Malware Analysis Report

2024-07-28 05:18

Sample ID 240603-q643jagf5y
Target 9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe
SHA256 51528ed66d073afe1ffc13814edb1b5ffd32bfa02585852468d931e7c6203105
Tags
adware discovery link pdf persistence spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

51528ed66d073afe1ffc13814edb1b5ffd32bfa02585852468d931e7c6203105

Threat Level: Known bad

The file 9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe was found to be: Known bad.

Malicious Activity Summary

adware discovery link pdf persistence spyware stealer

Adds autorun key to be loaded by Explorer.exe on startup

Uses Session Manager for persistence

Modifies Shared Task Scheduler registry keys

Drops file in Drivers directory

Reads user/profile data of web browsers

Loads dropped DLL

Unexpected DNS network traffic destination

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Installs/modifies Browser Helper Object

Drops file in System32 directory

HTTP links in PDF interactive object

Enumerates physical storage devices

Program crash

Unsigned PE

Modifies Internet Explorer settings

Enumerates system info in registry

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Modifies data under HKEY_USERS

Modifies registry class

Suspicious use of SendNotifyMessage

Modifies Control Panel

NTFS ADS

Modifies system certificate store

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Browser Extensions
T1176
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Modify Registry
T1112
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-03 13:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-03 13:53

Reported

2024-06-03 14:23

Platform

win11-20240426-en

Max time kernel

1441s

Max time network

1442s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe"

Signatures

Adds autorun key to be loaded by Explorer.exe on startup

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\3WARE.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\AMDSATA.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\AMDSBS.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\AMDXATA.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\ARCSAS.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\IASTORAVC.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\WINDOWS\SysWOW64\DRIVERS\VHDMP.SYS C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Modifies Shared Task Scheduler registry keys

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Uses Session Manager for persistence

persistence
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000500061007200740069007a0061006e000000 C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Windows\System32\nksdnj.exe N/A
N/A N/A C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unexpected DNS network traffic destination

Description Indicator Process Target
Destination IP 45.77.153.162 N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ApprovedByRegRun2\AntiRepl\0\Operation = "1" C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ApprovedByRegRun2\AntiRepl\0\Target = "C:\\WINDOWS\\SYSTEM32\\NKSDNJ.EXE" C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ApprovedByRegRun2\AntiRepl\0\Source C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Checks installed software on the system

discovery

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\WINDOWS\Syswow64\Partizan.RRI C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File created C:\WINDOWS\system32\Partizan.exe C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74FBF93595CFC8459196065CE54AD928 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\74FBF93595CFC8459196065CE54AD928 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
File opened for modification C:\WINDOWS\SYSTEM32\NKSDNJ.EXE C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

HTTP links in PDF interactive object

pdf link
Description Indicator Process Target
N/A N/A N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\WINDOWS\system32\taskkill.exe N/A

Modifies Control Panel

evasion
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Control Panel\Desktop C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Control Panel\Desktop C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Extensions C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Plugins\Extension C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Styles C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Search C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\SearchUrl C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Plugins\Extension C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Search C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Extensions C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\SearchUrl C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\URLSearchHooks C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\URLSearchHooks C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Desktop\Components C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Internet Explorer\Styles C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates\8D4C4A23BA9EE84EA7348FA98CC6E65FBB69DE7B\Blob = 0300000001000000140000008d4c4a23ba9ee84ea7348fa98cc6e65fbb69de7b140000000100000014000000bbaf7e023dfaa6f13c848eadee3898ecd93232d4040000000100000010000000ab9b109ce8934f11e7cd22ed550680da0f0000000100000030000000a768343c4aeaced5c72f3571938864983a67ed49031c1da2495863caf65fe507011f7f0e70b6cb40e5631c07721be03419000000010000001000000082218ffb91733e64136be5719f57c3a15c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa25900000001000000160000005200530041002f0053004800410033003800340000002000000001000000820500003082057e30820466a003020102021067def43ef17bdae24ff5940606d2c084300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a308185310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564312b302906035504031322434f4d4f444f205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010091e85492d20a56b1ac0d24ddc5cf446774992b37a37d23700071bc53dfc4fa2a128f4b7f1056bd9f7072b7617fc94b0f17a73de3b00461eeff1197c7f4863e0afa3e5cf993e6347ad9146be79cb385a0827a76af7190d7ecfd0dfa9c6cfadfb082f4147ef9bec4a62f4f7f997fb5fc674372bd0c00d689eb6b2cd3ed8f981c14ab7ee5e36efcd8a8e49224da436b62b855fdeac1bc6cb68bf30e8d9ae49b6c6999f878483045d5ade10d3c4560fc32965127bc67c3ca2eb66bea46c7c720a0b11f65de4808baa44ea9f283463784ebe8cc814843674e722a9b5cbd4c1b288a5c227bb4ab98d9eee05183c309464e6d3e99fa9517da7c3357413c8d51ed0bb65caf2c631adf57c83fbce95dc49baf4599e2a35a24b4baa9563dcf6faaff4958bef0a8fff4b8ade937fbbab8f40b3af9e843421e89d884cb13f1d9bbe18960b88c2856ac141d9c0ae771ebcf0edd3da996a148bd3cf7afb50d224cc01181ec563bf6d3a2e25bb7b204225295809369e88e4c65f191032d707402ea8b671529695202bbd7df506a5546bfa0a328617f70d0c3a2aa2c21aa47ce289c064576bf821827b4d5aeb4cb50e66bf44c867130e9a6df1686e0d8ff40ddfbd042887fa3333a2e5c1e41118163ce18716b2beca68ab7315c3a6a47e0c37959d6201aaff26a98aa72bc574ad24b9dbb10fcb04c41e5ed1d3d5e289d9cccbfb351daa747e584530203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e04160414bbaf7e023dfaa6f13c848eadee3898ecd93232d4300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c050003820101007ff25635b06d954a4e74af3ae26f018b87d33297edf840d2775311d7c7162ec69de64856be80a9f8bc78d2c86317ae8ced1631fa1f18c90ec7ee48799fc7c9b9bccc8815e36861d19f1d4b6181d7560463c2086926f0f0e52fdfc00a2ba905f4025a6a89d7b4844295e3ebf776205e35d9c0cd2508134c71388e87b0338491991e91f1ac9e3fa71d60812c364154a0e246060bac1bc799368c5ea10ba49ed9424624c5c55b81aeada0a0dc9f36b88dc21d15fa88ad8110391f44f02b9fdd10540c0734b136d114fd07023dff7255ab27d62c814171298d41f450571a7e6560afcbc5287698aeb3a853768be621526bea21d0840e494e8853da922ee71d0866d7 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696768468-2170909707-4198977321-1000\{BA794D46-1A3E-4FDB-863F-81932C542E90} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616209" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\NodeSlot = "4" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 5600310000000000c3588d71100057696e646f777300400009000400efbec5522d60c3588e712e000000a6050000000001000000000000000000000000000000f02c2d00570069006e0064006f0077007300000016000000 C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\Software\CLASSES\ShellScrap C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" C:\Windows\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell C:\Windows\explorer.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5a00310000000000c358606f100053797374656d33320000420009000400efbec5522d60c358606f2e0000008f360000000001000000000000000000000000000000caf10c01530079007300740065006d0033003200000018000000 C:\Windows\explorer.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 0f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4620000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb20000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 040000000100000010000000a7f2e41606411150306b9ce3b49cb0c90f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb0b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a0065006300740029000000090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703086200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d81d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf67087e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d901030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d46190000000100000010000000e843ac3b52ec8c297fa948c9b1fb281920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46\Blob = 5c000000010000000400000000080000190000000100000010000000e843ac3b52ec8c297fa948c9b1fb2819030000000100000014000000e12dfb4b41d7d9c32b30514bac1d81d8385e2d4668000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d0000000100000010000000f919b9ccce1e59c2e785f7dc2ccf6708140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d86200000001000000200000006fff78e400a70c11011cd85977c459fb5af96a3df0540820d0f4b8607875e58f090000000100000022000000302006082b06010505070303060a2b0601040182370a030406082b060105050703080b000000010000002a0000005300650063007400690067006f0020002800550054004e0020004f0062006a00650063007400290000000f0000000100000014000000f45a0858c9cd920e647bad539ab9f1cfc77f24cb040000000100000010000000a7f2e41606411150306b9ce3b49cb0c920000000010000006a040000308204663082034ea003020102021044be0c8b500024b411d3362de0b35f1b300d06092a864886f70d0101050500308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a656374301e170d3939303730393138333132305a170d3139303730393138343033365a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381af3081ac300b0603551d0f0404030201c6300f0603551d130101ff040530030101ff301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d830420603551d1f043b30393037a035a0338631687474703a2f2f63726c2e7573657274727573742e636f6d2f55544e2d5553455246697273742d4f626a6563742e63726c30290603551d250422302006082b0601050507030306082b06010505070308060a2b0601040182370a0304300d06092a864886f70d01010505000382010100081f52b1374478dbfdceb9da959698aa556480b55a40dd21a5c5c1f35f2c4cc8475a69eae8f03535f4d025f3c8a6a4874abd1bb17308bdd4c3cab635bb59867731cda78014ae13effcb148f96b25252d51b62c6d45c198c88a565d3eee434e3e6b278ed03a4b850b5fd3ed6aa775cbd15a872f3975135a72b002819fbef00f845420626c69d4e14dc60d9943010d12968c789dbf50a2b144aa6acf177acf6f0fd4f824555ff0341649663e5046c96371383162b862b9f353ad6cb52ba212aa194f09da5ee793c68e1408fef0308018a086854dc87dd78b03fe6ed5f79d16ac922ca023e59c91521f94df179473c3b3c1c17105200078bd13521da83ecd001fc8 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 31989.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
File opened for modification C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001.zip:Zone.Identifier C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
N/A N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\ComodoAptAtScanner\cmdapt64.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: 35 N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files\7-Zip\7zG.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeDebugPrivilege N/A C:\WINDOWS\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A
N/A N/A C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1632 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 2836 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 1032 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 2504 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 1632 wrote to memory of 4940 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe

"C:\Users\Admin\AppData\Local\Temp\9d27ba9524c013e118ec59a3205b3aa0_NeikiAnalytics.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4048 -ip 4048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbeeef3cb8,0x7ffbeeef3cc8,0x7ffbeeef3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4976 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4756 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5648 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6340 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6672 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe

"C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe"

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe

"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5840 /prefetch:2

C:\Windows\ComodoAptAtScanner\cmdapt64.exe

C:\Windows\ComodoAptAtScanner\cmdapt64.exe --service --scope "processes|drivers|autoruns" --status "\\127.0.0.1\ADMIN$\ComodoAptAtScanner\scan_status.txt" --output "\\127.0.0.1\ADMIN$\ComodoAptAtScanner\out.xml" --tvl "\\127.0.0.1\ADMIN$\ComodoAptAtScanner\tvl.txt" --trl "\\127.0.0.1\ADMIN$\ComodoAptAtScanner\trl.txt" --filter "*" --scanPeOnly on --flsUdpPort 53 --flsTcpPort 80 --skipGAC

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1020 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2908 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,3965125322020879519,9857791048713704522,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8

C:\Program Files\7-Zip\7zG.exe

"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\" -spe -an -ai#7zMap28210:126:7zEvent6680

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\Unhackme.exe"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe" /wiz /full /imode

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe" http://greatis.com/dbs.ini /r /i

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" /select,C:\WINDOWS\SYSTEM32\NKSDNJ.EXE

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\nksdnj.exe

"C:\Windows\System32\nksdnj.exe"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe" "C:\WINDOWS\SYSNATIVE\NKSDNJ.EXE" /a /hid: "2024-06-03-14:16:57"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe" /upl "C:\WINDOWS\SYSNATIVE\NKSDNJ.EXE"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe" "C:\WINDOWS\SYSNATIVE\NKSDNJ.EXE"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.virustotal.com/

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffbeeef3cb8,0x7ffbeeef3cc8,0x7ffbeeef3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1888,8958902754374285432,10769257839006154630,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe" "C:\WINDOWS\SYSNATIVE\NKSDNJ.EXE" /a /hid: "2024-06-03-14:17:28"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\RegRunInfo.exe" /upl "C:\WINDOWS\SYSNATIVE\NKSDNJ.EXE"

C:\WINDOWS\system32\taskkill.exe

"C:\WINDOWS\sysnative\taskkill.exe" /PID 1852 /F

C:\Windows\explorer.exe

"C:\Windows\explorer.exe" /select,C:\WINDOWS\SYSTEM32\NKSDNJ.EXE

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\nksdnj.exe

"C:\Windows\System32\nksdnj.exe"

C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe

"C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe"

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe

"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe" /postga break:skipfix:6

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.exe"

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\wu.exe" http://greatis.com/reanimator.ini /r /w 132542

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe

"C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\regruninfo.exe" "C:\Users\Admin\Desktop\regrunlog.txt"

Network

Country Destination Domain Proto
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.129:443 r.bing.com tcp
NL 23.62.61.129:443 r.bing.com tcp
N/A 224.0.0.251:5353 udp
NL 23.62.61.160:443 r.bing.com tcp
NL 23.62.61.160:443 r.bing.com tcp
NL 23.62.61.129:443 r.bing.com tcp
NL 23.62.61.129:443 r.bing.com tcp
US 2.17.251.10:443 aefd.nelreports.net tcp
IE 40.126.31.69:443 login.microsoftonline.com tcp
US 2.17.251.10:443 aefd.nelreports.net udp
US 13.107.5.80:443 services.bingapis.com tcp
US 104.20.138.65:80 tinyurl.com tcp
US 104.20.138.65:80 tinyurl.com tcp
GB 142.250.187.238:443 drive.google.com tcp
GB 142.250.187.238:443 drive.google.com udp
GB 172.217.16.238:443 apis.google.com tcp
GB 172.217.16.238:443 apis.google.com udp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.169.3:443 ssl.gstatic.com tcp
GB 172.217.16.225:443 drive-thirdparty.googleusercontent.com tcp
US 8.8.8.8:53 202.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
GB 172.217.169.3:443 ssl.gstatic.com udp
GB 172.217.16.234:443 drivefrontend-pa.clients6.google.com tcp
GB 172.217.16.234:443 drivefrontend-pa.clients6.google.com tcp
GB 142.250.187.225:443 drive.fife.usercontent.google.com tcp
GB 172.217.16.234:443 drivefrontend-pa.clients6.google.com udp
GB 142.250.187.234:443 ogads-pa.googleapis.com udp
GB 142.250.187.196:443 www.google.com tcp
GB 172.217.16.234:443 drivefrontend-pa.clients6.google.com tcp
US 8.8.8.8:53 234.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.187.250.142.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
GB 172.217.169.46:443 play.google.com tcp
GB 142.250.178.10:443 people-pa.clients6.google.com tcp
GB 172.217.16.225:443 drive-thirdparty.googleusercontent.com udp
GB 172.217.169.46:443 play.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 142.250.187.206:443 clients6.google.com tcp
GB 172.217.16.238:443 contacts.google.com tcp
GB 142.250.187.206:443 clients6.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
GB 142.250.179.225:443 drive.usercontent.google.com udp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 content.googleapis.com udp
US 8.8.8.8:53 clients6.google.com udp
GB 142.250.187.206:443 clients6.google.com udp
US 8.8.8.8:53 243.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 takeout-pa.clients6.google.com udp
GB 142.250.187.234:443 takeout-pa.clients6.google.com tcp
GB 142.250.187.234:443 takeout-pa.clients6.google.com udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.234:443 takeout-pa.clients6.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 142.250.187.238:443 ogs.google.com udp
US 8.8.8.8:53 ssl.gstatic.com udp
US 8.8.8.8:53 233.38.18.104.in-addr.arpa udp
US 8.8.8.8:53 storage.googleapis.com udp
GB 216.58.204.91:443 storage.googleapis.com tcp
US 8.8.8.8:53 91.204.58.216.in-addr.arpa udp
GB 142.250.187.238:443 ogs.google.com udp
GB 172.217.169.46:443 play.google.com udp
GB 142.250.187.234:443 takeout-pa.clients6.google.com udp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 8.8.8.8:53 accounts.comodo.com udp
US 137.184.246.236:443 accounts.comodo.com tcp
N/A 127.0.0.1:445 tcp
N/A 127.0.0.1:135 tcp
N/A 127.0.0.1:49669 tcp
US 8.8.8.8:53 verdict.xcitium.com udp
CA 15.222.185.255:443 verdict.xcitium.com tcp
US 8.8.8.8:53 fls.security.comodo.com udp
US 45.77.153.162:53 fls.security.comodo.com udp
US 45.77.153.162:49669 fls.security.comodo.com udp
US 8.8.8.8:53 162.153.77.45.in-addr.arpa udp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 45.77.153.162:15378 fls.security.comodo.com udp
GB 142.250.187.238:443 ogs.google.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
US 45.77.153.162:1505 fls.security.comodo.com udp
GB 172.217.169.3:443 ssl.gstatic.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 216.58.204.91:443 storage.googleapis.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 45.77.153.162:49745 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 45.77.153.162:26087 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 45.77.153.162:36356 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 45.77.153.162:34884 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 172.217.169.46:443 play.google.com udp
GB 142.250.187.238:443 ogs.google.com udp
US 45.77.153.162:42683 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
US 45.77.153.162:33074 fls.security.comodo.com udp
US 45.77.153.162:80 fls.security.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 45.77.153.162:4017 fls.security.comodo.com udp
US 8.8.8.8:53 greatis.com udp
CA 144.217.89.149:80 greatis.com tcp
US 8.8.8.8:53 www.greatis.com udp
CA 144.217.89.149:80 www.greatis.com tcp
US 8.8.8.8:53 149.89.217.144.in-addr.arpa udp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 8.8.8.8:53 www.virustotal.com udp
US 8.8.8.8:53 www.virustotal.com udp
US 74.125.34.46:443 www.virustotal.com tcp
US 74.125.34.46:443 www.virustotal.com tcp
GB 142.250.180.3:443 www.recaptcha.net tcp
US 8.8.8.8:53 46.34.125.74.in-addr.arpa udp
US 8.8.8.8:53 104.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
GB 142.250.200.35:443 recaptcha.net tcp
US 8.8.8.8:53 recaptcha.net udp
GB 142.250.200.35:443 recaptcha.net udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.213.58.216.in-addr.arpa udp
GB 142.250.187.196:443 www.google.com udp
GB 142.250.187.196:443 www.google.com tcp
US 74.125.34.46:443 www.virustotal.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 8.8.8.8:53 verdict.xcitium.com udp
CA 15.222.185.255:443 verdict.xcitium.com tcp
N/A 127.0.0.1:445 tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
N/A 127.0.0.1:445 tcp
CA 15.222.185.255:443 verdict.xcitium.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
US 8.8.8.8:53 api.gameanalytics.com udp
US 44.210.247.6:443 api.gameanalytics.com tcp
US 8.8.8.8:53 6.247.210.44.in-addr.arpa udp
US 44.210.247.6:443 api.gameanalytics.com tcp
US 44.210.247.6:443 api.gameanalytics.com tcp
US 44.210.247.6:443 api.gameanalytics.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
CA 144.217.89.149:80 greatis.com tcp
US 8.8.8.8:53 www.greatissoftware.com udp
CA 54.39.156.188:80 www.greatissoftware.com tcp
CA 54.39.156.188:443 www.greatissoftware.com tcp
US 8.8.8.8:53 188.156.39.54.in-addr.arpa udp
GB 178.255.85.135:443 cmc.comodo.com tcp
N/A 10.127.0.120:445 tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
GB 178.255.85.135:443 cmc.comodo.com tcp
N/A 127.0.0.1:445 tcp
US 8.8.8.8:53 fls.security.comodo.com udp
US 8.8.8.8:53 accounts.comodo.com udp
US 137.184.246.236:443 accounts.comodo.com tcp
US 8.8.8.8:53 verdict.xcitium.com udp
CA 15.222.185.255:443 verdict.xcitium.com tcp
US 8.8.8.8:53 cmc.comodo.com udp
GB 178.255.85.135:443 cmc.comodo.com tcp

