Analysis Overview
SHA256
225bc68090e356a7581c3b83a4ef8a71444343e3aca4e447063d3b51459e7568
Threat Level: Shows suspicious behavior
The file agnp.scr was found to be: Shows suspicious behavior.
Malicious Activity Summary
Executes dropped EXE
Loads dropped DLL
Checks computer location settings
Sets desktop wallpaper using registry
Drops file in Windows directory
Detects Pyinstaller
Unsigned PE
Enumerates physical storage devices
Suspicious behavior: MapViewOfSection
Modifies registry class
Modifies Internet Explorer settings
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-04 12:06
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-04 12:06
Reported
2024-06-04 12:09
Platform
win10-20240404-en
Max time kernel
133s
Max time network
140s
Command Line
Signatures
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe | N/A |
Loads dropped DLL
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\trololo.jpg" | C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rescache\_merged\3720402701\1568373884.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\1568373884.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\1568373884.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\1568373884.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| File created | C:\Windows\rescache\_merged\3720402701\1568373884.pri | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| File opened for modification | C:\Windows\Debug\ESE.TXT | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\system32\browser_broker.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 30d56cd8dad0da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main\OperationalData = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "716" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{E7736A11-9EBA-41FD-8F18-3C8CE229759C} = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\InProgressFlags = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = b5b0b4b477b6da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000d8f5079f3a1de4210af3ee898d8d20b4186a05326ed0991877a9030365fa80eca073486ce1c3e354149f2ccd05cb040937c48748fb7ede0dcdf3 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Extensible Cache | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer\Main | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Set value (data) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 905ff019aab6da01 | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
| N/A | N/A | C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\agnp.scr
"C:\Users\Admin\AppData\Local\Temp\agnp.scr" /S
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe"
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YOUVE BEEN TROLLED0.txt
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.youtube.com | udp |
| US | 8.8.8.8:53 | i.ibb.co | udp |
| FR | 162.19.58.161:443 | i.ibb.co | tcp |
| US | 8.8.8.8:53 | 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| GB | 216.58.204.78:443 | www.youtube.com | tcp |
| GB | 216.58.204.78:443 | www.youtube.com | tcp |
| US | 8.8.8.8:53 | upgradeapi.PySimpleGUI.com | udp |
| US | 8.8.8.8:53 | 161.58.19.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.204.58.216.in-addr.arpa | udp |
| US | 143.42.125.232:5353 | upgradeapi.PySimpleGUI.com | tcp |
| US | 8.8.8.8:53 | i.ytimg.com | udp |
| GB | 216.58.204.86:443 | i.ytimg.com | tcp |
