39e145c9d72b6ca8648265a34998b525e33d529144bad1848c34fecc9c1aafe4

Resubmissions

26-05-2024 20:02

240526-yr8q6sab71 7

26-05-2024 19:39

240526-ydek6sac88 7

Analysis

max time kernel
306s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 20:02

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

cheat.exe
Size

18.3MB
MD5

2896a251a8d359f13d3d53d68918c491
SHA1

ec3a1ebe0a8b33d27e584372c85ccef21bb08c1c
SHA256

39e145c9d72b6ca8648265a34998b525e33d529144bad1848c34fecc9c1aafe4
SHA512

f0ea09e94abd04844a7f9fc82b312dd782199f5cc129fe7532f3585d7d6b312dab806f2dd2c8fb63feabc624516d7a80cf6d3e1b49e6e9b2ef44f3a64e8b6411
SSDEEP

393216:uS5AWMQ8Uj4d0f1+TtIiF0Y9Z8D8CclfhCW8Sb/7J5knXK/:uaAWMQL4d0f1QtILa8DZcOW8SbDkXK/

Score

7^/10

pyinstaller

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

cheat.execheat.execheat.execheat.exe

pid process

5212 cheat.exe
3944 cheat.exe
1372 cheat.exe
464 cheat.exe

pid	process
5212	cheat.exe
3944	cheat.exe
1372	cheat.exe
464	cheat.exe

Loads dropped DLL 64 IoCs

Processes:

cheat.execheat.execheat.exe

pid	process
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
1584	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
3944	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe
464	cheat.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service
T1102

Processes:

flow ioc

141 pastebin.com
147 pastebin.com
46 pastebin.com
47 pastebin.com
88 discord.com
89 discord.com
90 discord.com

flow	ioc
141	pastebin.com
147	pastebin.com
46	pastebin.com
47	pastebin.com
88	discord.com
89	discord.com
90	discord.com

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 47455.crdownload	pyinstaller

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

LogonUI.exechrome.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612274247047364"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "233"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{46ADB87D-CEB8-4CB7-845C-AFD5DF34C0A7}	chrome.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

chrome.exechrome.exemsedge.exe

pid process

3224 chrome.exe
3224 chrome.exe
3224 chrome.exe
3224 chrome.exe
3224 chrome.exe
4464 chrome.exe
4464 chrome.exe
5096 msedge.exe
5096 msedge.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bootim.exe

pid process

5988 bootim.exe

pid	process
5988	bootim.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

Processes:

chrome.exe

pid	process
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exechrome.exe

description	pid	process
Token: SeManageVolumePrivilege	244	svchost.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe
Token: SeCreatePagefilePrivilege	3224	chrome.exe
Token: SeShutdownPrivilege	3224	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

cheat.exechrome.exe

pid	process
1584	cheat.exe
1584	cheat.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

chrome.exe

pid	process
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe
3224	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

4888 LogonUI.exe

pid	process
4888	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cheat.exechrome.exe

description	pid	process	target process
PID 4932 wrote to memory of 1584	4932	cheat.exe	cheat.exe
PID 4932 wrote to memory of 1584	4932	cheat.exe	cheat.exe
PID 3224 wrote to memory of 4140	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4140	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 4952	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2356	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2356	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe
PID 3224 wrote to memory of 2400	3224	chrome.exe	chrome.exe

C:\Users\Admin\AppData\Local\Temp\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\cheat.exe
  "C:\Users\Admin\AppData\Local\Temp\cheat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:244

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9d057ab58,0x7ff9d057ab68,0x7ff9d057ab78
  2⤵
  PID:4140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:2
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2272 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3516 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4444 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4792 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:3436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4852 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3164 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3156 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3116 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1152 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3624 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5576 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3116 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5744 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5284 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5896 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=1152 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3992 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\hwid (1).bat" "
  2⤵
  PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic csproduct get uuid | findstr /r "[0-9a-fA-F]"
    3⤵
    PID:2396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:428
  - - C:\Windows\system32\findstr.exe
      findstr /r "[0-9a-fA-F]"
      4⤵
      PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "
    3⤵
    PID:456
- - C:\Windows\system32\clip.exe
    clip
    3⤵
    PID:4232
- C:\Users\Admin\Downloads\cheat.exe
  "C:\Users\Admin\Downloads\cheat.exe"
  2⤵
  - Executes dropped EXE
  PID:5212
- - C:\Users\Admin\Downloads\cheat.exe
    "C:\Users\Admin\Downloads\cheat.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3944
- C:\Users\Admin\Downloads\cheat.exe
  "C:\Users\Admin\Downloads\cheat.exe"
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Users\Admin\Downloads\cheat.exe
    "C:\Users\Admin\Downloads\cheat.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=5652 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=5708 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1712 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5544 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=5884 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=6000 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5312 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6028 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6068 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=6256 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=1684 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=1592 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5580 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=4144 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:5928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=6508 --field-trial-handle=1860,i,8925699444583378112,4892944482390239382,131072 /prefetch:1
  2⤵
  PID:2012

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:5008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec 0x300
1⤵
PID:6084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3b79769bhae04h48a6hac5fhd170208ed5ab
1⤵
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0xfc,0x134,0x7ff9e4b946f8,0x7ff9e4b94708,0x7ff9e4b94718
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,1528357178857071841,9663341259620114053,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,1528357178857071841,9663341259620114053,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,1528357178857071841,9663341259620114053,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5156

