43a90c6f57efb462b0c932321215c324cc

SHA256
161f3b13b6d49395a8cac0409c04833eac1b0b08804f1d00fdeecd7ad59c755a

SHA512
5e3541f8a069436c635652ad43a1bf7734fea9a2dec4d0dbfd972219c5672babf65dd10679f90516f781018cead3ab701a63ea2d315d50836363780a37633918

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\kleaner.cab

Filesize
2.7MB

MD5
b05dc0f26174e395870932a32ae7aa24

SHA1
6a115be45812088e6c2ba1479d83bd957af01d43

SHA256
965bc91c9688f0459cacc8df4b324faef2d0de17daa0efce72d3d878235ee4ea

SHA512
0f4115d530a9220cae57fdf81dd427c917bdbe153c1655c4e8de4d4094be0b532189089eb70a01f2c3d3689f2ffb1c1f9fe9920b732a55688a7cb85a1e5dfac3

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\product.cab

Filesize
7.8MB

MD5
e173a52f65b38cc5b36139fe95354fe3

SHA1
26d8790582d6e557b4b8ca9b65c90fbe59a9ee05

SHA256
44bb704d981dc2fdd61feae90394806686f8762a3666f0ac094f9392425891bd

SHA512
e15c55964bd60bca3c4cfdada1662cf8f21bb298df3681f9efde2862bbd32715cbaa9e9d5484803e001c9284c37dad56c9b3dc7524675672960bfd7a3ad74e11

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\product.msi

Filesize
15.4MB

MD5
670041e087de24ceae810a8ff970d0e7

SHA1
bf5963f663d80e836f72b81fb73e569d053a2885

SHA256
bb37700339fb4394d9a6df8c481e078767107da1d7db054a140c646568ca795b

SHA512
52b53b4347279ba71599bc1ce871467a2a28f000a98d20c5d7638138e32d21438a72e4c1fdb5b797d810271bd52dea499e30ba2a7adc20e19dca3a081a7e49af

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\productbases.cab

Filesize
12.5MB

MD5
e425cb0d2d9f2727223a8d68e13dcecc

SHA1
fd70bd8a434a6b3ec49612183b0fada11c211844

SHA256
9b0b39744db1afe3f53fca5a31db711f2a7d3c2990cd63896adae1bfc35da511

SHA512
c038aa4f0d4d28b40b65e320b7ac9cb0267e36d545345fec7b47c3046da0f000cc8bc1e125084b25ad80a0152335c0e36c076dccf93c87f0bca9fc8e21936f3e

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\startup.bin

Filesize
4.3MB

MD5
d93b78ecaae3bafaf137697fe9577aa1

SHA1
c1bb851f038cfc496511fc2e778967c5ee69c63f

SHA256
c00c192b8292f10810edaad88ca5b1aee7d7a413c987ea4d08fe33ccc0313e50

SHA512
fed76001369baf0dfca9c75e9c4944871475de83342f7b5a7148393f07b7679f8c6f5557a7688223f855198ae4c12b0572d8e7b26b554fb10ceb1c0d7efdbd25

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\startup_m.bin

Filesize
4.3MB

MD5
1e61ed960feaebadfd53cca0707d1636

SHA1
8452ecfe2773439c50546b389aed6df1d3641147

SHA256
ca34e8f978bbf7af8ebaca17a3caad0e9308c750237fb3ada19c16a9265d0bdb

SHA512
da82150b66edb552cefc903b7e09ca1479ccedaa53089dae90213e04f588988c0ec4ae8f4efaba18edaa20d9ecea60be2d825ec199d530ccc758e06bc7b78ad0

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\startup_o.bin

Filesize
4.3MB

MD5
e08c79a89bc7235253536980e71054d1

SHA1
812cce5a3f974bc72498194377cd55cae70971d7

SHA256
be8a0f136ac02ad95fab2402f33e295ed6f31611d4a6833295f8568ec9cc23cf

SHA512
956216d3e52b548800e30fe4d367cf269c55ecacaa5755f8d8e779e18cec9d30e4722ad156859dc8725c14aa61ef1188586b1c6261f02f499aa4c64a4e1ad909

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.2.0\x64.cab

Filesize
8.6MB

MD5
85ef2f683a17af1a421e68e806b88482

SHA1
4e6fef04f0d9fa0dcda32ea599e4e28006f88f46

SHA256
4c92cfbbd4151760050edea99cf27d18e29aa7d4d7bb27d97e8089cf6329b58b

SHA512
c40e25e7928f44735911c2e01409f6d8f59f5119b9ae6520e87c0b8d79f182061d0b99a116502db515b4915ec51936ae5711a0b1147dbd614943dde32cb8365f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001d

Filesize
64KB

MD5
3ece1b23510f4875830f222d1a853705

SHA1
679e11c6e72c3b8388d62d319d3c20937dfaef38

SHA256
d76667f1321b229fbcf572a867b7679dfb9cb72914cd5a7293e99ce7c249a539

SHA512
7f968790a3ba41551144b8dfa235ee744ce2af153164e3c62769d9f0a269a458f114dcdba3f74e915682c155562d761cd3e37e194195421a33f440ccd9d9ff95

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
576B

MD5
923c4211867c48c07b622409198fb3d4

SHA1
9ba3a7714993ba6c8741fd0fd5248c748b26c2c9

SHA256
2b209b351fa561a967a68a2ee193b0ee4f4553fcca6c366b3466cc01122e1059

SHA512
5415a68aefebb72466e3a9cf796d96c2b61a80f01c351750f70533878acdc2dd2ffa1d161226398572326401aee93bd3c9b45235a67f728bb73bae1caf3ed845

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
0df023994d6a0182913773ca09aab248

SHA1
190c9651b1f8791a80411a634f2a76408794aefa

SHA256
51aaef17291a9455710fd5a60314447e17ec3a2143d7dcdf38d554416f14f99b

SHA512
b1fb7c11c4ba2a7e1701b293b92020120c030ef0360c31257a21ae3990b0cbaebb4edc6f002f91e037e9b76038b7f64b39808eb1c9546f69602c97a6c9e94499

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
590d214f8f5a39ca54bfeb7067ff5512

SHA1
e9e03b23c16939e37b1f617abc73f02a50e0f76f

SHA256
0ed55d5347c64e1f9d5ad6c345e82bfb085a4cccab470573f1acb8630726898f

SHA512
8c7616667bccff9985e05d2a1fd6e4252fd911d23ebe82a1e8d0c6726b51d832b4a87620292c91724db5f788c0c52b05cce3ea57ddbe1a92af8fe5850980fbce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
e9b1bf0b6e7edabed3b73f789e4043f6