| GB | 216.58.204.86:443 | i.ytimg.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.125.42.143.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.169.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 202.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.204.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | rr4---sn-5hne6nzs.googlevideo.com | udp |
| NL | 74.125.8.105:443 | rr4---sn-5hne6nzs.googlevideo.com | tcp |
| NL | 74.125.8.105:443 | rr4---sn-5hne6nzs.googlevideo.com | tcp |
| US | 8.8.8.8:53 | 105.8.125.74.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 66.43.201.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.189.173.20:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 20.173.189.20.in-addr.arpa | udp |
| GB | 216.58.204.78:443 | www.youtube.com | tcp |
| GB | 216.58.204.78:443 | www.youtube.com | tcp |
| GB | 216.58.204.86:443 | i.ytimg.com | tcp |
| GB | 216.58.204.86:443 | i.ytimg.com | tcp |
| NL | 74.125.8.105:443 | rr4---sn-5hne6nzs.googlevideo.com | tcp |
| NL | 74.125.8.105:443 | rr4---sn-5hne6nzs.googlevideo.com | tcp |
| US | 8.8.8.8:53 | watson.telemetry.microsoft.com | udp |
| US | 20.189.173.21:443 | watson.telemetry.microsoft.com | tcp |
| US | 8.8.8.8:53 | 99.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 161.19.199.152.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.73.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\RarSFX0\main.exe
| MD5 | 15334f3e1c12a3334ed8ace824af7524 |
| SHA1 | bd97e351d16a7deaae0e43afc1b53d7daefdefef |
| SHA256 | a2d93d96e6fa9208f82865cb44d8a96f928c553d31575cc1ee06e89c5d0dc32d |
| SHA512 | d775585f212c07370c362de7ce4b9b0d5a7f4698cd88a07e3ef38f7dcf84a2cef25996d339513f81246e20ea3b77f75b14a23e344407ac5e79297acb8e0b1f0a |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\ucrtbase.dll
| MD5 | 0e0bac3d1dcc1833eae4e3e4cf83c4ef |
| SHA1 | 4189f4459c54e69c6d3155a82524bda7549a75a6 |
| SHA256 | 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae |
| SHA512 | a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\python311.dll
| MD5 | 34baa8088b479361208b691a87aa5238 |
| SHA1 | 0034f14fbcb1328dd5a65395f47c00c7ef72cbaf |
| SHA256 | 162e8557fbed5f39ae24983ee62b2d435b4796c937d9c1a34371888c7e43af00 |
| SHA512 | 6900da9a20bcefea0c334f07c758fdce991753dd0f65cc5587800c544110343f9beed7bce8b534b8531db009f1824d3e454157d45a1a95e1dff2472572b6edff |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\zlib.dll
| MD5 | d00d9d7b9e0215553c30bb974009356b |
| SHA1 | 4608882531ad0c106732682cbe746d911c38fc9a |
| SHA256 | 54c755e6b90499a5ef49a65ce9472535286fe4db3565a06c4a53f8a4833532dc |
| SHA512 | 8795959cdd8525b449193b90cebe81e8ae7876858a6cc706a255c6d2af5696be92e1dc93ef34551b4888b51c1f5dce920d834ef6ff8f8f4693cd4433e488dc56 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\VCRUNTIME140.dll
| MD5 | 8697c106593e93c11adc34faa483c4a0 |
| SHA1 | cd080c51a97aa288ce6394d6c029c06ccb783790 |
| SHA256 | ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833 |
| SHA512 | 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\_ctypes.pyd
| MD5 | f3ee671a420e2b57afb685b6451b0a3e |
| SHA1 | d9e6e9c09532a485d748213d87adbb9cb00a1fbf |
| SHA256 | 87a96b342caac2988beadc99fbcb0e800111f403e46876f091cd39e03337a7e2 |
| SHA512 | 6fa4f28532eeeb6cec0fd03e271e2b5e75f6e647036ad722f9da0f8d0aeb97df8cb46f8f8c9460e4d65b5ddb4a7178ebfce03bea410e64a1927d5823b1004334 |
\Users\Admin\AppData\Local\Temp\_MEI9922\ffi.dll
| MD5 | 006cc4f6b6fbe03521dc451f4f0a1d28 |