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3885055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4888

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
03805a76d1507b02a6d4f9a60a7420b0

SHA1
4719421663bb8835d89a5e613b505d2d44a50406

SHA256
7e89159de329f5e8e5c4347243bef892099a00261e145250d094f30a7724796c

SHA512
0ee302cd82b6e1a95a81a1949884949684799af1dca55354732189f684539cccd7c1a65699a546c4c146489fb0cdc3379ee7463966e178b1d49070b2efdf2d48

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

Filesize
59KB

MD5
7626aade5004330bfb65f1e1f790df0c

SHA1
97dca3e04f19cfe55b010c13f10a81ffe8b8374b

SHA256
cdeaef4fa58a99edcdd3c26ced28e6d512704d3a326a03a61d072d3a287fd60e

SHA512
f7b1b34430546788a7451e723a78186c4738b3906cb2bca2a6ae94b1a70f9f863b2bfa7947cc897dfb88b6a3fe98030aa58101f5f656812ff10837e7585e3f74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
992c0f350110f55a64ea86b82414bc95

SHA1
6b75183cf0cf5f0482416484468c737445a93f13

SHA256
6876032b4b5812d6778def5d589528a252618117a8d1aa9486ae5f3741c98d69

SHA512
312db039dff203e15738fce057ed0094e6cdb98b1f25b59084caaa6f015045d1371340fa236802a67f7d65d5e38e9ff6ccfb07cf81a5cb1e69b02588ac48cff4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
6a1aa404af8cf82d51fb897372fda8ba

SHA1
87b4894ba09abdd2a1d9af98ef4df7904bd70376

SHA256
2b5d75b0b19f28d7b84de09879fecdf714ca9eacb6e935e96c9566a542d67b11

SHA512
9102189452f32a076527d6e0e61956ca327b8d376d157c108c5ac4b0084734bedc17d4270f08e7a7408c50ec49dd25aaafe95c0137fbc0b0e790286cb2d9644d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
57b968acfb0780f7cb1ea12cf5b69d59

SHA1
c588d92a00e2841dda80249f0deb2492f0e9afba

SHA256
1d825ef16148396c8f1a22210a53f4bfcc14b3d77b6b5b91608e5016d358d3c3

SHA512
b092aadb84de297de8b27157a671fa699b36f56c1d8946c6d6b099aa1e15e477117e0ccee8baf26677efbbb97230c0ee609bb131c513a976cf624ccc604a95b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
8c2940efa264687a07577ca5e07d04e7

SHA1
686707fd7c5521e16be0413a7ad07e96f2937c23

SHA256
22ce808f02c0a23dfe15d0fa88f0e284536d4ec44d4d6e42782ac80613be4449

SHA512
ef7855939d431d353f61788d63fe0bc51eac29032b8bdbfff72fec798906795e6de6e4200174f33ff48317816f2dd4f6b6aa376b63e1549cc55f8a9a0cface81

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
1dd208bfdbc9cad0c2f902d9e54a69e4

SHA1
96fc30d07d5f38a0c215c5cee3a7947da04a023c

SHA256
dd4961fe43d18e02a31db308635eced844bade6e8e743563476b882c8b123ae1

SHA512
99408da3e124f63bd975cd7fbedff385f0e462f46d35a8a98a8847a7f9ed814f1d107b32e1de947eae8794ee195fef08a7d4bf03042df574a511bf47a6b60e80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
1d730c4404a2f6ddffb27378294dc02f

SHA1
768236270c6245de73bc9d7dbefcabec72b0df8b

SHA256
196db0bcc10e1e0656d9f66056fedb6cbb6fba712c762caa75e25813c936bf7b

SHA512
51f8610a241ae62b9e8fe19f95186bed25f26dd76669fc4fc56d93a286810fc70f6ec00f7bce29f667e62c41e482d61e7bf972461f662f43f7d6a9ee7a10d649

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
ef43929d54e1b6c4fd686e65c6877de0

SHA1
cf9ce8d28fd7483873ac3f1929f03cb7ac4a7a51

SHA256
e0868bc91986eb8eb96637c5ce4b751c9e4d6ace5cd62ac8c7acae6d0dff0800

SHA512
d66ba2f52fc0e6ed2de4970bdc088fa7dbeba040681ad3ed518c67c8ca76cb0a1b65297fe94c85e607d2203d46751168afacfa5e3d235f35da788804d39ed6a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
690B

MD5
da0295d7022ebcbc519ffaaae7ca1979

SHA1
9a71c099e0756dc2e79b4331b40b4c57f1278a4e

SHA256
4aaa25c303b19e771b93ac7e71e28b7df87f62a597e99ff20033e7b5f243d18e

SHA512
77dd69460d0ea9716d2de5248ab1a771f43c9185fb5251f215ae31917840bf145c5c9deb1cf02441d215c3160d4935d2f511876195b2e1fbb5ed014179359fdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
523B