Files

memory/4048-0-0x0000000000400000-0x00000000004ED000-memory.dmp

memory/4048-1-0x0000000000400000-0x00000000004ED000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 8ff8bdd04a2da5ef5d4b6a687da23156
SHA1 247873c114f3cc780c3adb0f844fc0bb2b440b6d
SHA256 09b7b20bfec9608a6d737ef3fa03f95dcbeaca0f25953503a321acac82a5e5ae
SHA512 5633ad84b5a003cd151c4c24b67c1e5de965fdb206b433ca759d9c62a4785383507cbd5aca92089f6e0a50a518c6014bf09a0972b4311464aa6a26f76648345e

\??\pipe\LOCAL\crashpad_1632_GOACGSJYGSEWXRTZ

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 1e4ed4a50489e7fc6c3ce17686a7cd94
SHA1 eac4e98e46efc880605a23a632e68e2c778613e7
SHA256 fc9e8224722cb738d8b32420c05006de87161e1d28bc729b451759096f436c1a
SHA512 5c4e637ac4da37ba133cb1fba8fa2ff3e24fc4ca15433a94868f2b6e0259705634072e5563da5f7cf1fd783fa8fa0c584c00f319f486565315e87cdea8ed1c28

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 64aa12db1df94572d511f5c640540e67
SHA1 84ef0c2fa601cf28fdb51ea3b4f98e21a5757b3c
SHA256 523e6837ee0a6dc0aa627d58b6b513d16f0ced30b9a5e9ee1a2dab9bfce4840e
SHA512 1200b7675a99ec04ce5348b0f94e605a2f6441b4043ccb7728b9531c98752cd59c63a9987bb59242370de0d0f2ff268c39da446d98717a21ef00a1e51bd11e90

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 826316f0c29e954097ffd302bf87593c
SHA1 7187f8a51289b7649d34eabf97b7a35935fe6ad3
SHA256 7a45b303f0ccf40177ea3ea7274dd99735124f7a7b6d6dc7c09fd888ae8e4808
SHA512 c6a8ffdb6f60529c47b28129c21ccd18de18bd950dbc13230af2b4ee446ced1b796f26e2e1b081896c6a885bb9b0d267fb4f6e9da8fb6ecdd69a64d6e8bca3db

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dbb294b0d3bfee89e3c56be396ed8d58
SHA1 7bb0cb9ce755e5612b91fe6717f05194d595c241
SHA256 b1be6b721acaf198b700ae0bca633b9ccaad581d75a59f955cdea0b62014cea3
SHA512 7c8dbffad8309ca3f52c295e321baf0daee9c4b54bb39bb386d30092ce135ae38ce22c190dcc07b6d1fc39aec10369a12c7a100dea877bcff73f3b85a69b35e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 4e3c41260d94578ede6d27552bd8f0c0
SHA1 f0961d6fa4b219e0680422069dbccb2fbc5294f6
SHA256 b2e5044d61bfc16032d9ebe26a4e20f55e2fb1072d91dc2e08e3c319dbb49772
SHA512 04c1a5a8e3fad6290c1c4be9e6028363c3d2c72945069488f84e405727475fc4ac48ff846fb5f787f6783b5dc64467ff13bf8d8f9093fc736cbd136e4bc8a941

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe61fa3e.TMP

MD5 13317fe9636b0d5940d2f22d7eb97883
SHA1 be89b2d9857d0dfecf6674f9ad4a5072c320aa08
SHA256 afd2b44b5c65eb97073a9a0e61e84d099ea6cc0a542c5546b2dc4bcb6bb58b47
SHA512 e4a09c6cb0b7300a686b6ecd29b896bc7d8df6ee348e2711bed1a0c1f2678b15ea0130d2c22dfc7299a00c370fae7086bc602360a1370191456d797a472707b6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 6f693cbafa63057ff4b4fa3be4154163
SHA1 ea3bb58fbb76cdce61b943d2b5fc9ecf720f664b
SHA256 c6949da8220bd13545ee9ec17d142cf1fe604389e04328c14f2bbc37c92dd235
SHA512 491b28c293b4317b09ac72c6557ff2bf3b81d5ee258a6c00a0ce51f3e58adb74625e11732fe34d481ee0d229defaf9b402e9393306f87f73ab2270174ee2d4fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 73c2babe53e6d2342f9bf0dcf620f155
SHA1 8ca3a93194ba63eaffbfd0ac6b87619bd80f84c3
SHA256 998f8644f3919be232a0a636c84c0d28ed625997559e7c527e9f48635adc26b5
SHA512 119d14d8ff9dac23224c64bd27583ac1131609812028be4eed53235ad9381e10face2293b8e802ee8d4b9a1f6f27d36d40b7cd83d9072f193db705d3c005c7c8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

MD5 97f07e182259f3e5f7cf67865bb1d8f0
SHA1 78c49303cb2a9121087a45770389ca1da03cbcdf
SHA256 c3a70f23a2cf331852a818d3f2a0cf7f048753c9b47aa4e7f0fee234c46b226c
SHA512 10056ad3a71ee806a8d8aff04d513a079568bf11799016f76f27c4255be2141a4c2d99c1f46bbfde9c99ba0f8b44e780a92b59f514d3cc1c248ead915c31b5dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 fd6c677cc93d529cf655bde3a46ad0b4
SHA1 07d5e50eb53582eb9049b86e39181249ac7ecfb8
SHA256 6b32f80181011b93d228dc8e01db16a11eb6c6a9c1bc6fe45eebb45e3d9b004d
SHA512 6d45c7cbfab7df100e56532a8a6e7dbe0054f8d93b8a51c8986d1f8b326f7ee7811e3201b3184a49e1c85ede535b37b0e435f33f1da67bfa189c1e3f1d19037d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 8d63a5c197e677456916f60681ba452e
SHA1 3e2e0340f0bd326cb62ba2650b579a033a93dc45
SHA256 58120cce479e759ecb812806f6f9596b38c27abc05ce6d033f70e7cd25b76a71
SHA512 18f026b2aac547bef7edde396ede2ca40f631d199ff7157c3ba88eb6945bb31acfd9c0feb77e04d67c0107f9fd38ee418ef0e34f5592296ed70291251697c299

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 85ea41af3faeda94503df4d2ea6c220f
SHA1 36abbeebe242f0fabbd7723485134ef785fc9772
SHA256 dc6d5d2b6557f287354a019716c6ffd0bc90b62f6d26b1c26fb5d3ecaec92169
SHA512 1a50830c28b02030ba23c19d421e4bcb68f403e749387b6597a5d612dae6ebdb9e18535db475d1d5d158982a581b70baf5180417a1735252363a34c82a11dac1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 c841127673de7d57004564efa75a275d
SHA1 040e5622f6b1789efabe80a744fe90b6016ed597
SHA256 d82753d735e8a74badbd98855bf1351e5e1cdad0b69c821f866d049694be69db
SHA512 aa659d57ca828b00009fa187edb7e7b5f0bfbcec10ba44c5ced8577b51d3f07dd97f4968261e5f40f6e56f45f051d02072bad93f818d80d439feb5f87c705dc8

C:\Users\Admin\Downloads\Unconfirmed 31989.crdownload

MD5 ddf8230ab47c7c517397ef1c5b1ee2e0
SHA1 4214d7217f353b7b8519ddb768ad238a9afa10f2
SHA256 688de6269eabf44a59a497e26920466976fa26a7d6b4ac4127cacf03da2edcac
SHA512 464dcf2958971a2b38e5e61c746578a88c571d976b5183489e3e8ec05953c51c860bd97e1839ea77faea18defa28da1d19f9d113037e4b7d98e5692ee6488ff1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 f97e89f425c68cc38a7ccb95afbc8081
SHA1 eea59cd880f9be3b261326c671688ba576c208c6
SHA256 f6e15ccd9e9c23dc9ae26cb9259161a9013d8174c325590340fad551b8bac4f8
SHA512 ed7fb8d1bdcc1fe72d0d95e3cce0c1b64fc59ced9ba0a737bc921ee6a9593d3bb40f2154a0b12a21353fd0d7db7e40f9f4bce07ad6bfb42c0ff7a85f0bc9ac39

C:\Users\Admin\Downloads\ThreatHunterAssessmentTool.exe:Zone.Identifier

MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 bebad2e4c4168c082a647599870e92ed
SHA1 1a87f8148b1cac6bbe429dd7e01361f07b99733c
SHA256 d7557ceb1580661d219342c97161c2d654b768dc72741b73498e4df64ea37ea3
SHA512 4272f846b3e32cfeb6e949feb4f43cdc8caea74831fef80318d9a660420fdd3ce9456001bac2d037fc9e18867c22d8d9f84d860e19a73ee92c9f94f252bbebe9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ef493d5e50768555effc08dfff3531dc
SHA1 fc02a0d0235ca435d77b254424f27b69a9b4c4e1
SHA256 8ca3e2d8ee9e3c9bedbfbc787ae02d59885a9c3b6c206dac0200e43a5670f815
SHA512 413639f4830f72576b986d80becb1c10d581c23b27cc9a664979a547600c002bb39b1a0b24d9ff304aa2a3030f62e6dae75adeb263595027f3dab6b504f6a03b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 e0ff089003983505ff76bacc38a7a0ac
SHA1 a7b6fe1109b68d11d377dfab1eabd80f87877a84
SHA256 7c31be65c819ae36df9f9efa8f08736bf1d28b45473c5ddf1dbbb37be50fac2d
SHA512 c1264bdc3c2a3c74a7aed0f536e0368cc2c8023fe04889616565421fd69c26c6a3674293cad195f97f2f1bea3514235d12463f3e6395b507227595b3da0ef52b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 8965703eea966f9a1563eb5b0d601bd5
SHA1 d8436609377d31652bcc00153fab9ce565fee6c0
SHA256 b49dba229cf4556c23cff2574996fd002a416fe143ccdd76aa5444ce82cbc9c6
SHA512 8c5728fbd8357a4cbd5e175a73efde3049f2b11782d23081ac2aeec56e3fd4a588ebdccf269cd0ff7ce6ee96dda6a74c5952edc9eeaa901c6abaa20802efe6cb

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 84ac6829abe7c3ef38198e4292e29d24
SHA1 1d00763b529eb191eab06c58216bc276c70958a3
SHA256 ad92e91860e128902fce6092c21fa3fa5a41ca90e3a4e0d857055b8ec936c043
SHA512 1496e99b3c2b1a00524c59610cf3db542f9b2a45f8294a3993de03feb5114d12f20104609ffcdadb04e14307875b6cb1a5b4a63ff61b11520978e8861fcb949b

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe

MD5 9dbd87da3046935d74a6026cb0e9bae9
SHA1 11584dbe6847d90c5797d0c2ca6ad4247154ca60
SHA256 381f108010501d81a8442290432434074e74b131a30a5c77a27d1e514a29b45c
SHA512 f2a57a0e86abb96d491f0b1ebc6c1efbbcd3e48f1e03e83b90b049b18c20b62e2d5ad56a35ae219b536a8ddec712072b002296a0d5adffcd573490855fb5ae43

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.exe.config

MD5 c006fafdde9bbf29aa270f536aa97d33
SHA1 fc43e9d0d0cd187e1a18a7ae01b6ea9fb3910a45
SHA256 8003ec74c61264a3b6e73b3f7090355480f12761680c50fd2dadbb60a2b40ab0
SHA512 fa7e68ef024291ddadd37047928bc48464858c0b317642ffcea4b6f5e961e7ea8fdf01323a661954652cc8ac0b5eb71643a6aef9f4c91cb5eb1a0b37663283b9

memory/1412-691-0x0000010DF7160000-0x0000010DF73D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Common.dll

MD5 620b8b022ae59a02b5217cc25ef09421
SHA1 f9c7ceff25deba9f6bfcd723d8695c11d1c2b4fe
SHA256 6c6ff80ffae631e803f57ab9b53075786ab003b583c4758047ee2df703249876
SHA512 b8157748a0e6093f9de4f5e95f8cb882a375c04f1026d4eb278c6226768107efb1232b78e71e2623b27ad72d1aac65433042aa846c9d55f8bf599c464735cd55

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.DeploymentCore.dll

MD5 db85afa75c1f8500c743db52755a01b7
SHA1 e38af07ab64904bcfab45c058057e19bc749285f
SHA256 e469020d57d38d5d43c10a540f4cf0b91cf4e1deafcc9426ef219df5ae03ef52
SHA512 968012fc1370c652ef9994908fb0c857c3c63419e0792c76a1a8ca85043c33543e3e6757236166faf0791b6211461eb5aaa0f5257dafb216d03aa46400c7b6c8

memory/1412-695-0x0000010DF7820000-0x0000010DF7830000-memory.dmp

memory/1412-697-0x0000010DF9050000-0x0000010DF9088000-memory.dmp

memory/1412-701-0x0000010DF9C30000-0x0000010DF9CD2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Core.dll