| SHA1 | f04ed6572a304d5a4098e6e354518e4c61d7919f |
| SHA256 | 812eeff28941d7a7f93cd64ec880eb8e773f613536ccba9d3cb1049dd884b027 |
| SHA512 | f0119fc663a0aab7fbfe87519d131ebb539d962b7aa42f82882af29144bb3f1cade8032dedec83d29d3b9da0976e5b3bd8f33a7eae018f1d0ff3fff8b49f3351 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\liblzma.dll
| MD5 | eecb3cc6af726c23b81c5b230688a008 |
| SHA1 | 0db012464de2e8c45c56557d043bf2b6a46e4812 |
| SHA256 | b8f0f02edeba6767ff105c7f36adecdabeea49b78c7e4773cb342e4edc87fa18 |
| SHA512 | dd6582f6bbbe5cae4ea14dddce390661f6868a3f7de28127df8650d78069f2e2ed2d6a966ca58aff175df73cbebc3bcd5ba8458d6748fa27736db80cdb21bba5 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\VCRUNTIME140_1.dll
| MD5 | 21ae0d0cfe9ab13f266ad7cd683296be |
| SHA1 | f13878738f2932c56e07aa3c6325e4e19d64ae9f |
| SHA256 | 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7 |
| SHA512 | 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\unicodedata.pyd
| MD5 | d4444ffbeab12f735fdc89f344a6148a |
| SHA1 | be675da9d5d96b84e843f9ecb36652744b938423 |
| SHA256 | df239e55df1679a6f1412a7ba6d2770dfb5e6893830252477c6121fe08795f67 |
| SHA512 | 5f8c4b99d97231b6904969ded431d4233a8be9042fa10d40c59ea09dd0a093913d5089a2ae8f66a17bd8d6e10a9f17f5b0dcade1aa804da1dd4d664a91b7c2d8 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\tk86t.dll
| MD5 | 4aee94f9acf291d944f15b8c1feba58c |
| SHA1 | 5ca3006d9a907fa5138ada3908658ca449e5aeed |
| SHA256 | 0bd53ea9713d4084e419666dc4320736df9c20272d0b06259473fee5d62aea95 |
| SHA512 | 7a879af57cf99161619dd94715ec8e79bc5f02fbf40597e1580aeb4b4ff9faf6536814016097572f73485301873e430e56eb73cacc5567f30f4f3d8c0ab693d9 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\tcl86t.dll
| MD5 | 7a082e56bab940b82e513db57acf9fba |
| SHA1 | 374c3955209be6c4041cd1a2480cddde9880141d |
| SHA256 | 3bbd1a25b0bb2663da1895506b5a5e8405937e7cdacec3f5ab3aead16b2dd7ae |
| SHA512 | fd4234431a40c2f14c58032c5e6ee95bd6d2ecf84bdd197368186cf130a9faf2b6b26020cd951c6a737dc84f23c6dd3678a3748d6ac75b5fac027aa860694734 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\select.pyd
| MD5 | 60fd923afc273a99d3b908ce4619dfc9 |
| SHA1 | 6b3fc307df5465111935ff8b30791b9cfe887354 |
| SHA256 | 4010f770d4e1a8f60de0dd22a4c6df634817c337a78b44436b87c61338114e35 |
| SHA512 | 2d2a8ab8b86f9e95fb5497bd81bbd0e50165fa33a3ba656fbd886e1a5d30d2f4f8cfd574fbf766ad7e7970cd5af67a621235aa703f403c3da0c6cf67cd9aad7a |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\libssl-3-x64.dll
| MD5 | c536188176426e04b94dd499eb197b2c |
| SHA1 | ddad0333e6b4371ae5d15838a3fd1eeb66bdf7fb |
| SHA256 | 2009b46919fab87bb4fccdb096a727eeaae52533e720b12df44dd21e35a257bd |
| SHA512 | aff8c179bb30e6ecff540e7b67d9c4ed9fde2199ceb9624904980aaee00d59398a2a1b475e3c27896c5f618145e69e3cb80e98cdb2c0e1b891c701d4daf68a9c |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\libcrypto-3-x64.dll
| MD5 | a5fd18aa05ebe4e52db0939faca34bbc |
| SHA1 | 5b7a34493077795f015f21ad186340da6796a1fd |
| SHA256 | 12fb5317d06ec559613dd3ac1d6bf8d392e219c05176fa0d50592dda761921bb |
| SHA512 | 9da478d0f1a19b0177b4104eb886371253fd509fc4c469c2a11da5a7661eb1da33828508805578657ede3517d0f29c1ba88520eb7622651a2583e8a5fedcc46e |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\LIBBZ2.dll
| MD5 | 9ecb733cf14bbff80b005ddb38540497 |
| SHA1 | 2f725f35a6602dc6a70a8339e90721d9e37dadb4 |
| SHA256 | e4ba6a29fe1611815b74da3fd55bd657564edafac7a9907b0819ff8fb091eed5 |