MD5
543e4cfff5941bdc8951961e2c2d6632

SHA1
43519f6fe73769e815221f458015292b336a1bea

SHA256
18219fe25de316b581352fb3fbd832ea8674eaa59fb263bcc350b8c40c2ff0fc

SHA512
6cc1834b9233f4fa84cd1c1ae1d1416ca7352d2839b059fc4af89db4fdfba95b4c7e40a04d91aeb5068cd9f2596689f2951bedaea7ab9c07f2da14aa4e57dccb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1032df3176f0d08edc6f596ad52695f5

SHA1
c865647d9a8cd9738e16aaf5c1d94ba2451a8626

SHA256
429baea87d9b3a086dee1a851acea3cbdef07d584976328f52c05e16c69d630d

SHA512
3cbfd22642d304350cabf74f37353419212129a7346f08a54ba1aa06cbcca8c6fedb61a9f291b01a74e25072937c8dfbd8125d99138314f276653c1dce09f08c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1024B

MD5
e5f8fd8bf02dac733bd730b41339cee9

SHA1
06e5f8a273c6f36ba0bf6e37dc2f9eee549304c0

SHA256
cf4fef0984ef5a90793131312b7b9d28e8460f3df91ceb1d3c9e6ab7b0e500dd

SHA512
b4478da43b58cd8b6b69df4a985cb3345261f20cb36e397b83d4c3f3b6c47229d26e5ae7fc0f250d976b835da1492c8f09bd24a319d8fd877bd7f39e9619dafe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1024B

MD5
61338f85f57baf6c57cfed36c2524337

SHA1
1ab2a80c08af8e0cc44ff22b4bb6347d3933c1f3

SHA256
eadff5ef204b36c6a262757322bf28371021f7533e31675a1501961aad3085c8

SHA512
d31b965fd1a96b2e6e0d8ed2b9c06477851c25547d2a759e0ae4a85162519b29949cf0471fc5a81c0809fbbca2c14fcb471c27aae79d918077001f9658c9068c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
45098d3cd9f2c09af3013ecbb7d34f7a

SHA1
cd44232e1a2aa82abb149f957c667b7d4e82b9f3

SHA256
cf8e8435f623ea7868d3468d478c6074761a0d7c51047baa1b7ecfbe7336be73

SHA512
439fef9fbe3361a551211a7ce5f0e0bed9f281957c1bd2e3df3180953b81eb5a3705fcda090aa78f694f08a6e32a99258c8a5f3fb19c36e14a6c6b83f0208c83

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
babc0e713d03c4da8d36ac1a040d7dd0

SHA1
94492d56c71e631373e4d359a6c2b0037881fe51

SHA256
f87b1cbafa65ddbd3854eee860300f80726a390679b47eb85b2e833fd271d2cb

SHA512
5f174e0bd22a8a85f51cc7ee07c3b43c4ca041b6bdf8ae10076e66bf18f0adf488cbfb345e2e352d5371dd84c2a183940d1c1dfc06e47da6c25ffc1d711ea567

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
0b9ea4a9670d22e42379af770feb0831

SHA1
33125e6761e0632cd095dc259feac1a81a08c1e1

SHA256
b5e446713ed1ef3f36315241fa06092d27b4713a339f6c27fec33bf842e95e18

SHA512
356c912abe4d9c2efcc52787a73acb5bfc94b57cab9bb9fe98b2b86295c6f297fd7d4a6259c6f645bbf7a649885b5e8d440ab900ef5aa96d973e07f9632b0b2b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
001279231c2f2700221475615b272786

SHA1
2abbd2278b8b9630df481033694cb11544ad2b52

SHA256
696cb2bac747597a7ddd087010bf175bd5eef627893d442253d8037f58b5924c

SHA512
c8ef356985778fef0a3742fbe637573f553d8005aa52a20eec88858c090b748392d57ba60d4cabea97fdc1a2f5fa8728b77b145d19d0c6933957ff52b0c3398e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
5d0f6bb1061b5981cd62a44aacf4b153

SHA1
afa8c40e37cf7f6fa8a6f48936863454789c08c5

SHA256
14b415775fa2fc70c66964c8d89a70efecc073f0243a40ed75831d296f3468bb

SHA512
287066c5d5bcfb55e30c3cfe3c3c3dbb32db8d6719f214265c455a89c26eda45ffaef83ae2099ef7dabf2f5f8811fcffcb003668a4a4d0f6fbd694257cfc6217

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
52091712815fed49cffb96e53d897aca

SHA1
768b0171f8d38a488068cb525cde818dc9814b5a

SHA256
eef44e4aa4265a1f555d335eb3bd483a0477ca661445a9215130ad5cbab11240

SHA512
2890b646bf7f6d0cb7d52ac7b229f5ead635af9233b4f3dd2175bbcef8bebaf6fc0320af26d34ceec10002570ab83a110ebe05c999bc46d5df961f899646d76e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
2680b60147cbecfd531d7c98d204b887

SHA1
0459edfd43179b6f0891cf1aef1123d89aa30f97

SHA256
dee797077c922cbbdf3ad390812efe88756770a2689684a70a80564ea6429d65

SHA512
6293ddb119aab00d3d8bade38e57a23f9a9d4ea8790c7b8ee72b4b6989734b8d8e2930320ba5a6cc0d81014311b63b787e9a7875c9d656e54310c3a8066bef30

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
659805b9e116c26210418d9a12d17bfb