MD5 8888b0b243f728265ed7f0ac33edfb98
SHA1 7867def2aaeff6c26391186ace0fd24cefcab8a8
SHA256 537b5fdb3a29a67897949b0393474e016dd25ecb312aba5a909d74dc768200ab
SHA512 acaf3dfd856ed10705d9d2d54773307511084b6ec21cdeb3c400bad3c1c11fe02d7139b8506194c9545d99a12fd71b2b7a6efac086e2ffa308407863bc32de5b

memory/1412-699-0x0000010DF9010000-0x0000010DF9034000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.DAL.dll

MD5 6448d6dde5acdd8e63a97a7652ffa3c4
SHA1 cd2db209db5b2fd25a94c32db7ec57b496dcfb25
SHA256 873d052480df1d18381993c4106be5596b0da65ccb42b9328af4c3904c27fce4
SHA512 e58dd82274431775267b4736c859a6cf4a00801f902365cbbf11f9249093f19cbf9fabfc3e973d6c9365bcfa1dde78c874b57de5f262fc3be1b919f0d5e28931

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.dll

MD5 6c8cc2eb4303baf8d7d26d4a0887fa5a
SHA1 9bb0c565c79e2d7a82669a7f11b3df5851d9c9fc
SHA256 83ca6a8fbef980905c29fb182f42868e9b07cd352cd87817a9f5449dc70b12fe
SHA512 6fbd8fc0b7e947ad4053c4fe449dbdf972c0ca20cdd2a70dbb47a4dba939566fdcc0e21a487ab22421eab71995982c13c6095491ae05434b7cf3947955d7816b

memory/1412-703-0x0000010DFA050000-0x0000010DFA3B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.GridView.dll

MD5 45e05d6966567000063bf7cf6c082252
SHA1 25113978e8acc2222165c3928ac588b0f305cca1
SHA256 16bde21916a973d7fbd50eda42c2c9b2c36f74b0bf6461f22d870fbe2a85df19
SHA512 0a6f439d7395107d7e5375eed88e4c9ef925834ddf08b36aa52c297ce0b0a4a2b038a83efeb68e180d92408c764804a06c4ee43c17e31c0d5796cda7b382a4ba

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Data.dll

MD5 9ea393be611a5edfffbe303a098650fa
SHA1 ce21c5e845d81e3b32c8cba4137f75ce8f0acffe
SHA256 9fae89b6f0288bf95dafceee1e04a570afd78f681f961642aca48ade87788e26
SHA512 84f9f95ff66c67f406e858d66a15b87d746c852c9c53d910a9682e04b0a6d6818e49015cfccf1e6ebffa91cf5240d848dd433238d2bcfd1d86d51fcaf840800c

memory/1412-707-0x0000010DF9B50000-0x0000010DF9BC8000-memory.dmp

memory/1412-705-0x0000010DFA3C0000-0x0000010DFA65C000-memory.dmp

memory/1412-711-0x0000010DF9CE0000-0x0000010DF9D3E000-memory.dmp

memory/1412-713-0x0000010DF9DA0000-0x0000010DF9E00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\SimpleInjector.dll

MD5 50392527815cf7a9c524ed35f96b096b
SHA1 86773de8d04efdd0f5cde4a10859cd54b8aa5223
SHA256 70697f7f545912682a735c99cdeccec33c398b3fd6bbc480c4be730da077cb00
SHA512 1fb3eca1fc18a9304afc6eade5315f5c73f7549f4fa9ad634501b3e3c1f255e847c7fc3e99ec4620725c6ed75709311fa791bcef44352f3af67cdf95a056e752

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.FixedDocumentViewers.dll

MD5 adaedfb21fa68af018a2df60746afe2c
SHA1 c34a794fc8969c8513697785e5ba646dd437e779
SHA256 2b31ad9f570fd23d513a47249f89064ed53f3cf1e8e348eefbb7d25be6fad7c7
SHA512 593846f005fa05218644824f02bce58a5f9733b1ee2e3f80627804b216e6794eeda0c79edb96bfab546f7d35379633633fddcfaf69095f30adf2edec0d155bb3

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Threat Hunter Assessment Tool.pdb

MD5 e8aa334cd901edf5e120ed6d1768b227
SHA1 5278bdd96a24ec4a3ae9ae8c91c2fcbd6aef56b5
SHA256 c20c9d1743bba7e66fa9a95901f54f4e513d250f08f70dda65bb0d8c708a913c
SHA512 18aa31ccb4ed200496b668e1403d990e5e645c81c70b48a6a4fb0e209641cdadc4f99227d9e077b02ab3793d8650aebbff0c9c30925782ea9d6b703f7ccb2579

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Common.pdb

MD5 6792817dca690cf3d52f5efd181cab76
SHA1 4cdfdc16f560c759f51409259edef189f21cef8b
SHA256 51029aabbcd4368b745d755706cb2b495325a0c5d8d8a78822baa88a5cc7a35d
SHA512 f9fd10c439d3f353e970c2c06a29bc03b8c6d2e36a9518758528f460d051b21ae0921d0b7b7a5a1afe68ac8130232eacd4dcc130ab91e0ddc23f2ec33fffa2e2

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Valkyrie.WebApiProvider.dll

MD5 050d548c6ffdab12d3031790a76381f8
SHA1 095e1171f5ab4d2eb658a802121e572a32ac11ca
SHA256 609d55474e7f6871fd22ae7bec34b8f2e251eaab54a176a5df01b7a9e5389b81
SHA512 c0984b9e6cd04d31fd13156c0085d4b7e67b1024e7fc9ea9cff48730a12866339a063a9c15e22ae14a0d2a1db11c9bdfc7108ea6a327c381632c23910d933a38

memory/1412-717-0x0000010DF9BF0000-0x0000010DF9C04000-memory.dmp

memory/1412-719-0x0000010DFE060000-0x0000010DFE06E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.COT.Login.dll

MD5 5fd915a05396c4ddcd21508991a4318c
SHA1 9c1bebdbd77d0f13eb918d5b9d2c87edc73e84dd
SHA256 811a0f9d57c36b14d3c149066c3f0ef2d117c0b267870f007098b30a5fb9b901
SHA512 e2880ca325eda3470ddf4710d3471eb00e9e29ecc8d8940fa22f7246d32293deb8b3333987a4e42675741ca103e0f2519643888691df18d5ad1d3aab8f2d1fa9

memory/1412-720-0x0000010DFE070000-0x0000010DFE078000-memory.dmp

memory/1412-722-0x0000010DFF930000-0x0000010DFF93E000-memory.dmp

memory/1412-721-0x0000010DFF960000-0x0000010DFF998000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Navigation.dll

MD5 64b10ac25f59777e7ebb0b7027881745
SHA1 85029e19b9eb4d58882828d7d01d3af8ac7d3294
SHA256 bd13102239c2d5e2201d4d8e0d9955ff26c5cb27cfe952c72849731ecd92b9c7
SHA512 0d81dd5c853e131dd8df25716858ff359f5da506fefea5575ebe06aa3b19b34f1399ab7adc8dc428f240fc3a3774e124f35447d820e65620d85ee6cb712480a9

memory/1412-724-0x0000010E00330000-0x0000010E00660000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Themes.Windows8.dll

MD5 f5c42ca459857a067ed07e02de1045fa
SHA1 d50657fe3e60f4432e8fc67f6f85276062f90b46
SHA256 196a1e24be95273d6dbc3b60aaf704818031fcff6962b780cdf13da841178834
SHA512 d59bf0adb43a4459cdbf6c81d4c9c05324cc4198d9b3e907cdac412c873c8b83d9a6dc8d39138f65e2088d520cb1634162aac773d0fac1eb02ec1cc92ddb8ca1

memory/1412-726-0x0000010E00000000-0x0000010E001CC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.Fixed.dll

MD5 aadfccaee394be81d28bd3096ecc585a
SHA1 66c7edd13df3129e4d188a8acdd1cf29cdefccbb
SHA256 00ac3169284891a885c352c05d54dc8e3b422002fec32874b352d6ef3f5facb5
SHA512 e0ac3db823a3b3176ab0180fe93f79518cdc30693d7be6b29244783efec4c59b3ec02122ae08a37dd1b22655ded0a41627720f26d0ab9b7840f3c9b02e941fe2

memory/1412-731-0x0000010E00660000-0x0000010E00872000-memory.dmp

memory/1412-733-0x0000010DFD600000-0x0000010DFD65C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Documents.Core.dll

MD5 7fb64cb114c7f39d886a482b6c1d88ec
SHA1 6f8eb5daf68a1f2b053fdb4d66c84a01f4756fb1
SHA256 781934a7b18b5c94bd4b52f3d44e3a5874dec398f7347672e1c92f1f09591f46
SHA512 f91a82f6ad9e00b865d08182e01f299a28d741c30d94499b3804593974608feca5840dd541e0fc8b813f745622ac73c60ad0d6c718bce0ec1df7642d54463b5b

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.dll

MD5 a35746d7a8c835f4cdaa90efe1f11511
SHA1 c6869e2de30809f944e12b79f216ce6cfb68c9cc
SHA256 ed6ebd749052f9018f6699671ae5469adedf086cf8b1bd4256bbe9c4e7f6ff05
SHA512 bb8a582a573f1da3545925178f89616cb1652251723f1589a15be929ede18611798283718a42dba57cc41ac4a96b394622ef425ffae32050f54a3eddba2ed15a

memory/1412-737-0x0000010DFD660000-0x0000010DFD6D8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\System.Data.SqlServerCe.dll

MD5 de710d68f76e076e161226836792c025
SHA1 e428220184ec752b7e1318481877139c3713e4be
SHA256 7f30232a69c65bb389ded22bdff2d19ecf6624561b9470757acde80b14e2fe4d
SHA512 66c09bfaf55d69195b5807bb148b5b7199926edfe13eb342a0943545c48c529302a7d56328319db4ca49645bebf64707e6a6cabe3aeeae975ba9206063245fac

memory/1412-735-0x0000010E00880000-0x0000010E00D7A000-memory.dmp

memory/1412-739-0x0000010DFFA10000-0x0000010DFFAB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Newtonsoft.Json.dll

MD5 a6be9efdaa744e9947f4ee18de5423bd
SHA1 258e57ba953cfadf9fdb00c759e8152a6ae7d883
SHA256 6cc0cbcd5c4709c6a1c97f5581c347d93e586e7cc0d64bffb4d32c6e753476a4
SHA512 be94cb3d150a2066db44031ad81921813cb841786fa827fdb36fc09bf06bf48939ee71fffd2d76c5b805b59d6c0f9a3e2dc6927aeaf0b4ac062c92c9205f55b0

memory/1412-744-0x0000010DFFBB0000-0x0000010DFFC4C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.SqlServer.dll

MD5 b9e43b7ac178bf49fc3c7c9de0f6e031
SHA1 4cc846edd69aac12e1889c1062c25eb30b57114f
SHA256 a1bf6c9e3820e83f43e9f20dd7d9b0a3362a93146f0afe0b1330185e2d51b0cb
SHA512 145d229ae1b95861cd573a157bbfa3233e7d6e0b290fb0251101536c45f1d8e3a0d4dd4986e789dc909586682abc6345e0d3f6de6fb9fa2f3b85cebcc797cde4

memory/1412-742-0x0000010DFFAC0000-0x0000010DFFB0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.SqlServerCompact.dll

MD5 3d9c3a57e581ab7726cfad21abbd8d67
SHA1 21315e4fa45081d005272d14b3acbde585d37546
SHA256 f7f2bee4d299130a0fa749a86bf83925799ec2de4e8f8c4f8ff01bbedd53b9b9
SHA512 645d6f83ace042cdd5888dcc45a88b1bcfe5dc4f3dd7359e58fa9de53c8303facae46b4da61cc179d25dc32510d70242be546467fdc99509d306b54a2d8824ea

memory/1412-740-0x0000010DFD4F0000-0x0000010DFD512000-memory.dmp

memory/1412-745-0x0000010D98270000-0x0000010D982EE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AMD64\sqlceme40.dll

MD5 2463b0154dac9ebb5792be48dd9da715
SHA1 111e26d3741d7d6bb7c13186c99e859f65374e86
SHA256 9e4c6c6fc7eee4e1ce25aae114de3434b931202491c50498ab9847e57cc01d80
SHA512 dbe4aafd2bb03986792fb569a8eb5ba2101a9161c20612b455412dfa8d5507d3fdb2b0f5becc4f7874bd4ec8867e5da5ed674f22ec80db66778442a73f0232d7

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AMD64\Microsoft.VC90.CRT\msvcr90.dll

MD5 e4c2344e31d3c577fb2723c961069858
SHA1 572f0281081bbb7a87e491d32b4a29e2447cd75e
SHA256 4546eb9106e86e471caf0870acdd4d1fe34c2ad293f596fd55b82215b922ae14
SHA512 7f35d0f0bf6dcfb44a1cd7e07f95536010690722fd28d587450f158f87be0913f210b06efceb87d63bdaf4dad4ecc09a4cf7397f64c5284a36579a133cfd5ba1

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\sqlceer40EN.dll

MD5 5b95f2033a574e491952daf40f19cdb2
SHA1 b824549e9cd1aaff10cadcc45e7a5ea289c42f8b
SHA256 b55993cd7098a4b107ba75b701dc90596ec2b30c4bee78c6a9bbb48f34ce62ab
SHA512 e68b8f77a3f8c5cb06735543029371d1d4712c2260748c2b219869ba1bad11c3a4538a2b088ce056be621808c499b1023fae05c6add876c0d55d84e7ff7543cd

memory/1412-752-0x0000010DFD520000-0x0000010DFD540000-memory.dmp

memory/1412-753-0x0000010D983D0000-0x0000010D9840A000-memory.dmp

memory/1412-754-0x0000010D98390000-0x0000010D983B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AMD64\sqlcese40.dll

MD5 b9855b76ef9cef229fcd56293e80efa4
SHA1 b605f3351cf7672e060bdf33e3a4519d2cd9c935
SHA256 69902ffb63494cfdea72192073a00755f3afd17be1b5512347a8ca05f16dfdf0
SHA512 4b629173919b3e1e865ff8a8cc9bb57ff746c90be458f5806d8fb55abbaee2fbae9c45463a4a88355f8719c0906b422951533d8f1c67cd3d2bc9370aaf41db2f

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 05aae5eab9fb6aab5d240e8eea1317ca
SHA1 8d189c4bf8865604318b41b0408e893735f6182c
SHA256 594af8445ad7d49c1e888e6ef409a21ce88e7a0295f69e6022ee35dfcd707629
SHA512 4ea0144f0bf376642d1564fd744791028754bb3699c4872b8335c5e41cef049a93b3d737daa910b84a06300263c89e3d07fa24c04a030ab91e0c6af94e74dabb

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\sqlceqp40.dll

MD5 af4e172abb526fa60d76f63bb8c6ed8b
SHA1 18f517803b1aea798813cadac07d2838b6345525
SHA256 7017da640e48baaca2b7fe60081437edbdade883327445633513d4eb6dc0208d
SHA512 ed6e6192dc91fe67a7245273642aede7f1b590271baa5acc7c1333ca1985f910bec31f664d19d02d6f1ee0360ee9f2cdad548bcc27a68fad4fff7e884a62b8c9

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 dbb770c4e1bf4d318344a19017a0a845
SHA1 7ef0d955fa597da91d90599b9a8002e9753d77d0
SHA256 d0bdc7654fbc44738e1eeeea0d756492e39cef009cb90a473476130e3ef934b9
SHA512 ecc0eee32b1e6006c252b101041f4b11b5952195593bc6a0fe885e18208620889ede47202f7446787269f154f04ad4a0d6ef36f289737432df147a0478bb0134

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 79b43064989b9904643b3b6b63254c5e
SHA1 fad366c177559c66d7e61b104d207f5e687d61ff
SHA256 5debb3f6d2ceef38cb94688b0a3a74aff134e04d5fcab6e850b3271988776b46
SHA512 a57b3b93267d12754fb53b79e6953ca8ec03b9615a043ee5823d93a8e9721b3538a30c892e07051546e8c88b52aa0db3ad5e7a9d6a98c5db22666ba868134dd9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 57165318d005715b17169fed18ea41af
SHA1 50d5d4706a81bff25333e58448f5783c27abcc57
SHA256 35d89d9d2d956beb954917a9c844d361255f9e82cfb0bd2ecf2dc4e8cdcc5a8f
SHA512 8c1c48c6ee46bb64bd3bed8f087eb6725c7349cba5b7972e73add2ebb0a2778b101ebd5a9b0a570141759a0372aa82adb8ec16a6d9686870eb6408bc9073f953

memory/1412-839-0x0000010DFFC50000-0x0000010DFFCC6000-memory.dmp

memory/1412-840-0x0000010DFD540000-0x0000010DFD55E000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\517efac85db7042e2b9ae54b76f4e58d_2ebf137a-1b71-487a-a697-945baa2a07f9