| SHA512 | 1dc0e845b47483faca748efa6ed956570c0d00c5909f3b25200d653b5c42a1f0086426ce1f483af32c36ec83043fa8cfd1577f3823568f9faeafe438f41b9a40 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-utility-l1-1-0.dll
| MD5 | 54f27114eb0fda1588362bb6b5567979 |
| SHA1 | eaa07829d012206ac55fb1af5cc6a35f341d22be |
| SHA256 | 984306a3547be2f48483d68d0466b21dda9db4be304bedc9ffdb953c26cac5a1 |
| SHA512 | 18d2bdce558655f2088918241efdf9297dfe4a14a5d8d9c5be539334ae26a933b35543c9071cedada5a1bb7c2b20238e9d012e64eb5bbf24d0f6b0b726c0329d |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-time-l1-1-0.dll
| MD5 | 6b33b34888ccecca636971fbea5e3de0 |
| SHA1 | ee815a158baacb357d9e074c0755b6f6c286b625 |
| SHA256 | 00ac02d39b7b16406850e02ca4a6101f45d6f7b4397cc9e069f2ce800b8500b9 |
| SHA512 | f52a2141f34f93b45b90eb3bbcdb64871741f2bd5fed22eaaf35e90661e8a59eba7878524e30646206fc73920a188c070a38da9245e888c52d25e36980b35165 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-string-l1-1-0.dll
| MD5 | 96da689947c6e215a009b9c1eca5aec2 |
| SHA1 | 7f389e6f2d6e5beb2a3baf622a0c0ea24bc4de60 |
| SHA256 | 885309eb86dccd8e234ba05e13fe0bf59ab3db388ebfbf6b4fd6162d8e287e82 |
| SHA512 | 8e86fa66a939ff3274c2147463899df575030a575c8f01573c554b760a53b339127d0d967c8cf1d315428e16e470fa1cc9c2150bb40e9b980d4ebf32e226ee89 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-stdio-l1-1-0.dll
| MD5 | 76e0a89c91a28cf7657779d998e679e5 |
| SHA1 | 982b5da1c1f5b9d74af6243885bcba605d54df8c |
| SHA256 | 0189cbd84dea035763a7e52225e0f1a7dcec402734885413add324bffe688577 |
| SHA512 | d75d8798ea3c23b3998e8c3f19d0243a0c3a3262cffd8bcee0f0f0b75f0e990c9ce6644150d458e5702a8aa51b202734f7a9161e795f8121f061139ad2ea454f |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-runtime-l1-1-0.dll
| MD5 | 8b9b0d1c8b0e9d4b576d42c66980977a |
| SHA1 | a19acefa3f95d1b565650fdbc40ef98c793358e9 |
| SHA256 | 371a44ab91614a8c26d159beb872a7b43f569cb5fac8ada99ace98f264a3b503 |
| SHA512 | 4b1c5730a17118b7065fada3b36944fe4e0260f77676b84453ee5042f6f952a51fd99debca835066a6d5a61ba1c5e17247551340dd02d777a44bc1cae84e6b5f |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-process-l1-1-0.dll
| MD5 | 595d79870970565be93db076afbe73b5 |
| SHA1 | ec96f7beeaec14d3b6c437b97b4a18a365534b9b |
| SHA256 | fc50a37acc35345c99344042d7212a4ae88aa52a894cda3dcb9f6db46d852558 |
| SHA512 | 152849840a584737858fc5e15f0d7802786e823a13ec5a9fc30ee032c7681deaf11c93a8cffead82dc5f73f0cd6f517f1e83b56d61d0e770cbb20e1cfff22840 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-math-l1-1-0.dll
| MD5 | 4dd7a61590d07500704e7e775255cb00 |
| SHA1 | 8b35ec4676bd96c2c4508dc5f98ca471b22deed7 |
| SHA256 | a25d0654deb0cea1aef189ba2174d0f13bdf52f098d3a9ec36d15e4bfb30c499 |
| SHA512 | 1086801260624cf395bf971c9fd671abddcd441ccc6a6eac55f277ccfbab752c82cb1709c8140de7b4b977397a31da6c9c8b693ae92264eb23960c8b1e0993bd |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-locale-l1-1-0.dll
| MD5 | ab206f2943977256ca3a59e5961e3a4f |
| SHA1 | 9c1df49a8dbdc8496ac6057f886f5c17b2c39e3e |
| SHA256 | b3b6ee98aca14cf5bc9f3bc7897bc23934bf85fc4bc25b7506fe4cd9a767047a |
| SHA512 | baccc304b091a087b2300c10f6d18be414abb4c1575274c327104aabb5fdf975ba26a86e423fda6befb5d7564effac0c138eb1bad2d2e226131e4963c7aac5bd |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-heap-l1-1-0.dll
| MD5 | f9e20dd3b07766307fccf463ab26e3ca |
| SHA1 | 60b4cf246c5f414fc1cd12f506c41a1043d473ee |
| SHA256 | af47aebe065af2f045a19f20ec7e54a6e73c0c3e9a5108a63095a7232b75381a |