SHA1
d30124142f9018368c5c1d8b85a6cf79df3139a7

SHA256
5a0f615bc1aaf34ba14f10691921175a09a5010e96dc5b856f52094d024e3cca

SHA512
7beb7d784faba2e8da58fefe8075a39de4d492b878499cffe08f9ad2f710f317dd99c366e813192d97ce13bed96dbd5f4893a497b1a33cedea043a14780d03f4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
3b47736ce60694f9b491c87d52d8f343

SHA1
ae67bcd1449cd79d9de6567e7e3af8ac43011127

SHA256
8595f34b59e4b7fa5c3ea25ef34f8f2ef8896c5a95720044e71d8e8f5ac762ef

SHA512
16769f56d087e3eb911f835e81a10fa8fe94a134fca2d596a44a37233319114e55e54f05676ddd92c456200eb0627bfd2db0cc3b0038f0c21a91326e581a74aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
16e9e0eab92fb7cb1dc0868ab0f26036

SHA1
673c84eb3096584304cb6b72d7e874017fd60cf5

SHA256
5e59ce39cd31bf0e2eae58cbcc2a407f2c5370876ad1513b158334ea802b799f

SHA512
79177328e2ef264980560958228a503849318500f70ceee99a9663444adcc77b1eee13810d95cda9739c756f679e35cc8ae78e069d8e138b0302d75713de24b1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
838ce31f1724046991b941e53185d8be

SHA1
ec8ffcb7cac26743357baab788970d3628281e0e

SHA256
585487adf6bf5867abe76615bc2f2aad0ce9fd30592ff4ddf722cbbd81895b17

SHA512
7262e21c86611855915ccfb02d8ab44e1750a41c10c8ed05941bcb01efa520a9613e58198a08631344a11f9de12301149d5101672521d1e189d60feac233bc29

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
1b1fcbb2bd01101ce716d61c1f67609a

SHA1
710f82baeec1952fff535a8e15fce10c58cf9645

SHA256
5fb35fb488de8d5121777aeae2e80318a149544c425e047f0aa8f4cde3fdc391

SHA512
266bc424bfde899cc37c13714132c5aeb128dfc42df4184e40b22390488cacc4990673b36f28af6994a921f4ffafe422aec5a43b2a8dbdf856bb0f24b26f32c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
77006e9078833db70ee45db9066a5cc6

SHA1
2f6991dddcc972cd5a080f486cef787f914d80c2

SHA256
f4989c1b2ee267e0e173c64e09517d351ea929af2d1b02669b70b08fcb6e41c1

SHA512
e94d60ab7d44e4cb60514a28efc0a8bf6bdb001972dc32a92b82915b5d8c120e744700d75d585f2961c2ff80e8e95a79befa219581964e0725def32973c7580a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
95ce27fc7e95b9243dedae2b34cc2f9d

SHA1
30ad0355b31976d2ecb83d64f436c2e13313bebe

SHA256
99d378e0c2e133987df0ddcd5bcfc56113d11e5e2663e98bd1d908e25c587140

SHA512
9028ccec0c005aaa7c4eb7a80143240b7c4a77c31f12890e365f317c626fe7e5f7bf9bbf661eda4ccaae6cb7e4944d607f82d0782d2c4c7a9fddb33f9ed2138e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
283KB

MD5
6fc96b7a441a720f6ebad7ead53d436c

SHA1
f048d743ecb580a04ec390c929c035c9bdcaa48e

SHA256
4eddf90b0c0abc29a538fb26d5082f631850f583a1839567d59ce896a561b193

SHA512
df505c924cb9f0945e60c0278e85b5714ea7506da4ff9ae0e910104e051d4307026d46fdb3f706d1a6c12bf9845823c86543a7b21dab5d6cfe7f4ae4edc2f120

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
6c3bc1f3e9a20d4e39e594897851d1b4

SHA1
09986ae56d60788980ba6a48e12ed5fd2305f620

SHA256
a35f2ae622d62e24ae054273607355ceadbf8336fb79a61e0941a32dc26c4c04

SHA512
04e450deab104bc26c9714bdb5885d9bb93d2c7fef09d281f60cf8695a39239042830dda9691347bc51b69850038139ecca55b5764c0a537954bd79d05512447

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
257KB

MD5
8d73d06173e051b03378da37d2105c76

SHA1
be50ad043c0a7072813c3ae8cc9e7314c014af1e

SHA256
4ced90c8151bae99c5b98d1fc24986ca612e4b237e43d18beaedcefedf43c4fb

SHA512
c29384099c6bd473bc8fc3419f360295f5cc81c3fb44b2fc865e114c69dd8d48ae5cfb2fa8025909f6c2bf771c972b7a58cca0ac7761d5d44ca8288742b21a6e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
ddbe51bcdad1c7e5d9057b4d6700abcb

SHA1
6e9b397bf003ee3d923086532845e5b59de9f530

SHA256
f1385437d154422a0e471d248ae1dc2edf295dc541d2e83739b32685020022b4

SHA512
f32aa6b1acf1a9cba25782ddd78469936c3e581bcd7a621df2b31f667514bfab8b02408e12edf97245211d33e2336964230f97a94a5ee5902b37af1d0732426e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
ff81933f8cd931d170677ffdc2c2a0c6