MD5 4f786152087be2421780544897125bbc
SHA1 1465783d441a6f6a81911d45a1a37717a67f75e1
SHA256 c7615ebd18ae705138de2779645a691e95be66508896269c01cd075faf8f2ff9
SHA512 5d74be14e8cf3b2b65aaee70c69502a528ae5a0a524bec6122b1ed44a7c1c53f64fe40edbc764908bbae8baffd732967ed1f5cf0ae508f9777ea7fe8a038f118

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 2852d448f2497d63dcf9cc5fae589af8
SHA1 59258e3218575a02689887c057937d186840faa8
SHA256 e1596c9d9d453a7c2e58a53c4d9fe63e72aeac09c66446331c5f510b8996a63f
SHA512 c9c224e85c6e91a5d11088d50600ebacb4e9bd414397c7d23af00f5ce67a82e8c9b64fca039f433d1e4a4841d436a34dc55955e0b2902434519844a396b8dbe8

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 2d4a4354095ba5addfe0b809b3f244b4
SHA1 6693fe523ea075c5d6c21569483d459bad182ca6
SHA256 76af9e333165d96a766c1521e18d5545eedb5d1c2241c3150533f92dea2faf36
SHA512 a10be2dfb774f7b7a763c3b0356b7d34a1e456dbd04a4890d1006ed55dc5104346786cadb9dce284bd36d3803218163e1bccb87811e8d10f7d3415998ac03792

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 f5dbdb6d6069ced4cf57c5d29746f74e
SHA1 228fc91e3daa3a71d8ff3c4ca9d9ff54e038e3dd
SHA256 2daba0d168e6f160200c53679380d4d7fc84dfacc8117502e5f87e08d5a927d5
SHA512 9cba212868460930711de9b56e8aecda5d99d5a0e96d03f2f230a16fbb667ce81eb2244049cd7e09b3ea44b69d293ab6a47ba672a0ac80f7349840a2c99aa5ee

memory/1412-919-0x0000010DFD4D0000-0x0000010DFD4D8000-memory.dmp

memory/1412-920-0x0000010DFD4E0000-0x0000010DFD4E8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 acf98cf23e4822978ee59d7509cad0b1
SHA1 fbd935cf0c547ddd1207bd2e1e059e6393dbc15a
SHA256 19254e12f458c8f4aace52c2c049b99fa2bb1442419aec9070789beb5a906d09
SHA512 1006d0f51325f9ea9a036b172a456d3cde7fa1acf9e5ef16e60664813eca078b32ad9746a1a1b5600d163dbfcc7b691cc5ffbfc4b3d012dc78102723821e141b

memory/1412-926-0x0000010DFD560000-0x0000010DFD568000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 26b4a556528f0431e8c8d19da3b91d8b
SHA1 8005b25ed2f6f840b366b9b3642e2e5a449509ce
SHA256 4d78b7097f8a1ccc52e429b83f2bdc54c14481ee4c6f7ae265ebe7715875028c
SHA512 bfb69c076d198f07542bc9883c8dbe77c1711348bf60153883a49c45996abd1e6ae4bb4b71b955ef0d1360faea0871c2e72bf452f09abfc66cbc137783fe2967

memory/1412-940-0x0000010DFFE60000-0x0000010DFFFE8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 dd97734743ed1a5c69dd6256378617a9
SHA1 c9bfff2ef55ba2ac52212fa96d9dced333025fd4
SHA256 22edc5c8d7b60295605314bea01891687fe6e3a0b56519d3a61018e13cec62bb
SHA512 bb600ef5c4e5d00c28a61ecf6a32c8dd14af25de72d84b40ffb7abf7f3adde91025076c7e769ff9ef9223dccb8824646417e815196444e3e74286ea6b63e1b34

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 a698f2084477eb0fe9fb995517bc4a98
SHA1 0f9d762ae3136f10b3da79dc6dc80da9599293f0
SHA256 3b0118d4a5440fd468a62feabe07f0650075990c286437a5c99727555b88688b
SHA512 df1ba3b6b6747e4ef6d2a829981cd9ad53d223ea50da6ed69d1601592471f5720f4638faa6140d8f8d718c88363cef24ff54e4ee6c7e2a7304091a90510e82af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 c0d60ed1ce7f4f8bf239cb7c8a610dcf
SHA1 d6b9b0605251b25f2ee0273d499c0b4c7897004b
SHA256 c2062c2cdc588626f341fb859084f35d3385ee8b04244716539a55ef6ec93c1c
SHA512 7afe76ed634523cd19a3a9fe4b9e94c41e87e40ccb5e46c7a3b1b3bc96ec2824f6fc42d30851207e0a3261046f53f892ca049154ccc41590bef1f51d6d4eb5bc

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 b13fca8c06aee701af16316ea46e9cea
SHA1 96f4f1af18015a4a92ba0da0a1d7fa46712316e5
SHA256 95605cd9ffdd7122aa64535813bf28125ff60cec66b0ef2a1a2d8f54b78ed666
SHA512 c15b1e59bc9637bb0739821af401cf65436f89925657a31270e51526167cce6635214d1d4227940c78f998945f6b9d88c84092af7446ebddde6a6e6d96b696a6

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 7a77bc88bbfb8d294c51fa35f4b750a2
SHA1 101f945b88285b2b9bdc9f54e83e03374fa129b9
SHA256 bd6ead7bd3d6df3bdef226555f7ba0c48741feec33899cba3b1fb32ba7e962b9
SHA512 ce1d2f85c8c6ce5ecdfdfe68d7eaf6000b85f04068bef0a5b1cdda521a379db4a32d2365806beeb1721ed601f89f5395ca650940aab432f373120d64fbe91cfe

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 197fc6ec7344482935bbb38de930180d
SHA1 80c0181d0761da05de503eaae5b91394fd63a1d8
SHA256 a5fdfc09a6ead2d688c18ed256fa36af881f2bad9f1f051e19352aae2b10c80d
SHA512 de0ba77b2f1208e03db6fd8d0dfbf4c9d518dc3b369b66e3d2e907e69bd65af607ce2bc49b42e6e2638f9401a986e8ac921ef8d5b15a7f8776d3c623224a3b00

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 6e1ff14a81238017144ac131ba70cf9c
SHA1 9ee2db1c07656a6d0979764850df5a5388f725c5
SHA256 5f06512149902dc19e8d49aac7add7d9a272cb73e60e43567067412b192a7f84
SHA512 d1a97f6627f91f16f268ad26ec3d6e92ad5f562c108dc079335ca03f47328a6c266448d7fdbccaef4b1256be4043fc5e7c248d2d1869ac4569fb022167490081

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 ba5a01278c7b5bc7640c9b3ea3605bef
SHA1 19920024f95dc6f44cbced99070d53f9a184430b
SHA256 00a47588dc3f544350b28528fed73c404662f6c56f10ff5b5c5b37d5d9f1e11e
SHA512 9d8412c72eda07a897c4b7084b9c6e258c6adcf2312beca6c4a56e1d6bd9eab58c8b6b0c03a72b395ee0e0a4cbcc826d4593998c7591869961c771cfaf243515

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 081a8a66f14642193b117fcd95e5658b
SHA1 1d5300ae7815cfab85d9858f96334046f745415a
SHA256 2e114647e93368e5bbc0148cec9f6df3349f2ba9bb8e0093bb6c7dcfffb7eb80
SHA512 e7c39a3dd73d52856187be914b1692fdf593d965e7a3af4362936b82c0d10ce69437bf901487893ccba35d400f9d44a11b9bf57c19b71f1b4712036b43d72938

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 69d3ab6863c589bc2d0d1a0cfd039b75
SHA1 89981580ff77e290cbb76f39bfd406d206306ba8
SHA256 e64be2aa32cad5ab13e09b443dd7a280f7c2cf400a2518f7613f33c1e8deb025
SHA512 4bc85f4a971fac70d1296b4aabe3668ee7d8e5d793d040c9c88b727dbf1f6b3a7e121cab7aa1e0ca12ddcc7d73492d3aa25261379c1217c64b1b0735ada913e5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 b60b12e2deac08873f20bb2241a82726
SHA1 d4b937c2e7470e2849024dd2983c577ffde25004
SHA256 ca3bd66eb5b9368a5e1017eee291dd2da64dc0dbc54f1c17cefefc719ad4ef5d
SHA512 eb3af2f289958e4288ef56c71cc690460136adfb8a844e2d63f41c7a9cb7d93d7a461c96c2fd0835dfac72a3468cfdb9eb9f2de8c0a31741fdb304455c9afc3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 cd951aa8e2c82fe05c5d02e918a4aab9
SHA1 e24193bd667f657b3abb280a0ac321a134c0d05a
SHA256 75c4a2eda7fe246bde7dabb1b0c26c0129a4bfa97a0452ad0118214a5fdcec4d
SHA512 14179f9f92ff3b7458ab1f1a64e4f7b3c114e3cfa87354d9dc830e2099e85a03dfec97b608021e4e95c11ebba13bf09bfdd451dc2dc0494b81697425c0ef98ad

memory/3172-1361-0x0000000000400000-0x0000000000E4B000-memory.dmp

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\unhackme.log

MD5 3c54acffe4b0f144d057aebec0a773e2
SHA1 e9a0ab8240803d74df9f5112e38faab74e372cf9
SHA256 4e5741f6b0b163fbdd5f763de536a386e4029a1a4c005d633bf8e87c6f4e436f
SHA512 2f72b854ef1a41bb5bed0794a5ca68d7ced56f08f0069c670f3b57e38de01967e3ea0a840d0ec51a4a57aed41606b2afc446c06f4c36924b8eeb160333e1ade4

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\unhackme.log

MD5 72dd31d5d7590ed46c79a7dcb74f828e
SHA1 acfb710b2839850077beb44af53b96f389016159
SHA256 5b02f2e8c392de2dd281096f77acd9da3b5daabe00684621a438346b8d56e531
SHA512 ce249a87f3b126082d1368f1d37a773690758312be3e10f76add79d058d132992ae26455b3cdf6174eac63cb21ffac9b036b5b776129f41cae06514f5c18d2c9

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\unhackme.log

MD5 5610c88d04b6b27529c698719f985f61
SHA1 b6718726b9f3981e3c9ed5e74350819f85bfcc97
SHA256 eb996042c49fa54cc7fadb5cdd58021533376ba29edf175c5b119ed9ddbd61db
SHA512 2f5883492afd9394b0e14f7e06d3a8ed9bb916d7ccc9bbfa6e907903a0fb3590c56a688749ba39754e9513276042e0b02ae64e2ff11b606f0c076a13f4685b31

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 cc47e4747e5751b6bb436c2bf8654433
SHA1 af84c6a125d715a899cffe50bd22c7e2deb696a5
SHA256 1220f5bf641e1eaab8fa0fbd7ad1166e908b576c423d8bf747252194b10ff27c
SHA512 35e38b8181afabc6431a117ab8a089a4affb9943164d6984f151fbc5d72bcf0fff0ce1c422eefec43fbdd80e08b285b7fc244ce163fc90907744be9518d49c72

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 f57f7a84e5f05cd4a4131db6935dc55a
SHA1 5e8c31879d91a38e49ad08f1fedfa844be4dacb7
SHA256 f4cfa72ce0c22f3638c284ad231738b27f35b87b7a7ef64126a2d9926233c2b9
SHA512 b159dbd14b8da1b5ce47212a7bc22cd2eb1c80077e879e8890f45979f9dab1cfc96c9a5bfa2200bd78da88e328d22f60994d3a3d0cb81c246adea6281f14937f

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 8687757f343cfab46de4c25f5557324f
SHA1 e41256c9f38b4a852c040f599b5c9e4f6431807f
SHA256 60f76cc0c52bf1f380e235d3635b117ad642b9038ca0dbcaeaa55b355cdee544
SHA512 3189facf45641e49bfa1272cefb958ec40dfde45702b237c1833a5faf8d0cd62a8e2dfda1e6028b5df68d5362e7b8b8d02ac7fb3864ccc7230be13b3f87728f0

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 809b73778b1d9bf9fd383bafea931259
SHA1 d9f0fc5b0e7805cf8562cd6afa3da50c999995ea
SHA256 39ccceaf3538701ce74012090871b9c92bfc1655618c93be475722cf8de434c8
SHA512 b886046914ae0666903133673c3690a27bfa0d4cecef8e1158b1f2f17524717bb490feba5223a2dc1fa346ec9cba0a96cd92a36e39116bb1168e24569a774ccf

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 9356058c1a18183009714655db5247b1
SHA1 68b5eb82579e83587665b50a4c266e1ba0e6f3d4
SHA256 4b5464a64c136c073b19bcef950a07d0e1a891bb901fb5c45e7403de8a86cb99
SHA512 405f0afa6fdbd1815a8ead427076fe5f46d672af6136fc0f6ff666bfbc9c2d97669f4c4fc89c16dc6b3be9bacb1ab43f8bf4a36cfe7802b9fadfb1aefee28d63

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 d8158f8474c4fb231b120d85037efb27
SHA1 37917e4e01dd96e0af7f3473f61059642a7336f4
SHA256 d771101999e7fae765a17cf620f7b232955bba2c21bb3b3d47833aba5c0dfdf2
SHA512 e2af9f9bc45ff0e6ce6df6a0159c7e1b229228445cf87de806e23b79be2e87291eacd072ae6f0eb4660eb7ae26e0adac96e44d19f8084af3833d7f12d5f0e39b

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 bf1b11129d6dd15e5a0a07c14be9a224
SHA1 4a7516e12f9debd6048ebceffd34a12e2350a4fe
SHA256 172b6d466c87d47ba6e669cc8c86e156d280686d39e0c60012ee6376b3251efe
SHA512 f1c35875a151dbd45ff2007a254556cf5ce6b16b85b2aa991c5310b6a69d09ff0c9d55563b52415cfd39987d108876e367863ad3433d50619fbf6a6d79ea5a40

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 5d825b7205feab83c4d92bccdb6735ea
SHA1 1293bd8a7241f41763b0db8a86c34935a9e1e27e
SHA256 51fa9272e3aad82ac403532b734861f431b7d8aded8284a2c727166e103bd0d6
SHA512 9bc3b7c86c20d05f34c5a6415a3d52232425f8788e9778bdda7f3de897951a009623d8b6757a0b9260d3acfdd71d672e31f3d760dfc7a2f8977d197696a5acbf

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 d0f0814dc86bafaa86db4bb24479ba01
SHA1 12554db3210b11c5864e5988ce40d48f7e82f1f6
SHA256 9b4444ec8e10a5aa419bec6f4d1323338addc5309a237d1c85f7616d234028e3
SHA512 52950b0bd05ccacb1a197a2a5884578fa1b3a9558de180b6471ef85daf3f341789a6822bcd6cfbcdb76a06f176f81b187a137f568c956797f5cc8ce230fb02ba

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 a0ebdfc5e0dc1c9584b12cc5b047992e
SHA1 6d93cbfed4b3ab42f9559210621da2d6063f3c7c
SHA256 2dd1cec495c0dec3fc047835f895e33cc84fdcbed7777c86b3acad82771a7097
SHA512 608d0f0946f5449b252ad5f57a878431b87a88dae0b0c7fb37021ae4a5131e5adb6fd013d2cf3fee88f5f0861bb3a905f25e6bf06300224b3a1c0c84bf48f581

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 4b5ccf0ceb6ffc2ddc6cd86208ff8a8d
SHA1 dd937fb0c8bc6b0103eabb2e969bbf18e059a2e6
SHA256 f90d0ef5d3b9fd21a9dcfba236e818a12f44d669c72c81e394f69499ba7e30ff
SHA512 7672cfd66bd75c10e0ea45f78eab81a42014021ec8c68beea7e998cedcc6d905618991b947a8ffb4ce09b512448ec6d130b426c2336120edce4638dfaf2bb842

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 92491d47d2f469e07f716057759d5879
SHA1 a0772054433303b727bf2f93d2ec695b3fe0bb8c
SHA256 d05ad68bfc0c9ddcfa2f34f9cf0a4fcfa58b4adcfba63551714c157d94342307
SHA512 0715d5c7de15f6bc46793e962446c0ffc0d414dd00c00709339e8f2cfe05084fe1c0d6d7ffe84c2381da2b607520682d831ceef3a5f95fabe1b23bf8c8a26555

memory/3172-1632-0x0000000000400000-0x0000000000E4B000-memory.dmp

memory/4668-1637-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-1638-0x00000000052E0000-0x000000000531D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GreatisTmp\wu.log