| SHA512 | 13c43eee9c93c9f252087cb397ff2d6b087b1dc92a47ba5493297f080e91b7c39ee5665d6bdc1a80e7320e2b085541fc798a3469b1f249b05dee26bbbb6ab706 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | f0d507de92851a8c0404ac78c383c5cd |
| SHA1 | 78fa03c89ea12ff93fa499c38673039cc2d55d40 |
| SHA256 | 610332203d29ab218359e291401bf091bb1db1a6d7ed98ab9a7a9942384b8e27 |
| SHA512 | a65c9129ee07864f568c651800f6366bca5313ba400814792b5cc9aa769c057f357b5055988c414e88a6cd87186b6746724a43848f96a389a13e347ef5064551 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | c712515d052a385991d30b9c6afc767f |
| SHA1 | 9a4818897251cacb7fe1c6fe1be3e854985186ad |
| SHA256 | f7c6c7ea22edd2f8bd07aa5b33cbce862ef1dcdc2226eb130e0018e02ff91dc1 |
| SHA512 | b7d1e22a169c3869aa7c7c749925a031e8bdd94c2531c6ffe9dae3b3cd9a2ee1409ca26824c4e720be859de3d4b2af637dd60308c023b4774d47afe13284dcd2 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | d53637eab49fe1fe1bd45d12f8e69c1f |
| SHA1 | c84e41fdcc4ca89a76ae683cb390a9b86500d3ca |
| SHA256 | 83678f181f46fe77f8afe08bfc48aebb0b4154ad45b2efe9bfadc907313f6087 |
| SHA512 | 94d43da0e2035220e38e4022c429a9c049d6a355a9cb4695ad4e0e01d6583530917f3b785ea6cd2592fdd7b280b9df95946243e395a60dc58ec0c94627832aeb |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | 6c88d0006cf852f2d8462dfa4e9ca8d1 |
| SHA1 | 49002b58cb0df2ee8d868dec335133cf225657df |
| SHA256 | d5960c7356e8ab97d0ad77738e18c80433da277671a6e89a943c7f7257ff3663 |
| SHA512 | d081843374a43d2e9b33904d4334d49383df04ee7143a8b49600841ece844eff4e8e36b4b5966737ac931ed0350f202270e043f7003bf2748c5418d5e21c2a27 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-util-l1-1-0.dll
| MD5 | a1952875628359a0632be61ba4727684 |
| SHA1 | 1e1a5ab47e4c2b3c32c81690b94954b7612bb493 |
| SHA256 | a41bede183fa1c70318332d6bc54ef13817aeee6d52b3ab408f95fa532b809f1 |
| SHA512 | 3f86180cc085dc8c9f6d3c72f5ccc0f5a0c9048343edaf62239eb4b038799845388898408ed7e8eac5d015a9bc42ff428f74585f64f5d3467dddb1303baf4f03 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | f62b66f451f2daa8410ad62d453fa0a2 |
| SHA1 | 4bf13db65943e708690d6256d7ddd421cc1cc72b |
| SHA256 | 48eb5b52227b6fb5be70cb34009c8da68356b62f3e707db56af957338ba82720 |
| SHA512 | d64c2a72adf40bd451341552e7e6958779de3054b0cf676b876c3ba7b86147aecba051ac08adc0c3bfb2779109f87dca706c43de3ce36e05af0ddee02bbbf419 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | df50047bbd2cf3a4b0cf0567514b464c |
| SHA1 | f20ae25484a1c1b43748a1f0c422f48f092ad2c1 |
| SHA256 | 8310d855398f83cb5b9ca3adeb358da1354557aec5c82c8ef91a29f79a47f620 |
| SHA512 | 5c3bfc2ccb2ee864b99f6709677474327e85889f4c962ea0a1ef9e1e876dc88b1d8e8e0f6c1422f634ff1c84a861c34e52ee07dac7fdde505b508bea80562b9f |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-synch-l1-2-0.dll
| MD5 | 47388f3966e732706054fe3d530ed0dc |
| SHA1 | a9aebbbb73b7b846b051325d7572f2398f5986ee |
| SHA256 | 59c14541107f5f2b94bbf8686efee862d20114bcc9828d279de7bf664d721132 |
| SHA512 | cce1fc5bcf0951b6a76d456249997b427735e874b650e5b50b3d278621bf99e39c4fc7fee081330f20762f797be1b1c048cb057967ec7699c9546657b3e248ee |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-synch-l1-1-0.dll
| MD5 | 6961bf5622ffcd14c16fbfc1296950a4 |
| SHA1 | 5584c189216a17228cca6cd07037aaa9a8603241 |
| SHA256 | 50a1542d16b42ecb3edc1edd0881744171ea52f7155e5269ad39234f0ea691de |
| SHA512 | a4d0c15acbff4e9140ae4264fa24bd4c65fb2d1052a0b37bf281498f3b641fef563c18115511829a23340c9440f547028d36015ba38cbd51ad0744d44d5ccd87 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-string-l1-1-0.dll
| MD5 | b7cbc8d977a00a2574e110b01124ed40 |
| SHA1 | 637e4a9946691f76e6deb69bdc21c210921d6f07 |
| SHA256 | 854db7d2085caacf83d6616761d8bdcbacb54a06c9a9b171b1c1a15e7dc10908 |
| SHA512 | b415ef4092fa62d39941bf529a2032bc8b591c54ed2050ea4730f198899f147539b2c0e97f3c4f14848c71066924c1848ae5f07779a1a47ab4c5e46f02be7258 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | 2166fb99debbb1b0649c4685cf630a4a |
| SHA1 | 24f37d46dfc0ef303ef04abf9956241af55d25c9 |
| SHA256 | cdc4cfebf9cba85b0d3979befdb258c1f2cfcb79edd00da2dfbf389d080e4379 |
| SHA512 | de27d06b1f306110b42d0ed2642a555862d0ade7e56e5f2908e399f140aa5f43904e08d690bcb0d2f4d11d799ec18fa682db048da57d99cd99891e45add86371 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-profile-l1-1-0.dll
| MD5 | 7028cf6b6b609cb0e31abd1f618e42d0 |
| SHA1 | e7e0b18a40a35bd8b0766ac72253de827432e148 |
| SHA256 | 9e98b03a3ca1ebabdceb7ed9c0ceb4912bb68eb68f3e0df17f39c7a55fada31d |
| SHA512 | d035ccfd0de316e64187c18e6e5b36e14f615f872c08740ec22ef2c12d592e37d78ab154202926a56ab01d669eb5870dff651280a882d6bf2a700c43dcd25ac2 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | d699333637db92d319661286df7cc39e |
| SHA1 | 0bffb9ed366853e7019452644d26e8e8f236241b |
| SHA256 | fe760614903e6d46a1be508dccb65cf6929d792a1db2c365fc937f2a8a240504 |
| SHA512 | 6fa9ff0e45f803faf3eb9908e810a492f6f971cb96d58c06f408980ab40cba138b52d853aa0e3c68474053690dfafa1817f4b4c8fb728d613696b6c516fa0f51 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | 5faf9a33bab1d39dd9f820d34339b3d4 |
| SHA1 | 50699041060d14576ed7bacbd44be9af80eb902a |
| SHA256 | a1221836731c7e52c42d5809cc02b17c5ec964601631ec15a84201f423da4ac4 |
| SHA512 | 73c25d1338df9aee5211fbb0e1b14e6bd853e31746c63bc46f44810622b09d52ee39b8e8a57c655da63d3d3d4025c2cba4d8673893d022417a2032ba3d935061 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | f3b4ab35a65a8d938c6b60ad59ba6e7f |
| SHA1 | 2745259f4dbbefbf6b570ee36d224abdb18719bc |
| SHA256 | ea2972fec12305825162ae3e1ae2b6c140e840be0e7ebb51a7a77b7feeda133a |
| SHA512 | a88afb66311494d6c15613c94555ba436cd2f75e11a49a448c9c6776dfba24cda25a44792a1e8b3e680c1ad3ad0574b43ac2328c6e41ff0832139c94b066dbf5 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | a056d4eeaae37deab8333dcc4c910a93 |
| SHA1 | cb59f1fe73c17446eb196fc0dd7d944a0cd9d81f |
| SHA256 | 593fa2aa2474508ad942bbaa0fdc9a1badd81c85b0dff1c43b90a47c23ad5fb7 |
| SHA512 | c2f811994182ef51d0c011c19336179da69357e5f284f787bcdb54f90c32768a959232a477534f7e62cd3d71a048a13e91b20042e2fe6ab108d606c7c8df9255 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-memory-l1-1-0.dll
| MD5 | 6def20ed13972f3c3f08dba8ecf3d6cc |
| SHA1 | 9c03356cf48112563bb845479f40bf27b293e95e |
| SHA256 | c2e887a17875d39099d662a42f58c120b9cc8a799afd87a9e49adf3faddd2b68 |
| SHA512 | 5b4d2b1152bed14108dc58d358b1082e27defd1001d36cd72ec6f030a34d6caf9b01c3c1dd8a9ac66d1937fcf86a6fe3469ac93b1e76d933a8f4b51c1f782f65 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 588bd2a8e0152e0918742c1a69038f1d |
| SHA1 | 9874398548891f6a08fc06437996f84eb7495783 |
| SHA256 | a07cc878ab5595aacd4ab229a6794513f897bd7ad14bcec353793379146b2094 |
| SHA512 | 32ffe64c697f94c4db641ab3e20b0f522cf3eba9863164f1f6271d2f32529250292a16be95f32d852480bd1b59b8b0554c1e7fd7c7a336f56c048f4f56e4d62f |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | 5d5fae1a17961d6ee37637f04fe99b8a |
| SHA1 | 47143a66b4a2e2ba019bf1fd07bcca9cfb8bb117 |
| SHA256 | 8e01eb923fc453f927a7eca1c8aa5643e43b360c76b648088f51b31488970aa0 |
| SHA512 | 9db32ec8416320dcb28f874b4679d2d47a5ae56317fdc9d2d65ebb553f1d6345c3dd0024294a671a694337683dd4e77254595a9cdbfe115c80d0ef53516d46aa |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | 39809cc5dabf769da8871a91a8ed9e69 |
| SHA1 | f779cdef9ded19402aa72958085213d6671ca572 |
| SHA256 | 5cd00ff4731691f81ff528c4b5a2e408548107efc22cc6576048b0fdce3dfbc9 |
| SHA512 | 83a8246839d28378c6f6951d7593dc98b6caa6dbca5fbd023b00b3b1a9eba0597943838c508493533c2de276c4d2f9107d890e1c9a493ee834351cff5dfd2cab |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-heap-l1-1-0.dll
| MD5 | cdc266896e0dbe6c73542f6dec19de23 |
| SHA1 | b4310929ccb82dd3c3a779cab68f1f9f368076f2 |
| SHA256 | 87a5c5475e9c26fabfead6802dac8a62e2807e50e0d18c4bfadcb15ebf5bcbc0 |
| SHA512 | 79a29041699f41938174a6ec9797faf8d6bf7764657d801cb3af15c225f8eab0135d59cfa627bd02dd7459f7b857d62299e4d082586ce690627ebdf1267ebb21 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-handle-l1-1-0.dll
| MD5 | cce27ff9b1e78b61955682788452f785 |
| SHA1 | a2e2a40cea25ea4fd64b8deaf4fbe4a2db94107a |
| SHA256 | 8ee2de377a045c52bbb05087ae3c2f95576edfb0c2767f40b13454f2d9f779de |
| SHA512 | 1fcec1cd70426e3895c48598dfc359839d2b3f2b1e3e94314872a866540353460ec932bf3841e5afe89aa4d6c6fac768e21ae368d68c2bb15f65960f6f5d7d5b |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-file-l2-1-0.dll
| MD5 | bfffa7117fd9b1622c66d949bac3f1d7 |
| SHA1 | 402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2 |
| SHA256 | 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e |
| SHA512 | b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-file-l1-2-0.dll
| MD5 | 49c3ffd47257dbcb67a6be9ee112ba7f |
| SHA1 | 04669214375b25e2dc8a3635484e6eeb206bc4eb |
| SHA256 | 322d963d2a2aefd784e99697c59d494853d69bed8efd4b445f59292930a6b165 |
| SHA512 | bda5e6c669b04aaed89538a982ef430cef389237c6c1d670819a22b2a20bf3c22aef5cb4e73ef7837cbbd89d870693899f97cb538122059c885f4b19b7860a98 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-file-l1-1-0.dll
| MD5 | 241338aef5e2c18c80fb1db07aa8bcdf |
| SHA1 | 9acbeef0ac510c179b319ca69cd5378d0e70504d |
| SHA256 | 56de091efe467fe23cc989c1ee21f3249a1bdb2178b51511e3bd514df12c5ccb |
| SHA512 | b9fd37f01a58594e48fa566c41827b2b9499605d9e55c2178e83ee41c8c5f50a4df2c85efea94ca586ea0ea4a6d984ebb7ca2193e9306fcb853b147b2c76bc2d |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | a5883c68d432f593812ab3b755b808db |
| SHA1 | 51cbb7ba47802dc630c2507750432c55f5979c27 |
| SHA256 | b3715112a7ca4c6cc0efee044bd82444d3267a379e33a3ec118d87e75604204d |
| SHA512 | 27153e29e99a905fa4c8b3ede078644a3a3f29fdf7b98e387e39c5c60444e326c92afd74da8fee225f7ddf39724a0daef68ba238f3cc64fb7860172b8f29d79a |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-debug-l1-1-0.dll
| MD5 | 9476affaac53e6e34405c4001f141805 |
| SHA1 | e7c8a6c29c3158f8b332eea5c33c3b1e044b5f73 |
| SHA256 | 55574f9e80d313048c245acefd21801d0d6c908a8a5049b4c46253efaf420f89 |
| SHA512 | f8e3476a09d888caebd50da0ea2debc4006004e72af677919413655ab4595622cac524f1bc6c13406ee341ae0052a19ed83826ad530f652e73b2c65d4fa65680 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | 16789cc09a417d7deb590fffe4ed02dc |
| SHA1 | 4940d5b92b6b80a40371f8df073bf3eb406f5658 |
| SHA256 | 3b68d7ab0641de6b3e81d209b7c0d3896e4ffa76617bbadd01eb54036cdd1b07 |
| SHA512 | 19e4f086cc2137ee60316b0736b3c6b3780578896df9a826edfe004bb74bee8e051c511a84d8a7ea278a5f47c82b9c955394f629ab0bb0740ecb51293d9be7b7 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\api-ms-win-core-console-l1-1-0.dll
| MD5 | e5912b05988259dad0d6d04c8a17d19b |
| SHA1 | 724f4f91041ad595e365b724a0348c83acf12bbb |
| SHA256 | 9f3608c15c5de2f577a2220ce124b530825717d778f1e3941e536a3ab691f733 |
| SHA512 | c270a622d7887f4c97232ea898f5380459c565817f0d201cdb081ee82e3002b6e6248753a68da896d3b1327f93e8e8cb0ca0dcaeef324f610e0a1c7b542c6492 |
C:\Users\Admin\AppData\Local\Temp\_MEI9922\base_library.zip
| MD5 | 32ede00817b1d74ce945dcd1e8505ad0 |
| SHA1 | 51b5390db339feeed89bffca925896aff49c63fb |
| SHA256 | 4a73d461851b484d213684f0aadf59d537cba6fe7e75497e609d54c9f2ba5d4a |
| SHA512 | a0e070b2ee1347e85f37e9fd589bc8484f206fa9c8f4020de147b815d2041293551e3a14a09a6eb4050cfa1f74843525377e1a99bbdcfb867b61ebddb89f21f7 |
memory/4476-1067-0x00000255A8F20000-0x00000255A8F30000-memory.dmp
memory/4476-1084-0x00000255A9030000-0x00000255A9040000-memory.dmp
memory/4476-1102-0x00000255A62D0000-0x00000255A62D2000-memory.dmp
memory/2636-1111-0x0000022DB7AC0000-0x0000022DB7BC0000-memory.dmp
memory/2636-1112-0x0000022DB7AC0000-0x0000022DB7BC0000-memory.dmp
memory/2636-1113-0x0000022DB7AC0000-0x0000022DB7BC0000-memory.dmp
C:\Users\Admin\Desktop\YOUVE BEEN TROLLED4.txt
| MD5 | 331b0de09f66ed174c0e35a9b2a00a65 |
| SHA1 | 91ec9365a2b7fe30825ff463bc081cad45cdca19 |
| SHA256 | e27fc37b613f40d050e2c3299bf3e69470e3c0a334e8e5fc73fb2e7975b86970 |
| SHA512 | 2539f0bdeb0556a9cba2e3a6e120db6de12db812b84d6ffc35d7e615f6ff76cdc3d1f86b071496ad2b03882d5b94e8cd7aba309462b10fa1cb0bbe52411e4d4e |
memory/4612-1166-0x000001C46C710000-0x000001C46C712000-memory.dmp
memory/4612-1169-0x000001C46C740000-0x000001C46C742000-memory.dmp
memory/4612-1171-0x000001C46C800000-0x000001C46C802000-memory.dmp
memory/4612-1187-0x000001C46D110000-0x000001C46D210000-memory.dmp
memory/4612-1188-0x000001C46D110000-0x000001C46D210000-memory.dmp
memory/4612-1213-0x000001C47D820000-0x000001C47D840000-memory.dmp
memory/2976-2166-0x000001D08DF00000-0x000001D08E000000-memory.dmp
memory/2976-2167-0x000001D08DF00000-0x000001D08E000000-memory.dmp
memory/2976-2180-0x000001D09E240000-0x000001D09E260000-memory.dmp
memory/5276-2186-0x0000023F5ECC0000-0x0000023F5EDC0000-memory.dmp
memory/5276-2184-0x0000023F5ECC0000-0x0000023F5EDC0000-memory.dmp
memory/5276-2195-0x0000023F6F3B0000-0x0000023F6F3B2000-memory.dmp
memory/5276-2191-0x0000023F5EC50000-0x0000023F5EC52000-memory.dmp
memory/5276-2189-0x0000023F5EC30000-0x0000023F5EC32000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E49JWOHD\edgecompatviewlist[1].xml
| MD5 | d4fc49dc14f63895d997fa4940f24378 |
| SHA1 | 3efb1437a7c5e46034147cbbc8db017c69d02c31 |
| SHA256 | 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1 |
| SHA512 | cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a |
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF5878A90BE01580F3.TMP
| MD5 | d3cdb7663712ddb6ef5056c72fe69e86 |
| SHA1 | f08bf69934fb2b9ca0aba287c96abe145a69366c |
| SHA256 | 3e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15 |
| SHA512 | c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812 |
memory/4476-2229-0x00000255A6580000-0x00000255A6582000-memory.dmp
memory/4476-2232-0x00000255A6520000-0x00000255A6521000-memory.dmp
memory/4476-2236-0x00000255A62C0000-0x00000255A62C1000-memory.dmp