SHA1
6d5a3122f072cadcddfc6f82f2088a0d2fe313b3

SHA256
e5aec9336b019f684546bbf072c166f2411c9c700ec045d00a58721e7fc40f22

SHA512
e0d6fc1683d309034f2a51bb0ff57237669a53f1371370c24197b5ee44aa4dc3e0c4d16d6b002bef733265d1bfed31f94b4a83a5930587fe5c5383c0ef2287be

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
282KB

MD5
f9543e060ad2f6e3345f388030ae2a02

SHA1
98352170152c9f2dc9db7ce003b025c25974bc46

SHA256
677cae8deef2ee7bec092546aba1a1b1d821d28987fe49840d06936f8068ffbf

SHA512
a1b30f4ba74127f4165fee6cfadef8d9007e5d5a887de08738ea487b9f2039d496126fcb3f1489f07c72a356c57d14725cf515b490f3526bf6165132cddff5c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
e3537057522859fdb4ee128711286124

SHA1
6e6d4500622f91f245ac25140acc4a8a50f765d1

SHA256
ec38b695f1783f115a44da4f0ee4df7809e604264706612ddfb288b33e224a86

SHA512
4f7d6e363a4ebcef7555f92ff4ed530f1b68344d327af0c0b5ec3b60ee62e9fdc13b130ed846a37716dac918122e4d66c7264681b70ab2dc98431a8101e99496

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
262KB

MD5
ae0acd272c465cb2f7370fbeeb91fc19

SHA1
b48508011fe705c7e15ea8731f977a99ea6bfbfa

SHA256
ac96ba51a5a57800d2533a59a680dea0d2700ecdb1a44fc61eb7c9734d3aa9e6

SHA512
12518d1d339f92a83d82df66930af94a82bb708862db40a2ad13b8a1b47577e64f2efd01d81dcba7042939f953623ebf39264e0bafcfff9d8ea9917198e42fc7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
95KB

MD5
bc178d10139d69bdbd642b5e13b4b9e3

SHA1
a84ef446b57bbe387c36607b511ce2ddbbf03e70

SHA256
733f18e6b3ba048e498ae7b68ab3d8b58852d66a523d2647fe4855cf7c0233ca

SHA512
3179d23d8907e2306e2f3851675e0fdd52bc0a34bc1e3130f6d561325187e48284ce613a7f05bebb96ee2dd63a676bd29e49f5ef79227943a449ad9182223b13

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
108KB

MD5
34bad263a07f97397301f1a66dae36cf

SHA1
1b1fbb6000f02e3ce650400d2f99f45977598e95

SHA256
25e5f40af9c10bdd90443ede8d6bb3ebd4ddc2fab6b2deb483578a1f20c24722

SHA512
d91b77e0e71ac38b7518a56f8de13ba0e972071b72dbf6595b0d9f3c0e8f62f19d29b287f0b5473f8371ec8459466e95d177e03804e42ef4eda236df75cb7e92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
97KB

MD5
212ad65a3fbee8b687e1d88d82ca208f

SHA1
18de645490658c6176c41b5da964274ae5466717

SHA256
6ac4feb67370cf55baa418cf0310508a2176e463e70f247e5e19a2f9ad449bbe

SHA512
6289b9683573337b9bdb177b8471490e1d8e5e2ef1732d8e66068cedacc42dd97a04faae14c670519b2abc4957a91d7d0823db77e4365b7bb277cde87ece8140

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
102KB

MD5
e864779c0c4f3eb84dacb57851f1c0a3

SHA1
060f49e83b4105630e40efb9d7961e8fdb95bbed

SHA256
36c056e0fd68b4dfe144b9a9037d2c8a0e1eac2896e131154dc32696155c53a5

SHA512
8623bbad753f3a755f1534664be0b81e89ca9ec10e27211e87ab7b6fdfb522429d21564c1d8248741386a4f872ef3030a3d78b6086473424096af35479a54ed9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59096c.TMP

Filesize
92KB

MD5
769de49bef326a832996f914fe0c18c5

SHA1
05225d7a7baec49be586fe3c85d5fdbd8fe17544

SHA256
b035ad940719f9c33c143ea8c9b8240b8248995973bfaa7389a3a4f41cf16c54

SHA512
111dced3288567048a38bf2d892296f151086932dc152c8441fce80f785c91544150e1ccd9bb159bd21f1c516b51f97d88c87f21fac694037a07de595b0d85ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce0c1b1956fafd995b99d5880fd40ec6

SHA1
762407857690e68de10c93e4643bcd5971943bd7

SHA256
6d714effc44f6ec8551fb1a5985bfd4b205342f99f9f8556a3ded2a9afca1c3a

SHA512
74226df30272d179e3dfca9d0e416c554cce3c50b426a8a338179cec54319bc95ba6a200fec8b4b80bcc040736307333a2f494b279054961cd3d74475bcbbabf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
dc3177bb1b9febcf6cdd0107bd36f268

SHA1
da4b38531e49e1641024fca54ccb1aacc9970f11

SHA256
50541947cb3507fabacbdcbcc45d1545296f4431f15cf83f04fc140bdce2451a

SHA512
f95822067fbbeebe548b5e7ac1c7323f4216f4b1f866b073a309fd14eb15b62cdc625b9080d6524ec459f4206bd4c605de45bde5ba5324e955a1522189ed3a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI13722\tcl\encoding\euc-cn.enc