SHA1
c176972a729a41e31e76c8e1a744245660f74058

SHA256
7d474d57cbb6570a3f4de6debb4e69716dfbc5d7902f506237620cbb3268e1f2

SHA512
f169ce02ef3df493edae76930b19fee08c315724893fcf34c9c618e047dc3d2eca3f6b7a9724efb311bdd4360f04c09769e3e9a27159aa7e668d175a6b5019b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
1dad37ca0cd4ddb11ab8aa8aeb600737

SHA1
35c62e064b66444c58927e45e4c3b2af05161508

SHA256
5c6fcf3c12f1a3194ac4c0ad14ebffb476efefdd1a4ce3681488eb9e26869c0f

SHA512
8d3d4b205839c5c5ce80725dc2e2ecc573ad2e291882d59caca7e1c548c6fca9f84cb89cfb8dd599edba6d5026b0c9869c695e33142a5ec360204b400e21ede5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
b183f15d78254685d05027e6306410fd

SHA1
00997aee2b2f9a69704d1dae612d8d196fc0568b

SHA256
f4e5dc57808fde7c399413f41f410371992740f37272474f5add56d917938f9c

SHA512
b4bdec7f91768b9bdc772406349a04165521e11d18c77b8472a06e436f8a88c93bcb4b6ee5dca52b839a16d82f0ddf3486dace07291543077b261e3d54b47032

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
aa99cc53d335a283f06f8d2f34c5f7a7

SHA1
3a1c06797a5a4adc5762913d5a768c993c174bcf

SHA256
9873528c2c4868bd8fa11c0ac40ad86b61632956a1d97b3a3c2e4bf6728d0b13

SHA512
477bf000a3d9b6434a58b35582fcbb36d291a6a82b6037bca8c9bd450f0830b01ae75b891a1f34e5716873c741e2599372bf3391241ae66010d61ba0181994f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
06a0ee441ddf2a9c2ca3e3e8c92086a6

SHA1
b2038fa54d22c04e336e10dfee153686bc5c70d4

SHA256
546a4229cc955e019ba9b5e254d720c45d818b8047d74c5a41daf995a8be1342

SHA512
aef3411eebd841596c4ed4b1d3bedb0a333d9bd4b974f38572218073803a94b7883f636a333cb78326d9d2ea9c3742e12d8d8792da98632d73ea62fac9fff516

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
336a5aa178381a7def3c1e78fd96ac48

SHA1
ba646d89e9c774bacafe2b2632cd0ac1b1780a55

SHA256
752099f23186dfef9c3d5c04d520472060d72d6040d3ef4cdafad710e5745b36

SHA512
857601a45a25b66232b8d72b4392d92892e9d4d6d6d68273a8759d4ec8b1a64b6ed34a3d52dd4e7556835d0a255a3e2f8e379e3a5a5cce62ce994b42dd7e8931

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
2de20a2278bf3a3c5acd10aeb4eb0278

SHA1
d84575dbcf6727410e1905c54221f486e35be19a

SHA256
db40f9a1534f11cdcba5fe751484c101df0738424a59c0afbd9939cd0c77bcb3

SHA512
91d8520de1eceea3c6c68b682c4e58058020a0ec87767f7d6660505a5e90887616860ceaa160b79f34de8731508f73df2caf2edeadb62ea4711accc2d0400989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
4e6d8d7e16cf19d77582ea4c873bceee

SHA1
754ae88413aceaed663c4537c4a41f52480f250f

SHA256
d260b9e223b9de20e2c6ddbbfff2dc62e1085398b6aa63d2d9415247e7c53d9e

SHA512
117712df2cf76228d747580b33b21060967cb7ba6e3defefec594709075374435a4dfa91909902e45a04c33e72608fd4ed7403c96d7eb0785e126eeb6b0fa224

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cb921654ab8e7ae55d274056892ba7c0

SHA1
842cc51aefce22ec5a6ff6ff9807040b2fcfe6ae

SHA256
aa4a480be4af3bf66cee322ff0e4527f9ee7b95bf615da22409dd7987a2f07ce

SHA512
bdb96adba23783293f1654be691dcfb5fbfce905fa346a4905391881a77c4bec8ad8f65e0d6c095a662c07441953f02ea9912096a406c8cb810c5839f53ee8dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
7c068e1dd2d98b0881197dfec072774a

SHA1
3cf486a0e41733414d3bc08bd33f5f84d20144da

SHA256
ade020f72dbcc1c66d5ad3872bfead6b9e6cd2373bd0c3cec91bf66d224c945c

SHA512
38507a28fb68bc6c5a8002b3c461a21dac392660453c894ba72b3e084ffc4757bfc3175dfbd10acf1ab73f31088fb129b932f4f8aab22adbcb46f2fa3ee4a880

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
adf5d2287fbebbc69222022c2859aa75

SHA1
6da2df74e2d88835c5c9b5d8b4f7d00acffcb088

SHA256
4b02c7b0ee5c0deb0a6d4911ae95d921fabafd1719cf43e095b5b1f4d5f65ae2

SHA512
76170dd13f40a9e67afc15e8d50810b17c9cfe8f2659ee2beeb7b011e7e4d8382133e8639bd564d852c3d9e472a485b924eb338d7d851e6e7385996ea6e2b6be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
539B

MD5
3dbfa22723b14cf4ff8b947a53972cb1

SHA1
6d2d1543934be7fcf9c9b3fae2efb4ad02f8cabf

SHA256
ec684541729304734cf9be0bf05c257b6ff59bd4e7e3b14f21627a1dbb6b7c36

SHA512
91dccf8c17780bebbbdf273501f7991bc986ff7017256d1e7498e148dc18ebf5d3d7e607ac5a7f876b667559834b6806397a892d50e3511824db270aeb480512

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
b4e9542366787b436bc371f410c1fa51

SHA1
b7f5be930e4f1eb96c0fcf5d6dd34bb9d15ab55b

SHA256
0da82f99be9112e84b485e2cead3e89f3d4b813b2fa97d561e3c8d720e436f12

SHA512
e81fc056959a072a757f0686c63b58356c61b561e86b23dbc701f583d38812fca8a750f735e492132335c9153dff5839ae756594cf4b614c85e71fbedcca1719

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
094d5428d917994ad897bbba9cfbdda6

SHA1
ce73fed600a473fbf9f34ac511b0a7f0c3e16529

SHA256
e5a32e8d900f8e1f19bc70f053013f509c3f3413a26e3f47abb4ee0b0f450890

SHA512
0f6498525d3ed943e396bd252c953afe359a61b628dc691c9a213cb87f4cbdf06e7858408482552e7e079b91e764b69b596f8120fdb72ef9e442ff41c2ab664e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
83c6cfa72923737c08613990c4a8b88e