MD5 2f2cbf2e0534312c280eb822877f35d5
SHA1 72daed14653ec5b9151ee48f7aee5cbee76cb086
SHA256 09768c0c9c2a2212ffd7fd3dadb2a3159287ec3f45918ce4bc8a2197d478617f
SHA512 85883c94c677ec7390c954393e9d8b3733e0d1e24103e8af6cf9423bee2987b4fd699821e256c85179efcf22f598fcad13e60fbbbf82799801075cde3accf282

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\dbs.ini

MD5 f80d87797cc79d84b56d0cf0a171dae6
SHA1 1ac7ee9db795cd0c0e6bd00df404c2f41966bbcb
SHA256 20a5a25f74b037b6e3a2966b288320350fce210eee20c56a345c91ddce8b6d9d
SHA512 24ef830e306d51909dfcbc5e98c9b39259dae216709e1ed768e15802246802e059e98f99a2abaed6ce1af7903104632dfae4157c4bc395eaf6796234b96847fc

memory/3172-1672-0x0000000000400000-0x0000000000E4B000-memory.dmp

memory/1072-1677-0x0000000000400000-0x000000000088F000-memory.dmp

memory/4668-1676-0x00000000052E0000-0x000000000531D000-memory.dmp

memory/4668-1675-0x0000000000400000-0x000000000135F000-memory.dmp

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\dbs.zip

MD5 ebf46c652ff1b68e82145e8503bb47ec
SHA1 899a6f2e7a726f6e005ed0363fc3917c2934e542
SHA256 355c191b0c49d592dd409cda1bcffa59cb430b7cdd01f7df948374da0303806d
SHA512 4b65ab9da76eea9d0a7c971c661bd1dbc2a877c52debdb43dbc40c3da77e97c56e051ed88115bb36216bb30e674e57c1ae7401753fa9920a3d53053a84b33db0

memory/1072-1699-0x0000000000400000-0x000000000088F000-memory.dmp

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\dbs.db

MD5 c6470c526b746c0bc54d9b371253ecc0
SHA1 f7f0bf326ecaa10c00b2a75fc76be3c4d48e7019
SHA256 d7e649254ed693f3028b2e4d87e4e9537eac12b4a50ff4c66edf209797ba3812
SHA512 917d5a9749e82a19ec49f3c6d8f82add49300b2da1a81533a8ff757163b7e5ec691814044330344699af8d0d45962d2c2134638ac2f302dbfc191e181ee85705

memory/4668-1705-0x00000000086E0000-0x00000000087A9000-memory.dmp

memory/4668-1739-0x00000000052E0000-0x000000000531D000-memory.dmp

memory/4668-1740-0x00000000086E0000-0x00000000087A9000-memory.dmp

memory/4668-1736-0x0000000000400000-0x000000000135F000-memory.dmp

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 d88a18f17ca42d01919a8aaf386e7bdd
SHA1 ab91a8d6ca55e8dc0421b52e4f09b2b543539737
SHA256 881d901a10282de9396ab1c3211614258a3f8a1bffaac01936dc939639533f77
SHA512 6a09608c28290e0398f37f73b3d84545481e800690d4075801f89bdc14c0cc30954ce52cd07fd1e69be13bac0e543ac95a5cd3b6dbef8c8c46fceaf2a7cdb856

memory/4668-1792-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-1800-0x00000000086E0000-0x00000000087A9000-memory.dmp

memory/3172-1806-0x0000000000400000-0x0000000000E4B000-memory.dmp

memory/4668-1808-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-1812-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-1842-0x00000000086E0000-0x00000000087A9000-memory.dmp

memory/4668-1840-0x0000000000400000-0x000000000135F000-memory.dmp

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 16270d7df5f5dee43ca22fe72dd26310
SHA1 77d9f3962934d6ffc027cbaed699615234bcd72d
SHA256 4beb468d338cdac481e3767e33abe9649b51f5c327dc1f72dbcb1b1ea1cd917b
SHA512 02750cc6e01597621f7a3c728edf5750390cbb5b53319aaa48257ca20cc1818aaa2b509e66074f846abc759f4f4c6ad364e0283322f521d8f5ae75a06f9ec51a

memory/4668-1903-0x00000000086E0000-0x00000000087A9000-memory.dmp

memory/4668-1901-0x0000000000400000-0x000000000135F000-memory.dmp

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 b46544cdd1e1a16d9394b32253df71d1
SHA1 b65ea43ddcacb3ef67dfde3ffeb84c584e9776e6
SHA256 41433407f16a6751ad38f3b449d29fe2867234ecc4a4bc60dc42f12d5bb9927f
SHA512 71fb5c76f9a010367d12809f6865d65470604a91a5390b94d7f19e910fe2c4492a35815dc54814753c4b678eb85bc3f7d7be3431ca9ca359bef3578e8adc5fe8

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 a68e74c53c8e45b4ae0eb34e3709f1e5
SHA1 8b9ea9644b121979a886af8954d93ba99bd33701
SHA256 7ef142cc0b4c78accc69dc97b2a1d88aeaadbcc8a08ae4a564ba73c84d5add6a
SHA512 adaa38dff8fc1750a43bfaf0b0f677e98b0c1706c922c92cec5c62074fe14b3fc613cf8d80a5d83faa2e2a814b1b89918b84fb93611009d06b5c89647f7c9302

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 3f547949b2eed6f3eb6a6ac34f327af8
SHA1 9a0b4ea5e4a281f1bacb7add0c267d5df3c2e02c
SHA256 5c8fdec8ae330378ae522309b20ade48907aacab5733a4d8f7595b8d99c2ee47
SHA512 fa791dbdbde1c060dbc6e83119e4ebd66497eddff978f7b6a4e199ca7bf6b9d2dde15ddf3b5b798064b078dd7dc3a93d5c956f7c49f36b1873f551394bc4049b

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 789b9718ed128811dbe496efb45dcb92
SHA1 cee361b0cd6b0392b2532d407dd1f2878f505b5f
SHA256 2b29d20b7c11c5d9aac79d6cbb32c6b9136a6fa095106cbdb1c752b83fd6ac71
SHA512 806292de3351ec1a88eda8c147cdeb656e8a8c276871fdf9311230cac50251a66370f93e821221d667ae784a8d12090d21fa35a686265ed0d9104e5bab13d51b

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 0cd72bb105197240a292f5676bf8d8b1
SHA1 7e84fc6e11071cd004f67d0e13ba1c3487ef085b
SHA256 292781a5caf41b7df9b35ec41ca60f48fbabe79a74c9411c15a983e3aa4f16b7
SHA512 eab7ae60719b47956401181ef8a058caf5d789b32e61e7c15f2f14ecf3724dd34739ff3bf0b46fb07af5d58b09f1c2f2b91337e72f40851be2031ead64d16ad8

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 fdda79d36ae7f112ff89da1da35abc83
SHA1 c5539c94579e83817b8a977ec4ea54c09cc750f7
SHA256 c37600b31d5ca714101dbefbd0db8ca803c3fe4ae53d28b1c704fb55ae0d8705
SHA512 444530d74c2d696a0e572ce06654849cd8141802dc8cba854b845ee4ab4105709b497ac6ede45fd6e82823c6f999328ab6350569522cec24a033030ac54322fd

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 e71d4dc9ca22f7f2a7141e8cf69f7ee2
SHA1 c3d59d49a9ac20430596850c60b585f782904869
SHA256 cee70dc63ec9c4c73767d89207be833c7cbf06067645bd497bc663f566a9a910
SHA512 bfae8be10da0e2e20f1beca31dd1010a5910537afdd3a9a2ff88930f1cc81aadd27c87eb9bfbd2d9433772a262326cf448dc9ce0ab9d884093c247539809505b

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 3f9a6a3083a683a6deada196de0b225c
SHA1 16673f1d2614ad5047995314076e73af771fe7ff
SHA256 eb1ea99a12566c8497da4849ac5ee8580868cab5588a2160b34858e4d5f81949
SHA512 766f15241216e44589edd371a2649819056cc2f48e9bdbed43269fb8f7cf4b3a8d04531dc11c894e0a9720fdb2fab43a54e0e803de82139a66965057d0280d67

memory/4668-2163-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-2284-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-2288-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-2323-0x0000000000400000-0x000000000135F000-memory.dmp

memory/4668-2345-0x0000000000400000-0x000000000135F000-memory.dmp

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 5ad7cecff778237bd2a65ec2182c4ed5
SHA1 4d6e007dad82f59362f3b0b6adc64b9127a4466b
SHA256 57d3971b498111b05481aeb60bf931d2ed22e7895cf05e76e9cf311b0a278a23
SHA512 b1ba3eb62c44336152cdf3753f8843e071ebabd320cc2d304efec497ed7662be6b6f8eab44e0885e8387271981705d7a91acb378f2e602fa9ec088d86311fd41

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 902d0de690c71d71a8d9d6970b2195f8
SHA1 7de0698918757eae27e7d9f4cfa0cf7ce279f1ab
SHA256 4f35056cee0712382a3bc204df1ef698c1c2adb39fc174526acdb10255567dd9
SHA512 53b785e22eaf3c15de1644ff7bd6a93ce1396b63241ade106e0ce6b7b8fefce0fc9f47cc0737515f2e12a463f83d073715416ab7690772dc067518e10995782d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a3fd5b8163a68528f2972c1f1b5090ae
SHA1 b902fab55ebd1f622410e956d423599598c1917c
SHA256 2a3001978c9d962d8ae3308f7620254dd9d9c06bf6fcf21bf7bcab6d6cf14b95
SHA512 7156d751e932b589e0c4daec53eca45ee4e93c6238f075324b3681a9d105d1414bc61a4562230f684ba4be9004d1c4c8d6b9011a10c96949bafaad98772246d4

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 cbc151891e1a4e450828f57f8f860677
SHA1 ce80208d0ff6be28de57c5ba1443d1bfde68a340
SHA256 767d90a3584c02709edeb7cec8c98cebf7afad99b5ba10ee74b9ce05de5948d3
SHA512 a890958da2af7cb17fb4d3605172cf6dfe51d1cd09c322c8ba63ff8c5beead6b30881773e3b581b31a9a6717108f9166e3d28de1a32bbabd151af7e6495bafc3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 23d38ff87ad6a0366f8e3424a0eb1019
SHA1 c5328ea0512a7bd728163f31d292889502bc51b2
SHA256 273cd3bed44751ee6425dff5624d00f36b532727c576b788221da0206ddd06ca
SHA512 309cffbbe0237736ef8add44f36f007b5d2e31393411256ba0838bbfa46591e3bafb1d76c91ebc7bee3ff2a73e033591df7d1f905a3561e5a65ce30400aab383

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039

MD5 e955953b801c04327c1e96c67dd3c618
SHA1 f9061d3780f153e863478106bf1afd85132bccb0
SHA256 e8965a2d52ef25918ebee58ab6971745d396177a7943acf1ed53a65bb4dddd45
SHA512 6318ff1eb838954dd73dab5ed891d47f4f39089fa5e899d30183c32269c5620bd09d169af4cf8303e3d5c2ebab23cfe9ae5d9fa5c3281023abb009f66a25782a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 19b87105d7b1577a6e8e3dcadcd61c5b
SHA1 fea8181f76a334fea15baa36dda333a48d37331c
SHA256 cf0cf6b543e793a54fb7d37a413849696c8bd54fb11c202b88cf6e906dfddeee
SHA512 9e548c7c37c245007338d5040be8adc7e194ad4240e45623f2ad20b3b88342783dccdbb33ab8678ad2c11334ef9476afefc5c4a0866a7e5f7853287c4f0855ec

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 33340b6faff2f0158889c24a73d14c2d
SHA1 4f642118fd85a186d80fd7af861af3d5ff124f21
SHA256 b49314c5d2dde171c7a76b3ba6adca73f1117f548db201ade627b9dfa7548e0f
SHA512 0af47199becb5e1de25ad5120a8cb68112de8bf5216e48b7cbbc1882e7500d45ed774d32a8bf1cf3d2d5e76fd2630fb7b1f70bb30d2e2c19fe266ed4f4fbe477

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 5019840c605fb82e93148ad48c54920c
SHA1 66f8f257104165021964cbd82c0d1ed37c0da76d
SHA256 8cc9abad8ca8e5ec8043da8d8d12b5ca5a7c40e120ab683d55ec6281f800e271
SHA512 31cfbaffdba26581f1d0b7b8b788b67ca317de71e4b4579249c259144a9fcbb4c09b41053c35915d739c47ae16208daa93eab109b6e4f7ca89f44a1d3ce9cf2d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

MD5 cb962e8e0be0fbc59fa5b09c44533879
SHA1 1858f2a0085fe483ad94f485102fe774f5e1dde0
SHA256 aa876b9319ce76cb2b29e74263a236702028a7def4ab0ebe19bd7b73c7177eed
SHA512 625f8a43709d3da7be6018017c9bf2a0924b211f31191e166cdec192343dfa3ed9d8aea2c1d97b9662d867db8bbd81eb35c6b2adf3b39c7d281632aecdc55621

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe68242f.TMP

MD5 2a4f884f4dc69b9f1fffbc45614c6699
SHA1 6f418d4ac0c448ad469610a9559e7b4c3175c10e
SHA256 35dd1a050a59ba133af81b8418544d08dd8b2bf303be09145df1f53bdeca0053
SHA512 aa2d79c650ec62212729d6e71ac8cfc0064d4dcc86f32463ca79bd1a43fe1185869f5f64caebc8246a5a50c66af611eb8cccbf33309391b62d047d3380cf9529

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 ab9d920aad3f2c0fa19ebbacf35740ef
SHA1 ea1b8c3ca466008591803b9bb556910efdf63cb8
SHA256 42f6f8488bb072714487fe655f1fefe620ea877acd3965a0f326b3e9532fdf44
SHA512 2604eb2f82aa87dad0654a935bf5117e5894fc7ac42d6255bd37c09d796623e0e981f9d275b405fd3b8b9150eb49610cc485bcc8364d54a7eb2d6ba17eb5632a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 a90cdd707f3048a08acf86a97a39a97e
SHA1 6745291b79dfd319541539e2cb14ff309b20eb0c
SHA256 14e037bfaa397b155912b01bdc7f1475aa28ba218653c6f66128daa9b9ea0fe9
SHA512 0b83bf2967bb614c4f8b09d7a4631318e533ef53eb27fad9b199b37a9ee9052f373db4ecb377463dd5438f94710e2d71f7856b19f27c7721f8e74d135ee71fa1

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

MD5 4195ff3dbaafb7a9e8134121ea091982
SHA1 1eef97d6fcf5eaa2bf506afea4a619a8c22a6d2f
SHA256 ddd9b271c82778f54d4bfd95148f273597f2430acaf0bed7526a29a4720693f0
SHA512 9fa5b682d92628fe103e356cf98c2abbd1e6d63feb0fbb8dd654caed7f18bddf06ae107dc63d4229dfe89d9b0c178e2d03c96fb7bec011f7aa2ad6dcb0f7e062

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 eecbf3357803dcaf347be56eac9d8f7e
SHA1 0cd068530b3a0ba616414151bb86913c8c4f2b27
SHA256 2f0fff23dc8a677b2d56722e765ef3599bf05812e4f92401d4909d77ca49fbb1
SHA512 882ccdddfc3b52691aa60c673d090ce9c717563f633193c2f574e855204179774a70b114517116f0073eb1127b175f91a84d2b5f59f7d1af3ba9a7b8b43ee718

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 6707b4989c79bf0ccd2deace11495bd7
SHA1 1ba76dda52a4319b4682d0a4c6a59bafb58d50e0
SHA256 6a36de757fef74e3f2e09d0f7f09f702a1fe10bf0ea93b66b9a0a781eaf9e2a0
SHA512 cc98152e20e6bbc1ba9dedb2216cff5de4135dda953bc33fb59a54023bb82b521dd1b3053a2a468dadccec1609dad38d724ce51749924346daf864494d5cf7f4

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 089e36dd79ab698ea6bc1409f8f04734
SHA1 29d42eeef5a4cf56e14811693c77ddde32030a24
SHA256 4b7fc64d2b2c7e43dd9beebce09f9e16f5dcab34e034b7cc7f2f442b423469f7
SHA512 cc1850049226f3cc51f0cde03ddb395b81b11f865ebf486f975cf4274ae84aebf6bb224ec3356534036cb6d7034b2b71fca350b3165f0c62ddc53be7531c4cfc