Filesize
84KB

MD5
c5aa0d11439e0f7682dae39445f5dab4

SHA1
73a6d55b894e89a7d4cb1cd3ccff82665c303d5c

SHA256
1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00

SHA512
eee6058bd214c59bcc11e6de7265da2721c119cc9261cfd755a98e270ff74d2d73e3e711aa01a0e3414c46d82e291ef0df2ad6c65ca477c888426d5a1d2a3bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\VCRUNTIME140_1.dll

Filesize
48KB

MD5
f8dfa78045620cf8a732e67d1b1eb53d

SHA1
ff9a604d8c99405bfdbbf4295825d3fcbc792704

SHA256
a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

SHA512
ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_bz2.pyd

Filesize
83KB

MD5
223fd6748cae86e8c2d5618085c768ac

SHA1
dcb589f2265728fe97156814cbe6ff3303cd05d3

SHA256
f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb

SHA512
9c22c178417b82e68f71e5b7fe7c0c0a77184ee12bd0dc049373eace7fa66c89458164d124a9167ae760ff9d384b78ca91001e5c151a51ad80c824066b8ecce6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_ctypes.pyd

Filesize
122KB

MD5
bbd5533fc875a4a075097a7c6aba865e

SHA1
ab91e62c6d02d211a1c0683cb6c5b0bdd17cbf00

SHA256
be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570

SHA512
23ef351941f459dee7ed2cebbae21969e97b61c0d877cfe15e401c36369d2a2491ca886be789b1a0c5066d6a8835fd06db28b5b28fb6e9df84c2d0b0d8e9850e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_decimal.pyd

Filesize
245KB

MD5
3055edf761508190b576e9bf904003aa

SHA1
f0dc8d882b5cd7955cc6dfc8f9834f70a83c7890

SHA256
e4104e47399d3f635a14d649f61250e9fd37f7e65c81ffe11f099923f8532577

SHA512
87538fe20bd2c1150a8fefd0478ffd32e2a9c59d22290464bf5dfb917f6ac7ec874f8b1c70d643a4dc3dd32cbe17e7ea40c0be3ea9dd07039d94ab316f752248

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\_lzma.pyd

Filesize
156KB

MD5
05e8b2c429aff98b3ae6adc842fb56a3

SHA1
834ddbced68db4fe17c283ab63b2faa2e4163824

SHA256
a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c

SHA512
badeb99795b89bc7c1f0c36becc7a0b2ce99ecfd6f6bb493bda24b8e57e6712e23f4c509c96a28bc05200910beddc9f1536416bbc922331cae698e813cbb50b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
e8b9d74bfd1f6d1cc1d99b24f44da796

SHA1
a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

SHA256
b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

SHA512
b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
cfe0c1dfde224ea5fed9bd5ff778a6e0

SHA1
5150e7edd1293e29d2e4d6bb68067374b8a07ce6

SHA256
0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

SHA512
b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
33bbece432f8da57f17bf2e396ebaa58

SHA1
890df2dddfdf3eeccc698312d32407f3e2ec7eb1

SHA256
7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

SHA512
619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
eb0978a9213e7f6fdd63b2967f02d999

SHA1
9833f4134f7ac4766991c918aece900acfbf969f

SHA256
ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

SHA512
6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
efad0ee0136532e8e8402770a64c71f9

SHA1
cda3774fe9781400792d8605869f4e6b08153e55

SHA256
3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

SHA512
69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
e89cdcd4d95cda04e4abba8193a5b492

SHA1
5c0aee81f32d7f9ec9f0650239ee58880c9b0337

SHA256
1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

SHA512
55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
accc640d1b06fb8552fe02f823126ff5

SHA1
82ccc763d62660bfa8b8a09e566120d469f6ab67

SHA256
332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

SHA512
6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
c6024cc04201312f7688a021d25b056d

SHA1
48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

SHA256
8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

SHA512
d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
1f2a00e72bc8fa2bd887bdb651ed6de5

SHA1
04d92e41ce002251cc09c297cf2b38c4263709ea

SHA256
9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

SHA512
8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
3c38aac78b7ce7f94f4916372800e242

SHA1
c793186bcf8fdb55a1b74568102b4e073f6971d6

SHA256
3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

SHA512
c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
321a3ca50e80795018d55a19bf799197

SHA1
df2d3c95fb4cbb298d255d342f204121d9d7ef7f

SHA256
5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f

SHA512
3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
0462e22f779295446cd0b63e61142ca5

SHA1
616a325cd5b0971821571b880907ce1b181126ae

SHA256
0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e

SHA512
07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
c3632083b312c184cbdd96551fed5519

SHA1
a93e8e0af42a144009727d2decb337f963a9312e

SHA256
be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125

SHA512
8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
f3ff2d544f5cd9e66bfb8d170b661673

SHA1
9e18107cfcd89f1bbb7fdaf65234c1dc8e614add

SHA256
e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f

SHA512
184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
a0c2dbe0f5e18d1add0d1ba22580893b

SHA1
29624df37151905467a223486500ed75617a1dfd

SHA256
3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f

SHA512
3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
2666581584ba60d48716420a6080abda

SHA1
c103f0ea32ebbc50f4c494bce7595f2b721cb5ad

SHA256
27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328

SHA512
befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
225d9f80f669ce452ca35e47af94893f