SHA1
a3fbe15c80620370591e788ca408429b163aca54

SHA256
9dc092fc221d45298a31cb0e82ca5d5c14cf3715a65161fd5324475b5983c8cb

SHA512
20bd450a502efcdb3a42820d04002c051e86994a9781ef8cd560a4d04193664d173011064bd22229fc995adf4aabe68cf4c20cd0d4ec7a2575eeed77f88d97a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
af8d6123e7ccab36dca8e28254412685

SHA1
8203d8a811e6969b840335d063e43e2d32f994a8

SHA256
81c70e1c67aba3ac30a14075226b296d5a7f2b82378adc732856ca13365090a4

SHA512
4d87eb644d867607b7939c4f8a05dcae5c62c9ac0eb603c0ab66c5e5b7de86e90f4d07eec238c6d02ca851c7123addb610c7b5f156f64331fc7fb253e79cd0a2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
6d74bb196ccde5544701882223926d6f

SHA1
2e1fb2adba2058daa4ec837623ca9113b8548c77

SHA256
11c8a5f5272751a78df6ac7db89e23fed9336ecf895ffabca839904b55c15b84

SHA512
552de2fe7f0370d709fdde9400025a964a9468dea8bde5a7071b3b6d2302cd5c42672aee3b0aac19fef04b74df15071165d0707e5360985051f9431b6cc37032

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
54a8210c40c96cefe539fb76f28a165a

SHA1
5b2e4c3c565ee23ca65d7052917d7ded5528cff7

SHA256
6d695a68b005513daed071eb9047674662c37c0bf0e2f49d80f299ff5574d19a

SHA512
190a2826b5ea6e015cf7261d779f359af9ae06042653040b5586b81243994863ff6ce4fa967d7bc01ccd6ca22d4330c43e0ee8c19790c88d725852a40bca6c7e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
52579920dee4f1c61faab86806f72a89

SHA1
dc311c7ae869bd9c7987f8ad50b330e196a1637c

SHA256
4b5896d9c936f29eee03c7808edcebbb0d33b773904cc0ff27465872f86334d7

SHA512
d74e15e62e394afc9508d9790b4940c9ab7fb4c2ffb1516e93b29c1b250e56e943fb9d460863839f01d36b2c947d0b8c66c68b0eb1a8fefcf5b201744bfa3b0c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
d95247504520cb50ff2f16c57160a285

SHA1
2ad68e06abdbb04f52974547bcc8727426c2b7e3

SHA256
8b9c39bc6e3319e8223b97a3b618b95e2a85d3b24e32aec2a0a5dcfbdf6100a0

SHA512
211298df3f1ef3d25d25105080fadea3e10ffda10c57f2ed338ba24ad8407d0ab50073cdb74a2a978d5725b39f17c376f44e9145abbcf4a769d5feee150066af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
f2ea7f106c33d9a99c2484e9ee963394

SHA1
d8a81b35eb5f1098b14cd280899a3808df528964

SHA256
6b4fca5ed0583958f06a749a549537ad2d462b16f73489cde60a2cd48644e002

SHA512
bbba8a75584eb53af12ed6f1d835f67d80504363e4a14d30533ba13437b8544c5cf84657598bc7e3948f4969aff5320c35f526aa3267b5c805a76376621e3ab3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
827ffa7a11347878687bbf1f0ee90ca8

SHA1
c543196ab8dcac0e1eddcc36d51bfce098e2be3e

SHA256
963da95a88ecc967088795be839330f67157d5b6445ffddb809da9743d905702

SHA512
9009c69aef82d526ebc66a0dfeea6b8cfe98e370c5d8782bc83fe151d2ae576f86ede6e51633a3509f2f6c8374113fa80ded3a640c1d9cf55da691bad02bd9f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
136KB

MD5
55f5ab4aa98f13f78d3118bdec937de9

SHA1
5057b30dc8fad6f18f49ff7b26a1b7b5e29323eb

SHA256
4f9bf51154736c6000085c6da9dd9e62a789a715dacb0a7728048ca126885d79

SHA512
4842466b8de14655679962e2aa2d2bfa5c52b6f2b194f641d37d4e4e1e7855cff7b16fc4e1041835c757af156cc28c7895155e1b1f728cc5197ef03592f5bff5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
111KB

MD5
92e013d0629771c52e38e097187ac79f

SHA1
b8a040af51118f3fc1f3e81afdd38dad792a9f35

SHA256
d9ff29cad5ea35c659eb13e55123ae24e9ed21fbcbc9bf5e3d872477c8d1b567

SHA512
e0a676fc47bb49613a159b42624bf9ce32a662fa6390b5af526525157fd220c771339e0d22ff5c2fb77b42d56c8004f78038da75e81dabd64f5c1d6ee8aabcd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
106KB

MD5
2222d212c574b40892cdd799f1244146

SHA1
5dbfdacf373457c9d6307bdec06da90fc32de434

SHA256
9d27010a142f2da238a1bcb6a19c73d96843354217e9d233919e9a562d134134

SHA512
7c1e46e1458ae3462ab3b0fd234b9809aa64698f50fa2dcf3769d54ba45be68910b3ea83ecd4aa3e496b07d61efa2770e2b78704633b062468e39efbde6293a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
112KB

MD5
8b4fcf8383b27e0bde777a9967b2bba2

SHA1
341eecf962c3fc066060d8e0393193585566e6e5

SHA256
341bd43c7f6bba5a69934c3d62027110f95465e467249b07ebb462cb1da798c0

SHA512
3d7ea154d40c25797d9b75386e619ab6135346d07c762a1f7cae924511e310662d76cbfb5763b1bcf9eb1ef206c72a761bbc18bb3049ae14590c00130407c665

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57c41b.TMP

Filesize
93KB

MD5
d03916e2f6bcac75cef01ace65fc2298

SHA1
f8555f2824c9ea85e845cd2f63ead87233807131

SHA256
eb0480f79076a379ec27bd74c4e7f9513cb9e0b33f5bb75b0a462b08a04bf6e4

SHA512
aadc74b32fb7611ecd49389eb38a16af5646ecea852d988e896f354aa152926d103c2e988cc1df6fe2653364b91a19c3817f30dfd8f976c19f30ebe5a74411d3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
512KB

MD5
59ed3b3563f694c50bba2f4a8d9cfd11

SHA1
f5904d72af6d25d8674ee88e373f58b7f9aba764

SHA256
ce516ad6d612eb3c4fc794dc30700dc10b816e9fd7bd916385c9704cbe420a75

SHA512
ab93d32c53972d6083b1bd9fb8a2dae60d7d35ed202cc3b221152b1cb26fc10958a6888be5c65491e0f7ed9d2cdcbd6193a1e22c6aabb76651c1cd010d108784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
24ee91514d85097fd3599554fa3834b2

SHA1
6dd262cf1d0011865601da03dae9f78bf03a628c

SHA256
ddefe76cd5da51d5feec0267978202bae7ad9d8c9ad253aa684d9f1b53623e22

SHA512
a14db42e71cbf6c45350408bb164672af9757da056603d96eedce24d4c8e331d77dfb51e23617c0bb2ade29fbb208f0ba4454848e073ad70e34719a8ada5eb3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb

Filesize
68KB

MD5
84f0efef45556a1e6efc09eabb58319b

SHA1
e4d7ea31b2b82272b1d07d4803a3b0c4138a2856

SHA256
f1315a1a6ca17e5f69514a9e47967ac6cb9e542f85322bd4b6c7feee6e5e3fec

SHA512
a30df41d046cd5aa1696a1a646a962306eaace226cb018104a23547931140da9c045c50398e9aac6d6ba761fe7bd11627739d2c0b067f60d44cfdaae44a5de8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
254B

MD5
956ad5d6786e03b8fe6c801ad4b6ef39

SHA1
d4fd467a9a04252cca20bdc54a16e9ff00e90b73

SHA256
e1fa97a28781b472a2bd87f54a76627ce5cb92543f365dacacdb286ada17d99a

SHA512
accc50686067ad8c8e284ad2b5744b8e0a3662ffeaa193927eb1c8ef1f1cd56e67eb06fd0e254dfc23a0e0d3745a7c266a2cd10b8f89e905a01134762d00cda7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

Filesize
2KB

MD5
404a3ec24e3ebf45be65e77f75990825

SHA1
1e05647cf0a74cedfdeabfa3e8ee33b919780a61

SHA256
cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

SHA512
a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\System.Windows.Interactivity.dll

Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
C:\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.ui.framework.uikit.b2c.dll

Filesize
543KB

MD5
fb389c9c3c063163f5609608405f66bc

SHA1
0d2d249335b82941aaa7aeb58947c12cadf04ff8

SHA256
7e97138fe069a260a05bad7beddc31fc54d0909f36728ab0efa761e7580393df

SHA512
c169b1e6fecd432517f58bac541820c4fde5fefd847b9dd4544d290f95334b8fc392b26cd02eebeb30aaddb87885bd35b1f0c46644b1e5b9e9c84115afebf0f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\GuiStrings.loc

Filesize
22KB

MD5
09c4e9f41c4b8bfdb6bf8916af730ecd

SHA1
a215913aa718b459d8e3c13dfd22e5246dcff38c

SHA256
57bf969d3c10d5be0a4b31b8e530c1e005622c8dc809ee4fbd4c214f3b3e9a37

SHA512
7767639c5e068fd3e83a527dfce0345c902673e50102a6c5ba3998ffa2d16f0417a74bee15fce9b6825eabe94f6d36c4528cc70c4541294415b26b9f0f64937e

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\GuiStrings_KIS.loc

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\GuiStrings_ru-RU.loc

Filesize
56KB

MD5
e537843eea492ad205e49f434641708a

SHA1
e37ce9708261c4f144b67c2075c8c5ee36291274

SHA256
d6efc6134a0dcd65959341962e55633525ed0bdf48de7a9ceb7933eaec44321b

SHA512
ceb12dd551d848d768516dd6cd8a8624a39d22ca9bc1cc9439657c4e5edea7e4cb1438c54b60ff8653908395670102e7377000b1123824b84a55e6b43be02970

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\GuiStrings_ru-RU_KIS.loc

Filesize
740B

MD5
d1f6e9faef972acd6dcdf47be107861e

SHA1
8e7d0a986bd97e681a2fff473ed8204d2493e096

SHA256
f429fc27dbe2563e45c16147e418026404c6d4a0d1752b53ee7f95a24c9ed786

SHA512
c3c11f5c348eeee4d974768eebdc79c287acf4ad9fd0901c5d16a0401ea6302e738234cb0ee9c83f2133e0aafa9cb1e9e84c90cf87849fc7d9a19c64ad848b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\downloader_neutral.ini

Filesize
18KB

MD5
1224967a336a831fc3d44d58bb3b471e

SHA1
14b50d80646db3b078fe3cd98bd376a8421c52d1

SHA256
20019da9afbee4e3e2a9a1f9d32ad53dd4e3bc23368fc8e5e5f77758026f812a

SHA512
388b8ef1148fc7b1be8fde2faad7e6c95f563d7ca8ba8d200cdc82ce27c92b956a2896e3972a7f5518e80d93c2ee943f4abb1b0930dc7d56dc76c344ef893703

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\downloader_neutral_KIS.ini

Filesize
1KB

MD5
7d1ebecb49a1abddf80e36bcab9c4924

SHA1
08192de10aee08ae3cbfc3cb9063563466eeef91

SHA256
cc52c7f0764052ae08b0b0ff54212de04a76487d7ed548d3825524ad18bc955c

SHA512
a47f1d0089cef93a92b3dd30a98bc79b7587846f73c7220a9d91ab54fca0abbd61ed9bc01d029d948cfb783dc91efcce805aff675adb6a295b5689e348c9a708

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\downloader_ru-RU.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\downloader_ru-RU_KIS.ini

Filesize
60B

MD5
185f6029877918672087ed6065ea905e

SHA1
b08e89f9098f825884e3686875cb5b43c48559f2

SHA256
0b370da5018c49405a6d3214f5630fe525ea331c321360313f4b054b1799a254

SHA512
6725c4662d924cc1a6f4baab465619146aa58496b8472aa8d8062e8fd3b0348de65ab3d6a8b52e4ac38e256df86e058331a1120c9e7e5520bfed1adcea71cc13

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\html\yandex-logo.png

Filesize
10KB

MD5
799d56127b9caf682da75955b17148cb

SHA1
3ce8f4ee0a252aa5ec3207596ede45a164e2d70f

SHA256
1f9bbad0dacaab3b0ad5da494ce69cd4eb042aeecd5a33842f5f5523fc651b65

SHA512
544582c7fbaebb295c447e32e56ababc33f3b05c344039cdad4d11c98f0db27d3e50caab3efd0d20c8c588789da88a7a75cf4ea1db90fdb68c1c15bc5cae7772

Download Submit
C:\Users\Admin\AppData\Local\Temp\0B72C131-0407-11EF-92F7-4A72145DDB9E\mykasperskyfeatures_ru-ru.txt

Filesize
8KB

MD5
a38563bc8e31f082e2d8fe9124c83973

SHA1
01f77a024b4a128520ba62b0b13108c15a71bf45

SHA256
f1ac5f177a4183463b655c7eb1afbac13c5955ceec1a512d16a89c9d77fc931e

SHA512
4b5ebb658e5d1ee04310f926b37765f7b6e658f6a66687ece3b935cbe2e3ce2d60f33bc57881a70db9e669b8174881db14d28da004db4a3c06196355a07f9f3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E888127-0407-11EF-92F7-4A72145DDB9E\eula_ru-ru.txt