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 73004314afd920dce1fb81841f5fc182
SHA1 1b6c74f16b422a4963927f03d11d96ea1264e279
SHA256 7f7fc2bb8d9ede2bb7c398c945bd6b76519830c117c98438a88dc2d5a1a1c088
SHA512 c1f1309ba1073bb876ef72bba98c8fbcd5e523138a0c52ff0ba542f443c06c6dfe83530cfe17ec46943a969d4a47c77ec633b535625be72fb457b55ad90857f9

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 b156c744613e7aba5de76e03669ad5e6
SHA1 fabd53f5b030e545bd08573357623e78579fb0c6
SHA256 ae8efa589a49876347ad78268b185ef0c073d1376da20a6c601ea47b4eddf1a0
SHA512 a3dab0419e6e690671e67dfd80658a3ad63bb9716edc09094e923e832cd1521fb765e36bca45b5ebf11cfc067600c9f6eac40f924b73577e5914d95c2f213633

C:\Users\Admin\AppData\Local\UnHackMe\rr2log.txt

MD5 088c9913d017c2c12779577a250c194e
SHA1 92392d468c15d942443d3de9ef1589728e478c5b
SHA256 1bf77f3fd784aa952f9e82db648ff17cde504fb7a6ab3aaec89cda928458c894
SHA512 bae345e86fdbc833663395da0bd8f2d886ff892df2088f6dc9bf7ed350844f82e82c3d166142185fbc3a60d6909f8a8464cb52651728d39c5164bf35b3eed057

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 8d0bbd7d33a5cbb37f74284889935a7d
SHA1 a329237f50f4a335f1640ce7664cfddbc0b23647
SHA256 eecc2e16482da25583672905f652a3364861823b95bd6b8442dfd20b88f3034a
SHA512 eb70a670c69011d398c8b459b60503761cab51094af5e79789093596fdba8f025f7ffab38e27e6be3af0dc6ee74bbff5bc2651c1f405d568abb5a5f7a5e4059b

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 bc7f5875322706b01835aa5c572863b1
SHA1 b8f1d23ad3b65423513ea1b0eecf0271c92aea7d
SHA256 33915588db50581cde1e9f0fbabf83faeba8c40de3ff250028bba1da6de84f0c
SHA512 1364a88cefe92820c5002cf0fed0a23db4c767ac577bcb8c9b60527679263ea98d98be36cd8fd5e5bf18e14f7c07a6492f3a0b91ab2405700d094c2e7544c22b

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 e3ad0a2af1f53c0f8b3c8d1adbead9bc
SHA1 232a010166edb1cf80e61394eb5999ea18c563ab
SHA256 3e914ae5bb26f6ffd5bcac898c299b3c56dc769f9b865ca805247d029f134b2c
SHA512 2597094a6821f589524ad9b2ffe7e21a4e40eb885d5d528ffa8b35bb717cfe489b9128846f20417469e04abd318232bcea49a28ece8110829f31fa3a2e5208f9

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 df2ac075a625beebc964d535b6f3f8d9
SHA1 b32c62e61c2f3f51035550e3a04893a5c7e19953
SHA256 a236f6b8410c89c1f9aa2a7f79f8acab681db34647d26117221e0c475476f326
SHA512 c73cbaa91810adfb7ad8c68171cc80a5900ed349c37f0c95711aa8dd5f2a39121ef64fbc3b6f0ee7630ca3df6bcc61d02353add93dae610733e056b777a7e6ef

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 40b2a51c04684bc0ab64ca6019e41c32
SHA1 8ea6e62d30c19adc2f6731bbc381574a582f4e11
SHA256 d44752b6717d9330b5dfe348442d23d2d7c8f594e5d69c770a60f0932dc71851
SHA512 edf11b168f32572d62de3af943b2b8f0b39a7e38709891f35edb6ea9cac112978d6ae4dda06c0dd57d64e388fe3c59231750e793cc39b7ff29323b80b736df08

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 bcb2cb7deed6b2218b07a1c0f7873e9b
SHA1 26a41f91f51ee9885e32bab6cabcec9be977e4bb
SHA256 1e8eede950065c83e6446274173122bd589f554ae22304916da2135c8736725f
SHA512 bc7e603ea563c13efb8e2a56927e913ae2e7d2527d253798041ffc11a19e9e8ae1485164bb5b09399de403d360baff7430a306ea793dc9e18ba44071cb60c949

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 a50229da504b03079350f4e95f7c5696
SHA1 e57ae56ea3c13145d6b9d2f2c9c6e42933292993
SHA256 0c31708f88a9fa7060039c0ef420e6c9d0e6d1460254b1d9af8a47d9fa73bc35
SHA512 98699f1250b12a666121c65a5c85594ec834b4505ae17e025cf7d7f47715a9d6764998fa830fc55640d6f28ac58259468a4e236fbe7134463183e500166dceb2

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 32cec6743a6cb4a28c193d2f4ad6cb2f
SHA1 0bdadca2dc993ab7594883d01409ea4d7757abdb
SHA256 ad2691c9225ee7cae5e4990f9c3f013ec58b72e5436af8cadf4c8424d9af6df9
SHA512 1c8c1a8bc69ad5364dd78f519cf2c1e77e3285587852a69a1ef7770f17d1fa72f9e29392525748b43a3f910c41ff8c25ef035fbef1e52090dbcdc5c3b5300881

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 872331407dced14a3c26db0927885283
SHA1 b0ec253a775550c20cba9032d2bfe68e014af2a4
SHA256 6db21bceeeee4189e07162463a881c642afac26cf495567559b55d9d50af6ed8
SHA512 34002ad2718dcbbbf7cd6649a03e4b6532fd49518a6e4ddcf6a7a3003770ae63a971fd56c3db7111673c4657f0e3efa43a98550d3448c0fc2f0573c938280d74

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 95a8e63b8c238c5773d1dc71af5de79c
SHA1 44edce07d2c6f2301f3f40e01bb799b99aecd79b
SHA256 a15d09c55b39c003e902497aaa3d8d84e11b891bf326f8b1e46bb4f4978d1069
SHA512 164cabc319bc8b2e90094bf6225ab4f8b3f6677a462a016ae55611751405e8bbd6737ac2ff89d699c10cc25b0739a28aca584657e5b78c5b6233d0aeccf0c327

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 70235c45739482ec3e800cbe9836fc5c
SHA1 760d9941278b439b0f65aad64bdb0a938fb0b9b8
SHA256 2432d04015403747f4f1269a1298c0a799dbc156f621cf2150afca243bcc5402
SHA512 3df102229cc1c7b75243cc75c4b37ac0beb432b53634e78f66f4adafee00e8922541caf2b5e5273b94ca1762daa4cdb67804053e9be6944ba345d58bc01f597c

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 61781a62e59272fc3683a9b71f6acaa8
SHA1 c1e8d287f5189b392c65fba328ce094b9b6fdc2e
SHA256 468c9d99b0e06b9910369d7b074ff279ae19413bcf27a6973c05cef2825674b2
SHA512 3415b1bd05327afc32ed75245fcec8e643e922612cee810e6d776e7685a5e616a91fec01742ec75ec9701965c0147c1f1472fe97c9bf2978193cd1b57538f67e

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 cf84a5a908096cf641fa1cb2a264e2d1
SHA1 7ee249838050f7e5ff84f95a00c264b322a64fff
SHA256 3b1a0b003c47da16a35624c3ec6523022eb5bb6823b2fbe31e92dbf20f1302c3
SHA512 f6e9634b0cdf1b626f902eb673a14e33b7782bba47d45cfb196f259f37db78a696528fc2b3aae724bebaa8687ecd21db929b337c983b6c5a812366381270f5a2

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 feca39a8c52059b1a43f7ff44ea825fd
SHA1 b709c39e2df483ff242625b397a28542d2e6e9e4
SHA256 f0da3c8b64d43f9ac8574a50a741fecb9f5441b69bf5932d85c9f1dafebcf4f6
SHA512 a591238e582262a6769abff49aad1684fa12906455e720b84a4d24b53b3234a2d04b4e6ca8b3b9cfc6d60fbdf6e270e5bf13d61de2ad5e8d89cc672c5d435da5

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 565eb69aed18d0f9d824da46d7c68ef1
SHA1 c19bb8bd0fbb4fe1d8ceeb720285ebdfd3897437
SHA256 4255f151900beff2eb5e8dafa73e828914cf847ebf75434e12921b3b00fdffa0
SHA512 6465e4ea4b837cfcf89a297c4077580202650f0f4e27e19d81c48c0fa650e9e835405e62a0e9951691724a6f378cdd1166b41574dff4a72fbba7a78fbaa69fb2

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 b808e701ecacc73ee736c96ac121115a
SHA1 b6f93f1dc936bb39b5ff2f82d63f060633028512
SHA256 5d4cee969c29c0fff82c250181368e32d66fba40cbba4a0ca33649727405c5a3
SHA512 994c4d4358932c844945b351aeb0b8282e706e14dd1689a9552156a951aea927c3e68ff2c60e9e6a08f1f20366f4cb87291508cfa54809b9b22e1c17debe74ec

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 3886ebad9df58111b2154ed331575625
SHA1 0929c6ecf0da8b3e281fc8da5616c8a01c0223b2
SHA256 e0369d46d4a2d1ac5c0235c746f2ea0e6b052cdd03866ca8161b934f7079a82a
SHA512 ac34089bd9ef62bdb264da14a951198c6ddc390dd16f113f7bbad723bd1b23add06a090ec014b050a1fd44f0f40c1f9cd0a16c103e0c3bb9ed5d7677a707c99a

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 f51053f822ea3f5a1e214a964b8759b4
SHA1 e261351e5cbcbc271b67e5f6822a122cb1609e69
SHA256 c55a12658bcde18010a7af5ee61e8815a12b310a70c05516897bc8ed8fa7bbb2
SHA512 371218d69c5458b63c4128fb1757a9987d2758183de73e9de0c620d7c079352d17651b0f4379c078d2ed50e79a1bdf5949eaf229c3a86c0d6a3f2e21f038a37f

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\Microsoft.VC90.CRT\README_ENU.txt

MD5 a14f24c16fe9cb910dbd2aea9e14dc32
SHA1 b682064e84334beee3049975e0581a26e05cd4a2
SHA256 89f4a0ff447b833ac81e59c5c653d303377c4264060305808f6ff7f674070fa3
SHA512 eaca2b45801932daf2eb746df4e529f737d961628b578cd759d4074bf3b78a69da25dc9902519da458231ea871910ed6d22123468ebd90c77ce74a8afac84140

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 e3e648e09fecb5adb122bbe614302e07
SHA1 444dcf8683066096f06c754a8a7992b74f3b6c08
SHA256 b0ecadef00012765981e6dea12916a872503548f0bd363e884bc0e4242163f09
SHA512 463d293864673a7c01a3a2ca2916d18204c3cc2455bb53d7b8f50922a422c17007e0dec252805e4464e2c2a118b29757853fe4f639666fe2d6466190a47743b7

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 ec96dcccbf3174180cf02cda4678cd2b
SHA1 983ccb38d4207d6521afc0847db480ae337efc63
SHA256 47d1c9b4f31fd8f8548c9f837bb065a227e4b15c8a528c47e29e9d7465aed340
SHA512 12bd47dcf8b912b3d8b0ac9b3b4cdce82b853585e5c4e8cb2374a8b949fda8094f7049ad7be06a5dc55f2eba1b692cc039e5f436f3063566d35f8a8fedfcf288

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\C36031EA9BFDDE3E7D9F3695FE139DC1.ico

MD5 fc325fe9af020c93e6404a22f081ab7c
SHA1 fa72a728f66255b2b996cf72064aa3b499988564
SHA256 a50702147991c6c110e5454cad76f77a991ea624306f10f871d4ac87871be8cc
SHA512 5cb63232df76782f96307cad53cb03be96d07b633d2e15246db7c8ee7fa298d28c450ed3a89b06657bc3317bbf598c52d42daefccbead734a72be7909d9ee8cc

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.xml

MD5 a4cd6107b5949af9dbefceb181d32261
SHA1 ac293ccd971b946ebef5ca14dadebef727e363a9
SHA256 71106ae99d2b0a98c3d1a73d5a557edf06f149ef679d63de12a1d852cb71b2c4
SHA512 3a65b8195ef7eebe561096b1d2e657ac25122e60f9a1d13051bd2593cc2044aedf84bd133b48169f4561e7cdc485d44a7c17763c8776a9d71ed765efe16fb055

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.SqlServerCompact.xml

MD5 7722c2ee048ced26b956b97570a5e6d3
SHA1 34984befdb6de139af927abe9a10a47af29edccb
SHA256 2c54b1a0e04c55a6152900cc2a5128a108619c7c4f7beb0c10d0e509da4ee7e7
SHA512 805b5aab3e27a894cf9fedfc09b30f756dac431a6ae9c42ce3b673d6e7261fe4f94812c49e98f5f4f827fa1187d3302ecd988494dcaece930e5da87c6789235d

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\EntityFramework.SqlServer.xml

MD5 24202fc18d310d70304865679523e122
SHA1 f3577795f8f17edf8435bf6aed553f06968f36e3
SHA256 772985d6b7588cf78af0865ba64583e4659982870b01ca909e4a11f4e64c5c58
SHA512 dc2c5241bddb9d7965c9b6030ae01a8012279d0f8749f452abc213ea02c4772242b64eefa5f780ebc668560759db631fcd9ae149e530d06d0a5e076e995d9db3

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\buildScript.bat

MD5 f25771c5a6f4b8507abf636cbf91067b
SHA1 6a21c7cb3d54daea9215d240c0fc20c09f4e3021
SHA256 398cb84d4db969cb28220842c20d5ed55bb4c574a4de26f8ab4ce34abe801948
SHA512 b1d01d9ac178d49af59643b0dbc9f9a794b0bf2c889a106e5fbac5f858b1dec1f5aeb982fe4083aaa5dbf4cba503051fb6d2c855c2b5cc72528ccd42c025ef0c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

MD5 a806c2a878ebcaa97f095e204ad23527
SHA1 83eb34d7ced2b9dc71dbb849aa21ea78ec45a78c
SHA256 6b737568e1a12ab56ea091427b691b0fb5391997ebbdc4353c4abdd2786e110b
SHA512 52149492ed4ff37115cb8d16203be2419b692074824ede86647cbc1b9caa46d23e04c9c9d8979e512ee09933d46f69b7b384678e05b74abedb81bb9ab6917263

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

MD5 53213fc8c2cb0d6f77ca6cbd40fff22c
SHA1 d8ba81ed6586825835b76e9d566077466ee41a85
SHA256 03d0776812368478ce60e8160ec3c6938782db1832f5cb53b7842e5840f9dbc5
SHA512 e3ced32a2eabfd0028ec16e62687573d86c0112b2b1d965f1f9d0bb5557cef5fdf5233e87fe73be621a52affe4ce53bedf958558aa899646fa390f4541cf11eb

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Newtonsoft.Json.xml

MD5 bd7c6ace526a1d8ee7ea0b90eefb87bd
SHA1 c6a17d9b2588bc9d3b40ca0b1687c5c94678b8a1
SHA256 919f7b81315558c1c102fae1b6c21363708c3ecedc0a9007f8a25c97bad73c9c
SHA512 ed67b7995a8a3c8d3fb04c8d722b8640e676afa9dc8a15a3d1182a766480689da62b024abb58e4feae484578fde165ae3d303749837f84244ce411eba1e607cd

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Reporting.xml

MD5 b3393a5827609ba8883d5a0737e5c589
SHA1 e6b5cdf179da9d35ffe4eb48c1ee39da8fca6820
SHA256 c8800509bfe780bf580d113bdcd732ac8a48074728dda1cd4750548ddd75608d
SHA512 91796d977966305315f10aa7966415abe10f6b790694cdada4eab2f6284eb8b88ffcedc94087ce2f8f28749647589d891ae01ab4b8b3bee29e34dd5167ca2624

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Extractor.pdb

MD5 511e3d6bff347f0c7aa6142ee17735df
SHA1 ddb48c8ce7b224b5b37d14ab9c05e55852422544
SHA256 29d8c2a58937b1d41c399986e07903def9ee055cb47ce339dbd8d3a41fe94e33
SHA512 d101ff7eb801c441d072db76d885e1391ce4a2b0c772d198d0bf0f9d29b90d0d20e3ed96ecf6817fd10c220119f136274a5de4204bfd4ef0afee47c5c9b698a0

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.DAL.pdb

MD5 b86b34fccd8f76d9499d028a50b39a12
SHA1 178212edd37c24bf362cdab2ec2943d0eb84908c
SHA256 374a6764d3ebcc41dc893bdf7b36ca46ba9fcd8187169174d70a9d5952bdbbb3
SHA512 76b91bf8b033b695997d63ab5fb6aa301663dcecb2bc8fa1e3a5452e2830409953e63f077521fdc5a5e19ee85e88bec9f2d7670e48803ed87f88ab8928fa519a

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.COT.Login.pdb

MD5 7d8e60e2323bedcb37c4720ef38dc802
SHA1 b4df4ef9c6204fc1635e5b737e28a38b841c94cb
SHA256 df181e16b380b8213684ef0745942304b806b2a896035c754efe3a990f9bf24d
SHA512 fa08e700f510c103774956f91b21d241972d28e38557d9d90a1862ce55f4026539029d60aff550c4ef9621f025a01c13d5a9ff04c29d5c8e192ad94416f7180f

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Reporting.pdb

MD5 0621be69509255799b5c375a45565109
SHA1 0feb8b70a0e7720c13daabeeb3aa54d57498759a
SHA256 56c036083dd4b94fa5ed81b5ca233101b05b0621d47bf131563b3fe7b984d57f
SHA512 15be7ecee1a790c8d97097edceb6c8540c05846dde13cd03016dfcc7a677211f360de230433d30e5f2cb5380e9592982fb43c73d4d14bd86178b1403d2986638

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Extractor.exe.config

MD5 a9e07cc45416dbff9943056f01d1e5ec
SHA1 ba72bebe100a5626a31fb01ff52efd8d56d90f3d
SHA256 a3beb5b22c38e768622c7156d428733bc4ac6434a711fb4dc792f2b90a016446
SHA512 2c4746d3f09574625d36db73eaa346d452907a73ec2d574a2386e920ef2b26e1ed7d24583d53fcbec687624f0dc8a0c7fd6fb8691bf46a985e6328d747cc4ded

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.DAL.dll.config

MD5 d1985e3dbab7e9054ea42c328d8918d9
SHA1 222fadb53a15be77a8ff23de4183b36b9b78be2f
SHA256 1061ed6e8c6884e7b5c76dcf29a6066abce04bcc09cc72e3e50b8dc731faed8b
SHA512 df8bedc359835dafa1c09f2fb6e6e07e4704d5b72a453951f603f6024f7deadaae4c6e00058602cc78fbe0758fd321790f4c1d2a8e42fa814fea01ab16985b3b

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Core.dll.config

MD5 37087dce345d62e8d5abd1523aa5de88
SHA1 6dc76c43bc356103c181d0c8d50982789302436e
SHA256 e6036d748d44973566311eba833032d0b3ec1a44d1e59d3a495c99f33305ba61
SHA512 e0d8b5b4f72cfc3c5fe2eba389f52fa6f09be36b06d046010260eb2c2d253cd1b83194cc2ebd15fd229e680ac325a3e444588bc0bed495c030f012898e3d0425

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Common.dll.config

MD5 87ce7c2cd621a9e6afbe3fa17afd939b
SHA1 6beb13a09ad4f352321a563995bd3530204148c4
SHA256 3f45928db6057c3985ffc3223e3a5b3c01d3cd1ea574094a7cbe9052c9f825c3
SHA512 c526aee4b3b760ace39a14f2e39361009ac809bee1cf1470537763a41566d09ecc6d67c56e3e286651f9ba3a9ccd9a71dfb0fa34ff6703a3307fe56b68f70b90

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\cmdapt86.exe

MD5 b1cefaa4a55b73e0bcc5be8d408ffda2
SHA1 24969110a7d157807e3c88add049ac5a2f9773fa
SHA256 6cac0e48787466f544d89ad916d147b90a02bff531f28bba25815b9fa6145786
SHA512 e871cbb13602dc55bf4b0d2a0273505e7c27a36997177230182416b291e5eb9bf0f40352f1127f4132723995aa4f7b95231dba44a536b1a04f53b64011d89c32

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\APTAT.Extractor.exe

MD5 117aeb87a2fbbcab6d1d7a300548c464
SHA1 2536d1e69c0a8b18151852d0fcf1285044970127
SHA256 48dfd3888d4c6c9f7bc9ebf73ed86f9c5b08c65568dc0b38526e7aaea3e8841a
SHA512 0373ad92cb995fc8ecd924451bd846b12a67d168ac9a8ec7eec8176f5674ddddf82fc4bb8f8f275e2058f3e24b52af969dd2eac8b9a66263ba3eb8c190468e04

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\1461FFA3628ADFE447358024B3ECE803.ico

MD5 37d1252c2c10a3f8aba7ed4d1b4737ec
SHA1 c17be4cdd4d9f710f25367bc5c777ab41550f46a
SHA256 f5b9973fbc33d4b94dd7c2e49eb7e70906e59a28e76ad4487b840deade50de2f
SHA512 4709098d23e9b4e70d94925121518fd2f14963e57db4eff6bd29a54605ff8875ceab07d1c876e2fc897a216ce99dc6ac0b522e35db90d9d84186878798600ff5

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\Microsoft.VC90.CRT\msvcr90.dll

MD5 7538050656fe5d63cb4b80349dd1cfe3
SHA1 f825c40fee87cc9952a61c8c34e9f6eee8da742d
SHA256 e16bc9b66642151de612ee045c2810ca6146975015bd9679a354567f56da2099
SHA512 843e22630254d222dfd12166c701f6cd1dca4a8dc216c7a8c9c0ab1afc90189cfa8b6499bbc46408008a1d985394eb8a660b1fa1991059a65c09e8d6481a3af8

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlceca40.dll

MD5 d7176e6944c2c4404af8a7ab35d9c93a
SHA1 66d6c7f67098212fd5ba33e516a3dc9e6fe1730e
SHA256 fc2d651ff0ac080074460a3fd9fdd6088274f0a2131d3970f4b7c882e866e445
SHA512 a15fc9165407d64517d0c8fe43dbcb4e66b9697fe65ae68aa5b6a29f55ddce50e0f4271337c017b93e37c420ac78e2cf0abcf1062ae50dec299567601a18afbf

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\sqlceca40.dll

MD5 659c0b5b0ced4bdd4a85ecbff154c7a8
SHA1 09762a5478a2bc30deed9564f7f07bd9657cf0ef
SHA256 574016cfe70009ae69bb959a510fa2a7607807f04cf9e3d7d940a72b172b5e0b
SHA512 92d9bb08ef151ef82b878041a99d57fa48df449c635bb608bdf3d30239ed541d520df127f6dc7a3a18b9f82a69249e8243ead9a355cf5b62fa91aa42ed84dac5

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlceqp40.dll

MD5 fc5791c1e3b7b78ca6eb69f2a9af713a
SHA1 17d3465759311299308139fab0a201cfbbf1b616
SHA256 e1651f6823a71a361dbfa782186570c1dd6817f1bab28463f8e769af5b7eec40
SHA512 f0da025e4d675ae5ebd05f2272cfe9cd8a1813407314ec6307a28c20420424741e2ec2587fb38ec933aceee1c2bc7af0ef7d4e404e9d63197c6c4d2328c04537

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlceme40.dll

MD5 52aa877f046ca5ba70fd0cd2b4d2b9ea
SHA1 8ba6af731bb41f93adea4d369b0e0fcc9cbc3cea
SHA256 d732dd087ca8d1b06f12886dc1817bb4b6dde5ccbfe1c80e2b6ca2380ee1bd86
SHA512 f6677de8105832692cfdb33a52ab2847e44c83b6bfaaaa8d7ef671618807fc047be4eb87577165d156da55d8121e2bf9523751eed1de02d8892343a33adfae5c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlceer40EN.dll

MD5 52111aa73b19336b45e13619b722da68
SHA1 174ca2f9dd358c5ca409af70d1d92b3854594f01
SHA256 77f877bc71c0cb48845d9df22ea7d3abc06b52956bd352ac35aba3f89c5fefe7
SHA512 dd6b4461add43cbaaf2b5eb779d5bf210a65ec4f5097e1d809cda5fa77401450dd83053b5e9ed9f8a98a5faff1a4bf625dab782558a0c1f0ab36401b426da461

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\amd64\sqlcecompact40.dll

MD5 f17cd1165921937eb5ae4f0814c7b5f6
SHA1 65546a12f3819b4a1d3000aa5c1ae3fb28c2ccde
SHA256 6b67f5d6633bc2a1f19f7b4debcefa6fca3773803098f5bb2a47cedf86fe9bce
SHA512 c1d8455a1e68bbe15e2dff7429fc021df0716bc36ea978987eadc83ecf61f31e8b8804db4d43e20dbe48da0575f3ba1448d135a152dfe56bdfed156b439c0c79

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlcecompact40.dll

MD5 399f220514cb4165788cb97daedfb0ca
SHA1 2c8334674de0ea6faa848ff535d169ecc14fa55f
SHA256 0a18c87437cf7e17d99f2320e39441e769094151375ecc02fb149ec3cdcb90ed
SHA512 78e36f1cbc63cc33881102844d73b5af12c79ca1f2c222427c9c907fe05da909d3b5215b6c2590f957fe065c1c280a2cf037037b9218ba218329fafb639636f6

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\x86\sqlcese40.dll

MD5 969057d94759d19a07aa8bbb2aba1740
SHA1 e16e42c24c732da8657239f5e69ac357710301cd
SHA256 f5557c96b52f8c0f1d374c12bb62981bd8342f224e56ae8688a419731c374173
SHA512 20c75664c449e2b8e7f2e4b890a0e2b3913920bfb380b093b96a5df336f9d40c0e138bc95021b65d9e77bfe1b7ee2bb35719c44d013dd7990b7a14a9098b8d3d

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Reporting.dll

MD5 3f16d24b8df2ad4d03e9515454634aec
SHA1 6ce54fe7188f79b7ab619f44e0ca25681b815d09
SHA256 8ba65871c53ea3f2277585b272ee2628634c0a1f19d06e11792625a4c9f0194f
SHA512 3ae1c4513502eedcaa1341248f5d2c2acd6c2e98671a6cf146e6455d386cb1ce1bc05bf6a3a8405d6eb83816e3af9c617856f6863d56e4b10075a56d5738a324

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Controls.Input.dll

MD5 da6ed879f9d59005266a29cb84a52b3a
SHA1 d8497cae764560f15713716879e24f3beab2ba7b
SHA256 17c64f62f05c28fe3520a0237161762436b8efe1d1d7bc5d4fb149b356a61d21
SHA512 24f8e01ec28e91d0b0e45b586db76519cac85e9fc37617474c0b4c0831f65db48fb1114ec646204cf654a0ea6a8ae16dddf361ce0de539c8a55be880b0e7a01c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Telerik.Windows.Zip.dll

MD5 99e54a027f5b438950d9bcd1728c6b0e
SHA1 b04deb4b4e93866972979cbf2e9024460767d442
SHA256 c3f585408a9fa5d2f3b7fdb5ea9c28aba1cfecc2562da01722a7da2aab55bc3c
SHA512 ef82a5be2ec71d69470da37bcd8f88fdd4ed2193e39d10c0b50c6e0548de1fcda12976b1d7ca28307a9dd05af67ab4e8d0c651cc9ba4b09e8c55dd766a1a5ab0

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\A245AA7C50504B07699446B0D5815C10.ico

MD5 0d6b10714f31ebea009f7378d6e5fe8c
SHA1 2b35b5e3dcfebd813b826df9af79a7cbb3824d88
SHA256 f3dad0c91f26a8aa57b8e6a9d7a7747b9b32eb565da6650fd38a0b883056a907
SHA512 b7491610107bf295937349a85d760bf44e786aa8161e309ce5772feb66d47839fb051087db373079e0b5380eae0477281912443a6c2d93160fd4d1163d109bb3

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\FD38783521CF35387F70874946301AFA.ico

MD5 786dfcd11ca6d9d9df878e934fa76386
SHA1 c20f865a49038395333a9c5c97d72e3aa927da16
SHA256 932a78916f9ec9731890b644454e843fd4ce4280a53e2d6066a1c94f881323b5
SHA512 34ec13ea7e98050941313eacda1fcd6d2144ffba8d3a4d384a4f2d4fd199c6424b27c3cec6fa2cc34b7004ee44329021f6ff1f58f8f6d6681b09bf2dad35c3b3

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\82947DC49FBBFE83A4B3EB4F30E5C8BD.ico

MD5 531c39d1070385b20e673d4fe7d5bb8b
SHA1 bec61d0205e6d80784be510500adda6e28792f9f
SHA256 eaec4e4155c33ec0a302c367248c0f6923a294f3672144f4b3db5810d890bc25
SHA512 52ca01e31492d1419257ed8383c538cbed7d58ba18cfa56d96657203b8314ab5a6c77598adf7b197404260791993feb80a887934bf23128a1922e312588bcb45

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\CBDEDDD52E71078B2C3CFB751E0A0D64.ico

MD5 af80fbb887437fd018864a0749464c19
SHA1 5cb46e321dc7beb17d1fb12e2ef52a19b372ac58
SHA256 bc833cd045c784242f221955acc1352151670014b92547c5e86a3c64a1312419
SHA512 47aa1cf7e59364ec88c540bbbff5a2093c9070a3fc69d3099647fb0d5663f8baf023e152a1a593788a788982df1e600e218734e968c35bdc25f49629af54d61f

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\EF9B54F121C1D2A45E7CEC1841140F5D.ico

MD5 0563fc73f0e40e0619ec99b79c2eb82b
SHA1 3ba8d657049ae379475ef255fae632fc13ffbe6f
SHA256 1b5f5b35198ddcf0ef2d26207a6eb05b155954facfb54f3425451535790e46a0
SHA512 55ce115ff505ecb1372278143f38d81ba49f14a05112a306e1889b9d26829712036ca2cf7754830b605f2c4d68dfeb994674328e4c5ba5e5a02e63e24c14e592

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\00063BB847EDED73D6009BEF93BD2D92.ico

MD5 14d2598ea57ab9775a8ea977f24ba1a5
SHA1 4c049d6adfa9745bd86d83aa7a54c8b38271030c
SHA256 a791349787267992762008e12af86037de1376a98c430496edfd309288fd431b
SHA512 b969c496c2e28b50652bbb8e63a801aaf8cc84b4a6c2704a87d3e0fe9ccbed18358fb6054faa0bc27d9c57ed03432d21d7b7becc9e5e927b95b39577cadc2701

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\3B324857BA92BF8FEA469E902E9C8A8C.ico

MD5 8419a0fe4df2b67967d7a92c86a7a30c
SHA1 7d561376881a8b1e047d86c486ddafcf1172435b
SHA256 29ee8b3d9e072804a7fa8ab0ec73684f798a0168ee1d579b2839300268584dc8
SHA512 d45f00686975ba2bdd7d8d70b153d57e3202d9cf17a9c2686ace8963699521409ba05dd513ddc021949b7619821326165fa9855f662493964c3e7856743261b8

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\88B4796DF6E5B4B684EFA7F86E8114DC.ico

MD5 58f1257c63d403cd90a2fc70f645b3a9
SHA1 de953880afd0f922e825e53f74490ed6933a0ba3
SHA256 22f37a5fde232278d9a6699a21bf39fd9bfd5a4c95d8b8475e6b2d189eda446e
SHA512 b96218c1312b052087f75a9269649c60c12cd1fec86b7e696cd53bc51340bd94bac7b2b3d1ca4749c75d115f182368edc2c804eeffb0516aefa18ad466e7d4f8

memory/380-6249-0x0000013E1C8A0000-0x0000013E1C91E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\59225C6AEB00BD7E0BD97CA813A111DC.ico

MD5 88ff69c3dc333a8a61226d1a32667875
SHA1 c98d4fcda9c100d8ebb5da256836d9393e94454a
SHA256 d8714d0511ff74dc3452e51158edbe2fc020940fbe9898d901fe13d34cab1a92
SHA512 eb01ced74f2b32bbce537c2186f56917f5b6fd1666b8e4d7fa9b8840de9202b806b442ec7fba868d7b9ca250b45b8593ef89780f8ffdf83a59f9555eec8e6639

memory/380-6255-0x0000013E1D1B0000-0x0000013E1D1D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\2621A44147E113F852FB158FEA2E3BD7.ico

MD5 b6f53be6a9d9a74250e19716c233fc6b
SHA1 3064e45c56cf5d809ae8f67524b8c19ad630c9fc
SHA256 9bd6f989e52a9bf20fa5a7211b6ff8965b2878d1d32cc9ee828bb158f2892176
SHA512 d3237ca84cdea629f523f8a2b704d380288a729ea33b93860dc8439650a6c996b2d4a464dd8086a42a67d0225ac9883f15e99f3250dece7ea13b23c2e147e2cf

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\0858E31A035766C6C58F4F661B9370A4.ico

MD5 0f977c0bef4175f89f81f5a14154c2a3
SHA1 ede951dd12a5693e243a9981f39c6005c0788f82
SHA256 dc254b03df443ec712a6c53fb55b3d15650eb02dbcb146e45f69565fac11da01
SHA512 e4161e36fc9adcafe783d2651940f24ce67592018c3c084e4b4b699271f90aaa2aa7bce94e7699dfba6608c144dc756456e27724a76c9c4454723d611bdeeedd

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 db71847678011be3a40116a8fbcf0e79
SHA1 399c4fb80981c2df64967d7f544e004a9a550821
SHA256 99a7bd02433eabdd81b6252f3d37f9555fefd8bed08a38b9ff0a89b70cbc512e
SHA512 07f87c8be602ef9b05036d0055a93e10c576ca0206f37e7d0bbe5db76dc382eef31b4dcb25fad257b2ec02db444ea00a1feff49f7cc8912dfda3302f121a8c62

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 7c7c29c2ac500aef79c802c4b7668158
SHA1 f3637232f80c380105fb4de79220331b77cdb86d
SHA256 2b84fa6faad40ec8f865eb3716adc60fa8619c62588d68e71ed2e7a2499d30a6
SHA512 3534cf2d5acc561e1aae39725e1c2ebd9ff70f58629467fa0fcf732d1e676752d1ecbdb2e8eccddb0f74b06106b109f775ce944a707e5e0c1c36d0f34e17f633

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\D0BA932CD1C38DD844EA3810C04312FB.ico

MD5 1267c4227a86ce8348d6e9fadd2c33f2
SHA1 4549fd6cb410e48cebbe8b84d7667303eb8fdb28
SHA256 c2571d009231ea6acc707d96e32bb6c5e8bdfc80c65fa39f7b3fa68b89ce90b4
SHA512 7aa858bb8bf685dc6af2f54a43bfb47f27ddd16df81bdb40f80c51d66ad6a4612a9a421bd9e7ad69951b3303149b623b2c6dc476d5a7114f47a7715e4b957e50

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\50A9AF2F787DBD5FA034F6502C5AB202.ico

MD5 8bbbf7b3a18b814d2dc6bd9c82fdfbdf
SHA1 241ffdc9342583184b10140cf042f30573141f5a
SHA256 734927c995efb307ac21b1fe8f2cdcd8e641e976d9da10648d1b0a7bfcbf6cfa
SHA512 a06489916c804eae815601512e497f9a66194ca95a1d5a449bd8042dc4392a465b95619f7e6cf7a6415f2a34f33e7929b184a92e7891dc2a0bb7a364000d0ed1

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 c2064d62c524c72f3ece9788a5a163fa
SHA1 cd71fd84b9c45e7261ade6649fec6345fd042497
SHA256 a0bad5cb7bf5c5a17df2e06eb300425c15d6fca5bbed19646458273efbbff98d
SHA512 54763e985b19876b23818d53cf2934f137ef91487d153ad45d2a391f20184fe91ebd5989740e514e84a9793bfa3f39400f791ad47e50671a643b4f190d67ff29

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\F0BC484BEA3A243A26022F9AA686F7B4.ico

MD5 f253ca0909881ee44dc9874a9399f7f9
SHA1 fb00106d1e09924cf08fc201437efe28cf20af63
SHA256 f436366edbe61c84c9780f25cde4ebe22df35751f55cc7d86c1ecc4bf9e66d49
SHA512 5c8232cd8b85c82700993f47b0a5b9e10683dae858980dd21f8cfaa9da7bd8237444ab6a1d5a55e957f84d2f488566de840c990cfe743f6c7c07cc7ed63fc02e

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\C8A2797273D41A5DE2931D6DB1C93366.ico

MD5 6f9321c2c01a95f338462d71c4282210
SHA1 21e0ddb9acf0c1b090bd14429009b1750364912d
SHA256 f9d8f2b14a965b1d4b63a079d22275166142a6b58ddea336a7bb4d4e1675f1de
SHA512 13faaa73806430b5f98fd59e051608e072a4d043cd25220272e081c8170b69514620e237af6c40b937b3a25cdca1e48692398013bba9ecd66ad9ebdb1fb4c365

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 42402f3c2d150f23f7390fca98c21e97
SHA1 249101617e08d0cb6059b1689faad855e45332d5
SHA256 7afbbf01ecab83ec53b8f08079e052839b86d61cc1626b86d7d5995af8c98bba
SHA512 c12dade6af8bf57bac6b5b4f3504d4d754f8b1754af0d3e04fc258d9a31e5d4e86cbbc8c959ec59e432562614d1a94740d6e6b3e4db887ed5f4494c62829ffb9

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 0becfb8cc8128d7eb97d3e29d585f164
SHA1 6c818e4225ca543d4cd8905315a0449d82a60e1c
SHA256 dd46f7841add29f7c6278717a6df5752faf017696ba490636eeeb148c5c8bedb
SHA512 82b785408463fbb501b2e2314501bf7eed9d9ef57840ce76c533dfe402d7ba3ec5868133d8bc281a5bfe1cf5673967cc7a30fb224b2efdb0aed698aae507557a

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 e996e8609ac999df77b6d49c47da3b6b
SHA1 1d3089824471a6591cba2db21009ee897a0a56ce
SHA256 e28f85d8245a5cb7b0cfe61e048e69cb1394e472ff5b5064beb728839cbb5f0b
SHA512 0b0e554ff3dbc63b2ed8f0807da0896b115fc51d6dcbfe0c6e59fbdf5d17b2321c4506fb15988a547340973f4d3d60abd2b638e18acbcaf34cd23c08e990acb6

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 b40a76f7bcc3be74628c96ea5956c59f
SHA1 98bc5c0b3887fbcaf9cf0e6522c7ac7f731b5f98
SHA256 dca6a16e87f209cf33bb0d674fbc1f103f74be64bf1ca74b3e3d1bd1101096c5
SHA512 1281ffedd59bec51e7eb80cb11a8694b3f23df11405143ad4826189698437f0c12b834da966331e22f124be8486322634be4da244baa7f6743684653bca71025

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\20219973590C16D942074AD9B47FC15F.ico

MD5 48869801a3a95c96331e4e6075a15219
SHA1 878accf96d6016ad72d75502ffcf49e7731e32cf
SHA256 af63fe4a7871b851f23bbcf3302c696027eb7cd59aa44b2e61e28607b41c539b
SHA512 04cbf9957b189a063788fe3178b7777f895dd41ccec1297dd8777b7a87d4b22f359ac573d10de79ee597725f9b95b7febdb35b43af8f0090a8507305b0c79d27

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\BBBA222DA7C494050EE4945F65D49CD4.ico

MD5 790417de19979f232a569a9f58ea0146
SHA1 098dba53047b2aea1a5b7315b60216908d7e1d6e
SHA256 0e3a834bda49e7b7cafdfa78fa036678c4c2216ff3be4242ba7cf2bbdb1b2790
SHA512 14681abade3e4fd10a8855f82aec19c8f37f4c4e95662b5dcbfd65285a6f878078c02c8529df652b4291457c003a7b36003122d24db8be07b0f0754104fdbae6

C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

MD5 81e28e27b73e283475d2c3f110989882
SHA1 13d3f880bab0cde2374afd3c8cd680657e0d61fa
SHA256 a26407f4273909fc43690ce4759eb1a46bfe6d6bc0fe6aabba7d61fa9decae01
SHA512 b0f360a89dbb45e5f4655a92a7c953d2435e5816e7cb73d2efa840ab03b83aad2d43feb4fc7cdea0b71147b161ed877bfe645df80ccbe5a05c52dd477f599e53

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\35535C5E8B0657BAAB905E901C628B34.ico

MD5 3a769cba192be85bcde6c5d715803b35
SHA1 2dffee658d7a0feeba1cd428fd14a834acda51fb
SHA256 736c5d0e4b7f4b76d8e010a501d94a007140b6802e614e6aee170c124d1d623c
SHA512 156a2b557b4dd5a17ac2d032cd8855d8cf262563120bcc7e0f2e5212a0547b4f6ca27465cdd59dceee2277354ffa1d22821d0824023695863f74ca20393c7703

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\8F950962972A86A6B86FFFE3616ACB25.ico

MD5 83f5e2ee28aa4f06fe26afbf26fc46d2
SHA1 623bc6d58cb32a1c386f9312ddb120ae9be2e683
SHA256 e8045f75ed323108fd6f9ba54c208b4dcabbff1ca782f9c96e41bca52f8b0aae
SHA512 ddadeae3f8835aefede5cdbb598fe7d368dfed48316be81f66797ec514b184eaa5c02f8291f14c5ddb2f1cfd65cf609ff114bc871b8b12f3b2fc85d74a6853a5

C:\Users\Admin\AppData\Local\Temp\REGRUNICO\B61128515D9B2C0ABCCB7559F15C7713.ico

MD5 d006fac02a92e2778f3d956cb8c1680f
SHA1 e7dac7f18f46b14e2eeb30cc540df1da430e4b67
SHA256 7719a7958026bb61aa82206b9a32cd424b4b620762bdac179cf234583c4415df
SHA512 7a3b0e81ab1e991300ff983c620a2f9e3cbb33d30a5de531b8dda3f85407139d82a013e8da4f365987c4307558e8d744dbbec12229c13d6b666bd1c46eaa56cf

C:\Users\Admin\AppData\Local\Temp\GreatisTmp\regruninfo.log

MD5 f50a64e774aecb92ca67418c076c1c9b
SHA1 81f5c4154d649a8ab84aa3a4a6f7575607baedb1
SHA256 b99efd2bdeca1b1f03a1231529418e2fbe9aaf3fdedf630a9cabc1cb3b5dbbff
SHA512 a2742f7be833d2b34d97602faee18a806320700265e8110834c487e9991fff73340ff5135aa9bc01139efecd6a16423597ad1f413e0cdc6907ae6c23fe83c085

C:\Users\Admin\AppData\Local\Temp\GreatisTmp\regruninfo.log

MD5 6400ec425bb9feaadc543c9232bf95d3
SHA1 efee9608bfeddc2bf5e25c48bf9260d3fa0407c8
SHA256 b9caedddef9d13e26ce04e8f647a49a84bccff5b746e2c132e80852c5edd07e5
SHA512 0cac97a0a33244b8be1c5218c1db475991e11f7ec4f9ad52119bddce533d2ffb126aed9152edfe998d944c06769394649e02703fd1cd248eb171ae9b07607101

C:\Users\Admin\Downloads\Unhackme 16-20240603T141213Z-001\Unhackme 16\reanimator.ini

MD5 3924e1eacbcc34f28d5a52f1c1f9ad80
SHA1 75e8dbc57bdc2d97df4f18cb6c0a7eeaec6080bf
SHA256 55f07bd86521bc7286bba62fe0a572025fe1913312221e43c3e7ea8385ab151f
SHA512 aaf1ff608673f3b4739caa8e3b6a2eb8053d209da0847c703ff9df60241b194087c5f76246c389b526f1ca63495dabbe50337468c939eee143d4430f25c9588a

C:\Users\Admin\AppData\Local\Temp\GreatisTmp\@[email protected]

MD5 004bc502e8a0ab7dddb5c2c67e1cdfee
SHA1 655550c2861180f3b0ba33b92d86c1db0462d0d3
SHA256 f817079ae7de02290eaa218cdf82475ea6fc481a699b37584d44b0ed86abd454
SHA512 c57d17de54e66f3f5a55c58e751bb1453cdba903bd8bcc3ba2c74b4006c595fbab581382b49a163aa0ea674cf2c2b11dd95562da8c469d61342ae669410395c6

C:\Users\Admin\AppData\Local\Temp\GreatisTmp\@[email protected]

MD5 b416d5ac17b5f7601cec4ba4f03538ba
SHA1 587730dc49bf664ca7690d4284d5a1030c118be3
SHA256 6f8335666f34b33cad234d45d75634a1b59298639f7c0c74cf1576e9a4f4e268
SHA512 c877d45e2221b1fa46047a18af150540f6bca859a6f230f2c524d3250e37cd029b4b1b4585a9d59fbd19e435c67cb39c86aec94ad47e2704927e1dd43fa9aab6

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 f1000f239c7123e86a1e512e293b7c87
SHA1 d3990a7d90b4577b816bd76cd019d375fd030930
SHA256 c67b212d3df1cb50b06211b8cf2108f7fd886034f5f27239849751d04819b0bc
SHA512 d500a9611bc41ef25b58a5074bfef2ca59b777c5604f711d42ee1dcffaf53fa81bdae1d5452b625a7022718b5e6a8e918c2af452782bda8a95a464e7dd088365

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 d01c93a821347ecaa156fc8bfa91ed35
SHA1 7be6b54a3b32dc3672624f0988b6dd7f36728bb2
SHA256 fad2aea9bfeb91191eb6e7f425a927ac9e81754468f393a1acc4c10d0687469c
SHA512 18ea05f69deaa81ee62eb7c97f00a1ce0dd2dc1c8a77f365593684a3c56f67693553105b2e75cf4c6721d66e36b3323f9566f71787777627667c6c5ce323f8a5

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 9bfe0b088c3a1b9027670029acdce07d
SHA1 5bdc7fc896d01061b64e3527a9ea7b4ffee37fda
SHA256 a71f8e7d94eb3f98ee74d432657599d304720e5d7c4c8ab0db112b5a811502fc
SHA512 ef48a9801a9c3647011204956ac0bb6615b5d5149a613aa3ce5f550d440b633f5c0a9c5a30e81342607a704a04969d38ebbe3e0c3b42a721e622f05493eb41de

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 5e0ef6b23a60219f3dc8536da1b4d536
SHA1 fc1bec827ba1b0ac5a1f67c9133fe12db1c0cbed
SHA256 12662bd0ceee54dced5dabfbf87a3ad9fc0b047036f04b24780a7fe983e6f6e6
SHA512 75181660d7f75962099685b88fb7d2a697fe08b499798d96607ae77ac8a40a3f4534c09b995c0070d794d5c4b0bc5fc04075a2e2418f62635e09bf1707904d7c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 2b775115a00e48e2fcf678c0969de0dc
SHA1 b7f467e0203c4a25a9fc89dd36b811d0a5570256
SHA256 a79aba734536485a517910082e60b3dc38057fc1184ad47128ba9e2aa0790494
SHA512 18d645082f2f7801493edfba064518061aba01b35262b9921ffa59d8cc7f55a195a6e8e632cb6eccd0a5555975543773593f93a1c620211e283b6ca28283fd3c

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 138942f399714a08b0fc2410d632b6fc
SHA1 83698dbcefdfa0cb771ea9a7849d98cb9c8b5aa3
SHA256 110a35a422e6a2acd77ad1c25aa62e771b72c60145e6391b584073067fd78818
SHA512 fd1118ad2efd2da4df4e24d01e2a6d0e42c97af3d9d145a2279253460f7b3a307be6e17e6092d456c26a2547d655154343916730b916b93185de70ef37570b98

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 2137850cb956ef4ebf7303b45ce23b15
SHA1 036e8bf7f23f4113f581a78d881e5158c57efa27
SHA256 b238e24564d72d1a8507e60a837e5646f73e3777de99f84d0d33bd97dfade768
SHA512 14c8f3f4e021e5f01daa61e0afb987f6a358b35dfe50b92a83cebb1921c2502a7e77217afc4ae7c7d2eff629a5d48c307630c45efdf4e2d846c9951cfcf1a0f2

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 a2c593cd41e765d812c2dd7088a72024
SHA1 d26699dc963bf55bf83c80481407ee55eae86bdc
SHA256 754ccda8dfe0cfd5f19ebb818eaa9449c82e89afe024003001ca9a044358dec5
SHA512 df5f5326814a9eb80580855ec2ae148a9eb388599b59559b96ff09ea408de656d989048a4fcab47a450a018069f48f01765ad1cc84cf44d1b190321a1ba0af44

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\AptDatabase.sdf

MD5 e4350f769a87f08f654909d2a2b06bb5
SHA1 292a13c2a5b6f4c05a00825f048de097c44b3084
SHA256 c14624ea1f93ac708062b10752515c9bf2a9ebd6722ea1cc4642bde06ff13b93
SHA512 3e580c465c145fe52bdcf67ef02c917aeb2e56c12aa1730cfb8d6aa344931dd2d93745fe39d5f2f2c80f9924d6a38c2cdd71ca323a0bd45c83846e9086d6fb40