SHA1
37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50

SHA256
61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232

SHA512
2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
1281e9d1750431d2fe3b480a8175d45c

SHA1
bc982d1c750b88dcb4410739e057a86ff02d07ef

SHA256
433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

SHA512
a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
fd46c3f6361e79b8616f56b22d935a53

SHA1
107f488ad966633579d8ec5eb1919541f07532ce

SHA256
0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df

SHA512
3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
0f129611a4f1e7752f3671c9aa6ea736

SHA1
40c07a94045b17dae8a02c1d2b49301fad231152

SHA256
2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f

SHA512
6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
d4fba5a92d68916ec17104e09d1d9d12

SHA1
247dbc625b72ffb0bf546b17fb4de10cad38d495

SHA256
93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5

SHA512
d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
edf71c5c232f5f6ef3849450f2100b54

SHA1
ed46da7d59811b566dd438fa1d09c20f5dc493ce

SHA256
b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc

SHA512
481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
f9235935dd3ba2aa66d3aa3412accfbf

SHA1
281e548b526411bcb3813eb98462f48ffaf4b3eb

SHA256
2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200

SHA512
ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
21KB

MD5
5107487b726bdcc7b9f7e4c2ff7f907c

SHA1
ebc46221d3c81a409fab9815c4215ad5da62449c

SHA256
94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade

SHA512
a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
d5d77669bd8d382ec474be0608afd03f

SHA1
1558f5a0f5facc79d3957ff1e72a608766e11a64

SHA256
8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8

SHA512
8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-locale-l1-1-0.dll

Filesize
21KB

MD5
650435e39d38160abc3973514d6c6640

SHA1
9a5591c29e4d91eaa0f12ad603af05bb49708a2d

SHA256
551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0

SHA512
7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-math-l1-1-0.dll

Filesize
29KB

MD5
b8f0210c47847fc6ec9fbe2a1ad4debb

SHA1
e99d833ae730be1fedc826bf1569c26f30da0d17

SHA256
1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7

SHA512
992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
29KB

MD5
075419431d46dc67932b04a8b91a772f

SHA1
db2af49ee7b6bec379499b5a80be39310c6c8425

SHA256
3a4b66e65a5ee311afc37157a8101aba6017ff7a4355b4dd6e6c71d5b7223560

SHA512
76287e0003a396cda84ce6b206986476f85e927a389787d1d273684167327c41fc0fe5e947175c0deb382c5accf785f867d9fce1fea4abd7d99b201e277d1704

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
272c0f80fd132e434cdcdd4e184bb1d8

SHA1
5bc8b7260e690b4d4039fe27b48b2cecec39652f

SHA256
bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d

SHA512
94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
25KB

MD5
20c0afa78836b3f0b692c22f12bda70a

SHA1
60bb74615a71bd6b489c500e6e69722f357d283e

SHA256
962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc

SHA512
65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
25KB

MD5
96498dc4c2c879055a7aff2a1cc2451e

SHA1
fecbc0f854b1adf49ef07beacad3cec9358b4fb2

SHA256
273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d

SHA512
4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-string-l1-1-0.dll

Filesize
25KB

MD5
115e8275eb570b02e72c0c8a156970b3

SHA1
c305868a014d8d7bbef9abbb1c49a70e8511d5a6

SHA256
415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004

SHA512
b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
001e60f6bbf255a60a5ea542e6339706

SHA1
f9172ec37921432d5031758d0c644fe78cdb25fa

SHA256
82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945

SHA512
b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\api-ms-win-crt-utility-l1-1-0.dll

Filesize
21KB

MD5
a0776b3a28f7246b4a24ff1b2867bdbf

SHA1
383c9a6afda7c1e855e25055aad00e92f9d6aaff

SHA256
2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9

SHA512
7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\base_library.zip

Filesize
1.3MB

MD5
8dad91add129dca41dd17a332a64d593

SHA1
70a4ec5a17ed63caf2407bd76dc116aca7765c0d

SHA256
8de4f013bfecb9431aabaa97bb084fb7de127b365b9478d6f7610959bf0d2783

SHA512
2163414bc01fc30d47d1de763a8332afe96ea7b296665b1a0840d5197b7e56f4963938e69de35cd2bf89158e5e2240a1650d00d86634ac2a5e2ad825455a2d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\libssl-3.dll

Filesize
768KB

MD5
19a2aba25456181d5fb572d88ac0e73e

SHA1
656ca8cdfc9c3a6379536e2027e93408851483db

SHA256
2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006

SHA512
df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\pyexpat.pyd

Filesize
196KB

MD5
5e911ca0010d5c9dce50c58b703e0d80

SHA1
89be290bebab337417c41bab06f43effb4799671

SHA256
4779e19ee0f4f0be953805efa1174e127f6e91ad023bd33ac7127fef35e9087b

SHA512
e3f1db80748333f08f79f735a457246e015c10b353e1a52abe91ed9a69f7de5efa5f78a2ed209e97b16813cb74a87f8f0c63a5f44c8b59583851922f54a48cf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\select.pyd