Filesize
51KB

MD5
9e51ec8fbbb3db9c41cbb7bcad644f52

SHA1
e0911e46a591baee22532559452f631c804def2b

SHA256
ba0c07696ef78db73e3a8c24680ef115d484722596c916cb713bfff9dc78a1ec

SHA512
a9d2d1f0392a158079103126271bef2f4c32fb962be21f2a4d3d3b54f2efb2921fdcd0eb0a5efc0f63c4c9118202f75a5c73d2622822db761454c7c579188ebc

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E888127-0407-11EF-92F7-4A72145DDB9E\ksn_ru-ru.txt

Filesize
54KB

MD5
2af0999cee35626dd3d1d9cd4b22bc79

SHA1
2cb46ec8d62e51cc9aeb16d401b1f5d1caf3bdde

SHA256
e9aeba3402a30ce346c9818ed4eb8d011d871c3ba5421b42555d056eef4165e6

SHA512
3cdc04dbc7077874032738aac5918afd432cbb11cd459463ceaeab090c08ddff669a5bf6e6057dd34ff463c1a513b4be49de6c112d6832daaff3bc60f336db15

Download Submit
C:\Users\Admin\AppData\Local\Temp\0E888128-0407-11EF-92F7-4A72145DDB9E\kis-select-down.png

Filesize
179B

MD5
eeede79637195b1b1efd8ca118a97df1

SHA1
250d41f2b47718d06af59aeea357a46173072953

SHA256
af39a5ee8977cc2a6a8217d6d051286320c2524fe2532a501c3a6ef60e68ad86

SHA512
b9f6cc136c4ed21b365c93eb621aca426e0366dda817c5c44fa81759bccad1078e480d9b92d6b8423dcb6b39194d8967c1bbf5d78f173747ef250b6778776246

Download Submit
C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9\kl.setup.ui.interoplayer.dll

Filesize
56KB

MD5
baf69d3c6977161e0c2b631b3f9958d4

SHA1
a1b2982c11811c4e5f6bce95f3072a855d11c369

SHA256
e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

SHA512
2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

Download Submit
C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9\kl.setup.ui.visuals.dll

Filesize
420KB

MD5
6181240bc579d2dfb176a1ca260f5a90

SHA1
eb13b6cd4a242c8399396795d1863954b8d79507

SHA256
b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

SHA512
f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

Download Submit
C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9\kl.ui.framework.uikit.b2c.dll

Filesize
631KB

MD5
445e34aa976419cae54e13ede8d41ce5

SHA1
98ca3ee808f97ae16970b0fcefd3387bd07278eb

SHA256
a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

SHA512
86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9\kl.ui.framework.uikit.dll

Filesize
2.7MB

MD5
18defb1e3b7460f592a8ca61e4b40ff0

SHA1
8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

SHA256
02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

SHA512
7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\621888E07040FE11297FA42741D5BDE9\setup.dll

Filesize
5.6MB

MD5
3278c1155c263b1feed37a4485e07464

SHA1
25c405c0c4b39b3542874bdd927db147caa4a645

SHA256
c3794a5439c3b67facfde818d9f08ef9913c08fca2fe658f84bc22133ce1711b

SHA512
da08c6ea3e994ad452a6343a1f3029fff5dc122421b8a7006762a357e94691efb1c21f3e5a39635d64b82b49290227ba9524cf7b8b12f572ff3cc8e9aebc0145

Download Submit
C:\Users\Admin\AppData\Local\Temp\63FF3291-0407-11EF-92F7-4A72145DDB9E\netcoredistr_6010_x86.z

Filesize
29.5MB

MD5
a52fc0a7ae337fc70034c27f8641905e

SHA1
596d958080e506a34c339cf0a70defc21326b573

SHA256
37511451047d583a12c93fdc02387b0803deb5749efe21ba90b415f98f312e47

SHA512
98c905aa803624b4c58849a44877449b9c5afa9d5b0335645630b1f29f807db86ecaf41f131733974c7fc9dc9410163c2143464a00ab1cbe40db8c1bb5f2fe7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\70A177C5-0407-11EF-92F7-4A72145DDB9E\cbi.dll

Filesize
131KB

MD5
2c9ff0702d21a9634fda780095027dd9

SHA1
bbc7d4c378434f9e765eeb4714ffaf404d9aafba

SHA256
08d8805569a5db3f2979dd9cfa2fea214978e464b5149474b6770578343ff9f6

SHA512
952383df24bf85a5f17360786287e7c350d8824bda66a47ea6014cd19001aec2e3a23f67d3457a07d1bd82aba0923945fb33c8e070d4b79bc7d8d844d23f1b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\discovery.cfg

Filesize
30KB

MD5
0791a1abf0cf4e7f36d2637f24dad244

SHA1
8928899ce4fb63b9dcf960f84d3b92d7d3c2b547

SHA256
35deae832278c47afbcb6e8c940f5bfc66d5b3fceba6ef6c2411b2c5065a70eb

SHA512
9e507bcd5054d9952319ea0795fd796f6915263a3251db10b632df6eacdf419d5f1c101f91cb9d39768f07fea3af1156af10e5b34792bf9378da840f78a30613

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp14593.WMC\allservices.xml

Filesize
546B

MD5
df03e65b8e082f24dab09c57bc9c6241

SHA1
6b0dacbf38744c9a381830e6a5dc4c71bd7cedbf

SHA256
155b9c588061c71832af329fafa5678835d9153b8fbb7592195ae953d0c455ba

SHA512
ef1cc8d27fbc5da5daab854c933d3914b84ee539d4d2f0126dc1a04a830c5599e39a923c80257653638b1b99b0073a7174cc164be5887181730883c752ba2f99

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15859.WMC\serviceinfo.xml

Filesize
523B

MD5
d58da90d6dc51f97cb84dfbffe2b2300

SHA1
5f86b06b992a3146cb698a99932ead57a5ec4666

SHA256
93acdb79543d9248ca3fca661f3ac287e6004e4b3dafd79d4c4070794ffbf2ad

SHA512
7f1e95e5aa4c8a0e4c967135c78f22f4505f2a48bbc619924d0096bf4a94d469389b9e8488c12edacfba819517b8376546687d1145660ad1f49d8c20a744e636

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5CE0.tmp.exe

Filesize
28KB

MD5
6c2210ba180f0e1b9d831c3c6c14c8b4

SHA1
00bebdf704f4cabf254583c6ad87c6e72872b61a

SHA256
501c36ac282029ccf7950a4957d4c10ea72fe18f0ad8d6daeabfe628fa4070a7

SHA512
26a63ad05199cf45acd7519fbc63945097b4c4a89bb2cdfa4f87ba004e1ce106220b0b99419e656de26d164265b3868a9ce541c71b05d4e4db1a9a1343130e9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB5CC.tmp.exe

Filesize
4.3MB

MD5
11cdc5cc38d5a8fe00271a57db610180

SHA1
50656dc0da6538715312cf867d089fb5dd34322d

SHA256
33ba198f59e0d606e81cbb1bf4cf9eb04b7483f5328642c3395e057b6b431cd0

SHA512
a813a494c3b78a80d7ee815b6340ae989a6398ff7a3e4e5c2e7072f1dae9959f99d0ed7578ee6e66890389f19d023b1ef01956c1e39b8710838effaf7d444b22

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
1KB

MD5
5b3d28e8ff300e947f3b516055f91413

SHA1
e97ed4be8d9cfa7e9617ea89469d7bf16bc9b040

SHA256
28faa60a8acc203a7f01a4a14348975423d190b21ae8ae4b62bcf5409a8fc9fc

SHA512
53a5e72273b87fbeecda9e885bd2e94fa8cfc660dd34267735d39f60e94f49cff8a5a40d8de4363e4fdd88ef2dd961897c2393398ab4c50e071a13153184f0b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B1D34515-4D22-47DE-9BEB-8D01587FE861}\msi_common.dll

Filesize
387KB

MD5
8d466ddf3c56f23fdc2092048d72ff9c

SHA1
ef52c7bffc600d19c9145dae3945fefa93d1fd51

SHA256
be4e6bc0ea54cdf516b5515fc49d6bad6421a348e1272d3c949ff7434758f14d

SHA512
31834233d1069e6c4bb864b23edd0946a49a9fcae25d793343656b0909bab4b9ca47de3ec698002bdfaeade667f1c6e5c546268ffb9ab4e4ebc05fbabd1cc3a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{B1D34515-4D22-47DE-9BEB-8D01587FE861}\product_info.dll

Filesize
269KB

MD5
8c54c9a5ef361e2e47519a83f9d344a1

SHA1
a489ca82b68954dd8230c78f2f155a2822b4fe33

SHA256
bd401169975aa5babe4858330feac645cb94fd613fb89dffe4ca2e09b963fde4

SHA512
da965fdec05b7330995282b700c38c32e0fb1651b49bb67cbe525c43fdfa9fd4ed330971f5cd5f0d37f29b66dab850a6d81636f3beff0ec7cb822a4936cd25cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_F5BB7AE13F4D4BADA380E9C75BD10EFA.dat

Filesize
940B

MD5
5f551277e7321d02401891e352e3339d

SHA1
51a162aac6e81c18058302cc2b6cb18b0231f6cd

SHA256
affc9e331d9d4a814f11dddad58715e5d143dad5f59b9d29825fe33784cd09ab

SHA512
4fa228a0fb85292271c6788d53711a390509f6e8f3e3f7f0f8a28f3c901805e1cb693829eb1d87546cdd13ff7496aeb237775b2589da31f5087c760f455a6cbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 521901.crdownload

Filesize
93KB

MD5
0ccbf809fba85d0ff7d1cb56c478e091

SHA1
f2fee4ad535cbce0b19995bc353615c7ebb0bc48

SHA256
bdf2c80252729d13451130dfde0c1d73b21074c78c30ee7c8ca331614f2c6d71

SHA512
25e6d817af6dc40b64e51a4a86e27adc64b4ea60dea39bfa2214b467daf78432177c3f4d049dcd5d5fabd03b6ec5ecd8039efa81ce832a0acbfc70632cb360da

Download Submit
C:\Windows\Installer\MSI28D0.tmp

Filesize
140KB

MD5
384cf5800c192575e21341023c7bd6f1

SHA1
88518d2603cd95f650f5cd28c1760960c35a5515

SHA256
2d7c1fb74efe47f69fd512a6b26aec3781904206f71e614aea8d9e920a58ef6d

SHA512
ddc262f9d3ae6baae53a8e08f2b95e6b00e1c88a6710e4d185276178dd44d541955d546f19e99a1ee82447a6bc3e07577d790a13857711aac6c164a7441400ab

Download Submit
C:\Windows\Installer\MSI29CD.tmp

Filesize
2.4MB

MD5
ca2075b3d77c759f034d4c911632434a

SHA1
ef16eaa8ff61c3bc738b8367f7392aab7d2643ea

SHA256
3ad0b3bd73a326ec155c4f441da332394281aa83cb6af0ee20ce5f537df7fb5a

SHA512
a3a405f8884b644ba3972ec7c743485cb46e3ad54b7ea4deeb8cbf0b204e5dab924a4eaf9a0f79af16cd633ad169bcfa01ff790bbbb9c02f2b29ed4e4d436214

Download Submit
C:\Windows\Installer\MSI31B6.tmp

Filesize
684KB

MD5
0ca3d2247d3e12432de156a305245066

SHA1
963ababe5168e198a760363b06be103e404384c6

SHA256
558e1b191c53ffe82f5635e4cc1ade7c0a91f2155f89dccd773d034eacb6c636

SHA512
3573c5b32cd48b7a0955b8249b63681786c851e6a386b62d3b94d96ee10cb2f854b0033e21f079bbeaab90ccbeddb294959d58a21ac06ac64f3f827f3bac3b0f

Download Submit
C:\Windows\Temp\OLD4C73.tmp

Filesize
1.4MB

MD5
01b968234cb600cda981859f2787908d

SHA1
c72ff0c4890195990978fac8b0a410d9b853d5ad

SHA256
5d70103f9faeaecdebf55304224a47b9cb455011b8df720abbfe0eeb817c5a67

SHA512
a6e44afc43aaa944fe3fcf8d3c9bf428a3baf78aaa6236032395b46f3b25ff56267e01b8011f7418d5f5b6856d1889939823a6ab2ed9563b284d18cd2756f833

Download Submit
C:\Windows\Temp\OLD4C74.tmp

Filesize
638KB

MD5
853c8a675293323a4dab7df3ecb0e9c2

SHA1
098fe6150717a5a04ef21a48ab2db130ec5092bc

SHA256
833a65f81233efcf1cb7fd0d42cc7abf40937a18641f3841a61f462ace52ce4b

SHA512
2f2ba41aa9905ab61de798863b0b34aa0be2d9e44428dacb21df05d3faa954fdc1a7717d111f0fca8cd5f4c8fb90fa9cbc5bbd5fea1b8bf08956381e780d4f9d

Download Submit
\??\pipe\crashpad_2824_HMWJGEMWDSNKUGMW

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.setup.ui.core.dll

Filesize
89KB

MD5
78fb3f1e9f69beca863af1ff7713249c

SHA1
65e00f042db34b385d9bfd0100a3b13efd79df5e

SHA256
323aa8d8707a030bf245d6031b7fb439c929a3a24c5621a03276114691e45aac

SHA512
79bcfa36dfb3b1a6e04d06a5d85fce6574831d5684ae55c9e08784ee6a585bde5c649438103d40edd85da3bb8fd1d27b00be16fd421d32502da3587468ee8ced

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.setup.ui.dll

Filesize
279KB

MD5
bb9df6ed16bad5bbcde9b106e11dff6f

SHA1
5a18c06282442a241e42ea45eb636cc77bf7d95c

SHA256
dc5f2821548e5a660fc920224846994da0169972f18a15e04fc9943a6a08f734

SHA512
12d3c0ec2cc0224614cd8dcc81bb0f5610a0b836420628722d3409775f1c186b9d7cadb9a61bf5ce5f5ae1c99fa408ad14900f7f8b83c0b5073180786f9123a6

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.setup.ui.interoplayer.dll

Filesize
56KB

MD5
a54a9d1185edd71b120010d131f0dbea

SHA1
e24ebb90da9840cb2b813bac4409c9525258d864

SHA256
a7d59379fdfa59c21b114b087b16028480f976efa12e3a197fff3729f28f3bb3

SHA512
c16e90afa3c9d49c6fb8af03e027e927c6ae582f28ffd6cbcb79178a47346327bef6ee8791cc0c04643ca7204c964c19c270f6c8609f1225bdcaf7d5f3c94c49

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.setup.ui.visuals.dll

Filesize
417KB

MD5
5bcc51f3bb85949e37ffc08cf1501f70

SHA1
f2d6067c3084e5c0af33b6e4bb9837b3f05a8f83

SHA256
fdcbe09d8c6ee7681e88bbf7bbcc6c87f089d034e00df6a422c3482f4a99a2bd

SHA512
950d8bf52222c1ba6c5173b3a9385737b4b414a259d72adee921b524b790113f473e00b5961972b19ad5dd2349fc1ba5c7b3541086c5b93a11238992a0e3c8a5

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.ui.framework.dll

Filesize
235KB

MD5
aeb7ba2ce5574025a985313bdde99cfb

SHA1
7e7d4d90a11c317c5d3b5065d47ef4209296cdaa

SHA256
92d7b5ad2e92e72804223e71cde8350ba7f0561e5e1b8c0002ce88e3e88f6ef0

SHA512
bd0aa5b5ac94076d6d6607cf704bcd89cabf43d3f99042fee8b653a0674c315ac9e464f0aef091998152f6b107a47034b541021efaf759bf250f6f99a91ba572

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.ui.framework.localization.dll

Filesize
281KB

MD5
ccf2531b77412b4eb5410888bd3eeb42

SHA1
ccc53ff2ac5b21d2a026b9f3431a016aee08dcb6

SHA256
170a04a3141b1c4f2606c3ba78d687972db6319d85d7a45f59958cc9f1fd05bd

SHA512
6eefd54ed14076cbd391e95817ce53c4bf69bae7d3c6f75f682d8e26f236cb2e4b9153c54fe358e1f833e9661cdc010686a2a5136fa70d77ca7f81cd59e32909

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\kl.ui.framework.uikit.dll

Filesize
2.5MB

MD5
7076c5eb43353580a88554a458c393dc

SHA1
74d9ec58d4ef5d0a7a69fe6500b47c6873ed87ba

SHA256
294055db0edebad0b62f5690d65c401ff3c859bb2ce913c7840142ea344f0f24

SHA512
81c88f67e55c415a5fe48c07d020069cd494c7eaafb8c79475093121121d7360c9a72e79f9f64c6700f4a90a923ae876064d0a942c2cda3a6914c1b07a218515

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\setup.dll

Filesize
5.6MB

MD5
986033838280c8d36c4fcc14b03caa35

SHA1
ac082f683dbbf4537dccee380b802055b2cf60df

SHA256
42abfb0fd3d1fba8832f5eb2aa0e0d42a10b60f4a033c1b3838668287a4e88d6

SHA512
4245f331953fd6661d75349e229e012fdce8fdf85de5f3666468f9b6198d678292ecd1970a6eb0101c02c3609d2116d7a609b9341509478de1b4e03c9614d65e

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\sharpvectorconverterswpf.dll

Filesize
137KB

MD5
ca5e6167b66c384f62e56fe0e1757af3

SHA1
4d8912deab579d0ad3bfa7477f7377d03260ec1f

SHA256
a9edc78bc8dd9e6ab098c96d2f26949bf8cc7c1f1071c5d96154022dac685979

SHA512
53d2828ea80ba1c9726240859c42deddf3b384bfdc173763804d5c0e59bc531de519720c8f396cba3851768be14ebed5f8f6ed501d2a99055f2abab9c920ce5a

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\sharpvectorcore.dll

Filesize
201KB

MD5
f6004bd10ff1bced912d389a48138323

SHA1
349d4f7bb69dec14ce5051c1ce4d7aaf33ce9ab8

SHA256
fa2c2216181125daaf69ce4c7e2addc9df98e09845a27292b9775ff8d568ac39

SHA512
550af5c8d54f4987a7c05347c9fa21a6cac5817ed410c5f9358bed6d13648c0c55be2426ea3b221f82b635e91f2a2c505f07703ae93392754c870853073536d5

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\sharpvectorcss.dll

Filesize
109KB

MD5
25e40483458b8083eb12d38b6cead136

SHA1
9158642854dcdc9b2610272e181d98526b3547cc

SHA256
1a87d710b34b187f75e9213c95ab5eb129da63906f122035e7badf7044c929c9

SHA512
381ba47f815cfc4fe665913a49f8e53121dcad53c8e63ffc3d61663a2b5db0fc3fb2e3e8784fe5a0fd058ccb0687317c11e01debf4c596795f7cae5fd45dcadb

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\sharpvectormodel.dll

Filesize
997KB

MD5
ff09404438a1aaf5bafa792a504e7631

SHA1
7e78ad564aba274bf70c5320e39ae5061b30572a

SHA256
ccf8359d7862330ebb1dd0a5f50b9e12e43b1763ef64cde5417960774d1dcf11

SHA512
8b90210aa69b69b9e4e06a721a444ca9e50bcb87648fffdd2f47f2056ad52c55a2228547c45757a804b3b76ced8bf8899918f5c4a23f2139061bdff1dcf23db5

Download Submit
\Users\Admin\AppData\Local\Temp\031C27B07040FE11297FA42741D5BDE9\sharpvectorrenderingwpf.dll

Filesize
203KB

MD5
619044935bd3151b6d1fef1e06ce5323

SHA1
f5d5e2b4171465ef022ed85ea7ff1e70c7b2a581

SHA256
5b6dc4ff32972e022a3a457d319ffc756c915b8f9be4fa62a550f2e361aca5f2

SHA512
d5f4cc32d6ccecd4accdb78913badc5190adea1df1e173d5b47ef2c522cadf4d2f198deb25440aa1360c03ba90fe734f3f8a3b63b38e7b7c54b8d3ecaad06cd4

Download Submit
memory/948-671-0x000000000A0E0000-0x000000000A168000-memory.dmp

Filesize
544KB

Download
memory/948-742-0x000000000A1B0000-0x000000000A1E4000-memory.dmp

Filesize
208KB

Download
memory/948-617-0x0000000008AF0000-0x0000000008B2C000-memory.dmp

Filesize
240KB

Download
memory/948-822-0x000000000B180000-0x000000000B1B8000-memory.dmp

Filesize
224KB

Download
memory/948-768-0x00000000089C0000-0x00000000089D2000-memory.dmp

Filesize
72KB

Download
memory/948-621-0x0000000008F20000-0x0000000008F36000-memory.dmp

Filesize
88KB

Download
memory/948-625-0x0000000009510000-0x0000000009556000-memory.dmp

Filesize
280KB

Download
memory/948-757-0x000000000A4E0000-0x000000000A4FC000-memory.dmp

Filesize
112KB

Download
memory/948-629-0x00000000097F0000-0x0000000009A78000-memory.dmp

Filesize
2.5MB

Download
memory/948-583-0x0000000005CC0000-0x0000000005CCE000-memory.dmp

Filesize
56KB

Download
memory/948-545-0x00000000770B0000-0x00000000770C0000-memory.dmp

Filesize
64KB

Download
memory/948-761-0x000000000A480000-0x000000000A48E000-memory.dmp

Filesize
56KB

Download
memory/948-754-0x000000000A9A0000-0x000000000AA9A000-memory.dmp

Filesize
1000KB

Download
memory/948-653-0x0000000009FE0000-0x000000000A048000-memory.dmp

Filesize
416KB

Download
memory/948-750-0x000000000A4A0000-0x000000000A4D2000-memory.dmp

Filesize
200KB

Download
memory/948-714-0x000000000A310000-0x000000000A320000-memory.dmp

Filesize
64KB

Download
memory/948-546-0x00000000770B0000-0x00000000770C0000-memory.dmp

Filesize
64KB

Download
memory/948-593-0x00000000083D0000-0x0000000008416000-memory.dmp

Filesize
280KB

Download
memory/948-746-0x000000000A170000-0x000000000A192000-memory.dmp

Filesize
136KB

Download
memory/948-547-0x00000000770B0000-0x00000000770C0000-memory.dmp

Filesize
64KB

Download
memory/1912-101-0x0000000073280000-0x0000000073830000-memory.dmp

Filesize
5.7MB

Download
memory/1912-111-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/1912-72-0x0000000073280000-0x0000000073830000-memory.dmp

Filesize
5.7MB

Download
memory/1912-74-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

Filesize
64KB

Download
memory/1912-91-0x0000000073280000-0x0000000073830000-memory.dmp

Filesize
5.7MB

Download
memory/1912-71-0x0000000073280000-0x0000000073830000-memory.dmp

Filesize
5.7MB

Download
memory/2600-540-0x00000000770C0000-0x00000000770D0000-memory.dmp

Filesize
64KB

Download
memory/2600-539-0x00000000770C0000-0x00000000770D0000-memory.dmp

Filesize
64KB

Download
memory/2600-538-0x00000000770C0000-0x00000000770D0000-memory.dmp

Filesize
64KB

Download
memory/2728-133-0x0000000005570000-0x00000000055C6000-memory.dmp

Filesize
344KB

Download
memory/2728-128-0x0000000000A20000-0x0000000000A2E000-memory.dmp

Filesize
56KB

Download
memory/2728-129-0x0000000005290000-0x000000000532C000-memory.dmp

Filesize
624KB

Download
memory/2728-130-0x0000000005870000-0x0000000005D6E000-memory.dmp

Filesize
5.0MB

Download
memory/2728-131-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/2728-132-0x0000000002E20000-0x0000000002E2A000-memory.dmp

Filesize
40KB

Download
memory/3988-483-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-489-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-518-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-517-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-516-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-515-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-513-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-509-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-823-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-511-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-824-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-825-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-826-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-514-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-508-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-463-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-464-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-465-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-468-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-512-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-507-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-504-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-506-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-505-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-502-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-503-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-501-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-498-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-499-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-500-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-496-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-497-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-494-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-495-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-493-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/3988-490-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-491-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-510-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-487-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-488-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-486-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-485-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-480-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-482-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-481-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-519-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-484-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-479-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-476-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-477-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-478-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-474-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-475-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-473-0x0000000007940000-0x0000000007950000-memory.dmp

Filesize
64KB

Download
memory/3988-472-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-470-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-471-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/3988-469-0x0000000007360000-0x0000000007370000-memory.dmp

Filesize
64KB

Download
memory/4532-1263-0x000000000A3F0000-0x000000000A422000-memory.dmp

Filesize
200KB

Download
memory/4532-1271-0x000000000A450000-0x000000000A45E000-memory.dmp

Filesize
56KB

Download
memory/4532-1258-0x000000000A140000-0x000000000A174000-memory.dmp

Filesize
208KB

Download
memory/4532-1260-0x000000000A180000-0x000000000A1A2000-memory.dmp

Filesize
136KB

Download
memory/4532-1276-0x000000000A4B0000-0x000000000A4C2000-memory.dmp

Filesize
72KB

Download
memory/4532-1267-0x000000000A430000-0x000000000A44C000-memory.dmp

Filesize
112KB

Download
memory/4532-1119-0x0000000005C10000-0x0000000005C1E000-memory.dmp

Filesize
56KB

Download
memory/4532-1265-0x000000000A6F0000-0x000000000A7EA000-memory.dmp

Filesize
1000KB

Download
memory/4532-1137-0x00000000083A0000-0x00000000083E6000-memory.dmp

Filesize
280KB

Download
memory/4532-1358-0x000000000AB60000-0x000000000AB68000-memory.dmp

Filesize
32KB

Download
memory/4532-1144-0x0000000008B70000-0x0000000008BB2000-memory.dmp

Filesize
264KB

Download
memory/4532-1200-0x0000000009DD0000-0x0000000009E6E000-memory.dmp

Filesize
632KB

Download
memory/4532-1185-0x0000000009CC0000-0x0000000009D2A000-memory.dmp

Filesize
424KB

Download
memory/4532-1156-0x0000000009620000-0x00000000098E0000-memory.dmp

Filesize
2.8MB

Download
memory/4532-1149-0x0000000009310000-0x0000000009358000-memory.dmp

Filesize
288KB

Download
memory/4532-1147-0x0000000008E60000-0x0000000008E76000-memory.dmp

Filesize
88KB

Download
memory/6336-8007-0x0000000000C30000-0x0000000000C3E000-memory.dmp

Filesize
56KB

Download
memory/13272-7745-0x0000000000C40000-0x0000000000C60000-memory.dmp

Filesize
128KB

Download