Filesize
29KB

MD5
92b440ca45447ec33e884752e4c65b07

SHA1
5477e21bb511cc33c988140521a4f8c11a427bcc

SHA256
680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3

SHA512
40e60e1d1445592c5e8eb352a4052db28b1739a29e16b884b0ba15917b058e66196988214ce473ba158704837b101a13195d5e48cb1dc2f07262dfecfe8d8191

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\tcl86t.dll

Filesize
1.7MB

MD5
21dc82dd9cc445f92e0172d961162222

SHA1
73bc20b509e1545b16324480d9620ae25364ebf1

SHA256
c2966941f116fab99f48ab9617196b43a5ee2fd94a8c70761bda56cb334daa03

SHA512
3051a9d723fb7fc11f228e9f27bd2644ac5a0a95e7992d60c757240577b92fc31fa373987b338e6bc5707317d20089df4b48d1b188225ff370ad2a68d5ff7ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\tk86t.dll

Filesize
1.5MB

MD5
9fb68a0252e2b6cd99fd0cb6708c1606

SHA1
60ab372e8473fad0f03801b6719bf5cccfc2592e

SHA256
c6ffe2238134478d8cb1c695d57e794516f3790e211ff519f551e335230de7de

SHA512
f5de1b1a9dc2d71ae27dfaa7b01e079e4970319b6424b44c47f86360faf0b976ed49dab6ee9f811e766a2684b647711e567cbaa6660f53ba82d724441c4ddd06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\unicodedata.pyd

Filesize
1.1MB

MD5
16be9a6f941f1a2cb6b5fca766309b2c

SHA1
17b23ae0e6a11d5b8159c748073e36a936f3316a

SHA256
10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04

SHA512
64b7ecc58ae7cf128f03a0d5d5428aaa0d4ad4ae7e7d19be0ea819bbbf99503836bfe4946df8ee3ab8a92331fdd002ab9a9de5146af3e86fef789ce46810796b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI49322\zlib1.dll

Filesize
143KB

MD5
297e845dd893e549146ae6826101e64f

SHA1
6c52876ea6efb2bc8d630761752df8c0a79542f1

SHA256
837efb838cb91428c8c0dfb65d5af1e69823ff1594780eb8c8e9d78f7c4b2fc1

SHA512
f6efef5e34ba13f1dfddacfea15f385de91d310d73a6894cabb79c2186accc186c80cef7405658d91517c3c10c66e1acb93e8ad2450d4346f1aa85661b6074c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 415362.crdownload

Filesize
280B

MD5
6bba9ae045c2e0013f3e00dc0c9199ac

SHA1
bd97cb2ce83f719622d7996edc74f1d7e702d57e

SHA256
865309d50a984aeca0025d60a989d0a63bded5cb83cc83cbabeddebf60c8063a

SHA512
843535efa14f55131765f04789e95084c563b2c9cba6580fca117b3b836abde7e2ac282b00f53387b3a72c0c4f2ff80f7e48e1ef7201e6dc191fbb0187eac542

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 47455.crdownload

Filesize
18.3MB

MD5
2896a251a8d359f13d3d53d68918c491

SHA1
ec3a1ebe0a8b33d27e584372c85ccef21bb08c1c

SHA256
39e145c9d72b6ca8648265a34998b525e33d529144bad1848c34fecc9c1aafe4

SHA512
f0ea09e94abd04844a7f9fc82b312dd782199f5cc129fe7532f3585d7d6b312dab806f2dd2c8fb63feabc624516d7a80cf6d3e1b49e6e9b2ef44f3a64e8b6411

Download Submit
memory/244-1122-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1151-0x00000195FE400000-0x00000195FE401000-memory.dmp

Filesize
4KB

Download
memory/244-1083-0x00000195F5E70000-0x00000195F5E80000-memory.dmp

Filesize
64KB

Download
memory/244-1099-0x00000195F5F70000-0x00000195F5F80000-memory.dmp

Filesize
64KB

Download
memory/244-1115-0x00000195FE560000-0x00000195FE561000-memory.dmp

Filesize
4KB

Download
memory/244-1116-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1118-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1117-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1119-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1121-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1120-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1124-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1150-0x00000195FE2F0000-0x00000195FE2F1000-memory.dmp

Filesize
4KB

Download
memory/244-1149-0x00000195FE2F0000-0x00000195FE2F1000-memory.dmp

Filesize
4KB

Download
memory/244-1147-0x00000195FE2E0000-0x00000195FE2E1000-memory.dmp

Filesize
4KB

Download
memory/244-1123-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/244-1135-0x00000195FE0E0000-0x00000195FE0E1000-memory.dmp

Filesize
4KB

Download
memory/244-1132-0x00000195FE1A0000-0x00000195FE1A1000-memory.dmp

Filesize
4KB

Download
memory/244-1129-0x00000195FE1B0000-0x00000195FE1B1000-memory.dmp

Filesize
4KB

Download
memory/244-1127-0x00000195FE1A0000-0x00000195FE1A1000-memory.dmp

Filesize
4KB

Download
memory/244-1126-0x00000195FE1B0000-0x00000195FE1B1000-memory.dmp

Filesize
4KB

Download
memory/244-1125-0x00000195FE590000-0x00000195FE591000-memory.dmp

Filesize
4KB

Download
memory/1584-1078-0x00007FF9E3FB0000-0x00007FF9E3FDA000-memory.dmp

Filesize
168KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads