5847b365d88f808835e2163945ea4cc39ad39582ec88a3c789ce12704332adf2

Analysis

max time kernel
1466s
max time network
1462s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

battleye_forcer(change to exe).exe
Size

14KB
MD5

11fd16c3fc9ce28b589a3fd6590ac5cf
SHA1

766f464eae4faf18a5bd915854611af15d809a37
SHA256

5847b365d88f808835e2163945ea4cc39ad39582ec88a3c789ce12704332adf2
SHA512

28c342ca640d9479520bf18e04299582e9b3e8975c25913f34fbf5675d215c03b66edd65129da9d751edc3c9261320d5e738f3407bcc92738f2f8bb89cc6848a
SSDEEP

192:9VV1zVZM/6GgGFwqNqnlAlP9meEMOkNPGgS5dgiaAws681vnt3Q5tfMc:N1zejFwuqnhcjC3

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Stealth (1).exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Stealth (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Stealth (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
648	raw.githubusercontent.com
649	raw.githubusercontent.com
650	raw.githubusercontent.com
652	camo.githubusercontent.com
644	raw.githubusercontent.com
645	camo.githubusercontent.com
646	raw.githubusercontent.com
647	raw.githubusercontent.com
651	raw.githubusercontent.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5632	Stealth (1).exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3272 set thread context of 3820	3272	wompwomp.exe	177
PID 3272 set thread context of 5720	3272	wompwomp.exe	179
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 3452	3272	wompwomp.exe	181
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 468	3272	wompwomp.exe	189
PID 3272 set thread context of 2280	3272	wompwomp.exe	191
PID 3272 set thread context of 2280	3272	wompwomp.exe	191
PID 6036 set thread context of 3900	6036	wompwomp.exe	196
PID 6036 set thread context of 1296	6036	wompwomp.exe	198
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200
PID 6036 set thread context of 6076	6036	wompwomp.exe	200

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624722480389611"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\0	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\MRUListEx = 00000000ffffffff	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 78003100000000009a5871641100557365727300640009000400efbe874f7748ca585b2d2e000000c70500000000010000000000000000003a00000000005f472b0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	wompwomp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000000000002000000ffffffff	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\1\0\NodeSlot = "12"	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 19002f433a5c000000000000000000000000000000000000000000	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\0\NodeSlot = "7"	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "13"	wompwomp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\1	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0 = 50003100000000009a58496b100041646d696e003c0009000400efbe9a587164ca585b2d2e0000006de101000000010000000000000000000000000000005915b300410064006d0069006e00000014000000	Saturn Patcher.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\0 = 4e00310000000000ca58b82e10007465737400003a0009000400efbeca58ad2eca58b82e2e000000d2da01000000070000000000000000000000000000000e9af3007400650073007400000014000000	Saturn Patcher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Saturn Patcher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\1 = 56003100000000009a583168100057696e646f777300400009000400efbe874f7748ca585b2d2e00000000060000000001000000000000000000000000000000ca1e7d00570069006e0064006f0077007300000016000000	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	wompwomp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	wompwomp.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 010000000200000000000000ffffffff	wompwomp.exe
Key created	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	wompwomp.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3272	wompwomp.exe
6036	wompwomp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4960	battleye_forcer(change to exe).exe
4960	battleye_forcer(change to exe).exe
4960	battleye_forcer(change to exe).exe
4960	battleye_forcer(change to exe).exe
4960	battleye_forcer(change to exe).exe
4960	battleye_forcer(change to exe).exe
4708	chrome.exe
4708	chrome.exe
1008	chrome.exe
1008	chrome.exe
3468	msedge.exe
3468	msedge.exe
4764	msedge.exe
4764	msedge.exe
856	msedge.exe
856	msedge.exe
2452	msedge.exe
2452	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
1296	Saturn Patcher.exe
3272	wompwomp.exe
6036	wompwomp.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe
Token: SeShutdownPrivilege	4708	chrome.exe
Token: SeCreatePagefilePrivilege	4708	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

pid	Process
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
4708	chrome.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SetWindowsHookEx 36 IoCs

pid	Process
5632	Stealth (1).exe
1296	Saturn Patcher.exe
1296	Saturn Patcher.exe
1296	Saturn Patcher.exe
1296	Saturn Patcher.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
3272	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe
6036	wompwomp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4624	4708	chrome.exe	92
PID 4708 wrote to memory of 4624	4708	chrome.exe	92
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 2732	4708	chrome.exe	93
PID 4708 wrote to memory of 4852	4708	chrome.exe	94
PID 4708 wrote to memory of 4852	4708	chrome.exe	94
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95
PID 4708 wrote to memory of 2384	4708	chrome.exe	95

C:\Users\Admin\AppData\Local\Temp\battleye_forcer(change to exe).exe
"C:\Users\Admin\AppData\Local\Temp\battleye_forcer(change to exe).exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff2c9ab58,0x7ffff2c9ab68,0x7ffff2c9ab78
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3152 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4424 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4572 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4720 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4868 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4764 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2504 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3248 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4660 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5244 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4804 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:6140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3388 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5372 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5512 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5808 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=5720 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1972,i,4403727350537812499,4330716146638371803,131072 /prefetch:8
  2⤵
  PID:5572

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3024

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x2ec
1⤵
PID:828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault213f9c23hbdf9h4644h83a1ha7a8dac3dd2f
1⤵
PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x100,0x12c,0x7fffe0a746f8,0x7fffe0a74708,0x7fffe0a74718
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,7865157311162353400,10500567058182663680,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,7865157311162353400,10500567058182663680,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,7865157311162353400,10500567058182663680,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault1bce4fddhdc6bh49bfh881bh0d25644928e7
1⤵
PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xd4,0x128,0x7fffe0a746f8,0x7fffe0a74708,0x7fffe0a74718
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,10922506791751687265,2644091833313908009,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,10922506791751687265,2644091833313908009,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,10922506791751687265,2644091833313908009,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2980 /prefetch:8
  2⤵
  PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4084

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1096

C:\Users\Admin\Desktop\test\test\Stealth (1).exe
"C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5632
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\test\test\Stealth (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  PID:5684
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\Desktop\test\test\Stealth (1).exe" MD5
    3⤵
    PID:5808
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:5892
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2152

C:\Users\Admin\Desktop\test\test\Saturn Patcher.exe
"C:\Users\Admin\Desktop\test\test\Saturn Patcher.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1296
- C:\program files (x86)\microsoft\edge\application\msedge.exe
  "C:\program files (x86)\microsoft\edge\application\msedge.exe" https://github.com/paysonism
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2452
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\program files (x86)\microsoft\edge\application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffe0a746f8,0x7fffe0a74708,0x7fffe0a74718
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4440
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9589128681409272599,5066679604578862421,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:5356
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9589128681409272599,5066679604578862421,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:856
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9589128681409272599,5066679604578862421,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:3644
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --field-trial-handle=2116,9589128681409272599,5066679604578862421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:5424
- - C:\program files (x86)\microsoft\edge\application\msedge.exe
    "C:\program files (x86)\microsoft\edge\application\msedge.exe" --type=renderer --field-trial-handle=2116,9589128681409272599,5066679604578862421,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4620

C:\Users\Admin\Downloads\Cracking Tools\Cracking Tools\UD\x64\wompwomp.exe
"C:\Users\Admin\Downloads\Cracking Tools\Cracking Tools\UD\x64\wompwomp.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3272
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:3820
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:5720
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:3452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\test\test\Stealth (1).exe" MD5 | find /i /v "md5" | find /i /v "certutil"
    3⤵
    PID:5316
  - - C:\Windows\system32\certutil.exe
      certutil -hashfile "C:\Users\Admin\Desktop\test\test\Stealth (1).exe" MD5
      4⤵
      PID:5024
  - - C:\Windows\system32\find.exe
      find /i /v "md5"
      4⤵
      PID:2548
  - - C:\Windows\system32\find.exe
      find /i /v "certutil"
      4⤵
      PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5692
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:468
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:2280
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  PID:4432

C:\Users\Admin\Downloads\Cracking Tools\Cracking Tools\UD\x64\wompwomp.exe
"C:\Users\Admin\Downloads\Cracking Tools\Cracking Tools\UD\x64\wompwomp.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6036
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:3900
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:1296
- C:\Users\Admin\Desktop\test\test\Stealth (1).exe
  "C:\Users\Admin\Desktop\test\test\Stealth (1).exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  PID:6076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\KeyAuth\Debug\Stealth (1)\06-10-2024.txt

Filesize
885B

MD5
59368978b4618414bfa7f6e565d13498

SHA1
2e6f88fa3de9dc48fc1b648358ccfbb79d28cf77

SHA256
45103c1e9565030bfc75e19bbd9339976bc55b28f3012a9f5f98de4a52475322

SHA512
a9cab56142f836271f8a45a7087341e433c1d56d2812292b798854c6753b8466d56dc4356fea5a52f11d12c583ec72322edcd4d1440f60ccb21695441e90af13

Download Submit
C:\Users\Admin\AppData\Local\DeFconX\Saturn_Patcher.exe_Url_guinkmhud1inxchqbzykyaxf52nrtnsp\1.9.0.0\user.config

Filesize
867B

MD5
cfe15bef5d6b261c559d2dd30f433a67

SHA1
9939f6d31b5d599363b1f238a28aa15e88ff90d1

SHA256
950e889c974a0865064dd5ee0935cce056d9444aca56c57e600db036d8292b91

SHA512
4a05dce39c81aa257bc48cc88995a61a977dca5bec1b8c913c90ce1ea0d114f4e244aec76c7d47a9146624092d4539010f6a384cb5b544582a47492c18e91d88

Download Submit
C:\Users\Admin\AppData\Local\DeFconX\Saturn_Patcher.exe_Url_guinkmhud1inxchqbzykyaxf52nrtnsp\1.9.0.0\user.config

Filesize
1KB

MD5
f569c56b2ab388bed9dd83e1515176d6

SHA1
1bf463fd8de4e083f75925c6cdca66fe9c0784f5

SHA256
be76e134e9a6773b0e06922c3e773550a02fb8050542bb4413b2e9cd532c79c1

SHA512
7faf87d6a580b814fc2514d55f525415397ec445b5056d9f73dd3d796211205f058c8b91e01023ecf2eb8d102b7d493c2ab0219e636f23994c3fe029f99121f0

Download Submit
C:\Users\Admin\AppData\Local\DeFconX\Saturn_Patcher.exe_Url_guinkmhud1inxchqbzykyaxf52nrtnsp\1.9.0.0\user.config

Filesize
1KB

MD5
fd368acc7af684310e4b7c31f7e799b8

SHA1
1aa3daa5e2921dbe3690fa872dd70c2492e9eb7a

SHA256
337fa5799162c6366af53981f3d4f9afc590269a38e5b64a529f8ee77a138bb2

SHA512
592454434269966b0fcc13c63f8a665549a72c81941b134dc176e3eed194968a20c41058e805ddd5bad92799083d9f730d22419fb152a193a12ebad9b7c0ddf7

Download Submit
C:\Users\Admin\AppData\Local\DeFconX\Saturn_Patcher.exe_Url_guinkmhud1inxchqbzykyaxf52nrtnsp\1.9.0.0\ztbu0sxl.newcfg

Filesize
1KB

MD5
6399b11904c147bd8c1aa61da61bd6a2

SHA1
dff5ecc44ec17b9521053b20e33d94529b665b56

SHA256
1e0faa995ab9455d18627ddd868bc9a17e45dbf2b3d0abab41b4e17530c9134c

SHA512
6dd1ef0c577ace9926b9227bb4d67a183a793430bf8858093e572907aea4eec2077f2274f86e127b046d84741513d4f9c7c6f0a92f3ee9cbf456404ef2ba69f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

Filesize
21KB

MD5
b1dfa46eee24480e9211c9ef246bbb93

SHA1
80437c519fac962873a5768f958c1c350766da15

SHA256
fc79a40b2172a04a5c2fe0d5111ebeb401b9a84ce80c6e9e5b96c9c73c9b0398

SHA512
44aefedf8a4c0c8cbc43c1260dc2bbc4605f83a189b6ef50e99058f54a58b61eb88af3f08164671bad4bd9c5e3b97b755f2fa433490bef56aa15cdf37fb412b6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c

Filesize
36KB

MD5
f90ac636cd679507433ab8e543c25de5

SHA1
3a8fe361c68f13c01b09453b8b359722df659b84

SHA256
5b4c63b2790a8f63c12368f11215a4ffec30c142371a819a81180a32baeb2bce

SHA512
7641a3610ad6516c9ecd0d5f4e5fa1893c7c60ca3ba8ae2e1b3b0cc3a72f7f9bef4c776a1f2fc52f366bd28a419ae3594a6576e886e79a20ebd98b55b2acc967

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002d

Filesize
17KB

MD5
950eca48e414acbe2c3b5d046dcb8521

SHA1
1731f264e979f18cdf08c405c7b7d32789a6fb59

SHA256
c0bbe530abfce19e06697bc4358eb426e076ccdb9113e22df4a6f32085da67a2

SHA512
27e55525ade4d099a6881011f6e2e0d5d3a9ca7181f4f014dc231d40b3b1907d0d437b0c44d336c25dd7b73209cd773b8563675ac260c43c7752e2d2d694d4d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
fcb7540af4ddc38a63d727a8815281c4

SHA1
efb85af45bf6dcf74df47e39a3229dfcab7d9c8c

SHA256
bf3b7c2fad56ef425359934265110e232a64eda03b9a1a469c8e1ada51306606

SHA512
31e483b015072bd1b3d63b7af75989ec8ae90fcf324d57d7331e22ac106ad16f3b554181075a6f4322685d2062810669618792c474eeb9dafbf6ccb6b4aabfc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
54975f58235c1b3137408583a05ffd18

SHA1
ac72447253cf73b9eee8e1b66a318e11074ae941

SHA256
e9cf369cab9689780f0e6d57bbd415391688f40692eb74a0eb3d65c2aa11e411

SHA512
d2f151fd5c8b9e57301a8822119e698da72f3e5804b48da6ff73b232685be12f11b330ac5e2717fb5da2b3d695b0daa33cbe1ea96b1f65b0b736ddccab77ecfc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\p\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
f0749e51064bdf14262c14070ad124a7

SHA1
8515a34fb2efa96f87c30694574e3dcb27e72573

SHA256
a2a7d8712bfa7afe59dfd608aea47987bab7c9219869fe04d5cd93d550f4263f

SHA512
770b8a73964f4dbee1068080d34ca68fa5ca8ad886e6856dda09d639fcf0d9e85c7edae1077e3255438995f6be9c145c10322f14d16e60e2d9b70d9e91577e79

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
158e53127da7f684f046976f3af0a9c8

SHA1
d13f3d47db3e301fe95b4a807c28df755ccc9fbb

SHA256
452cea7c3638ad7750eaf1672e6458a763491b128a2f264408343203573abf9d

SHA512
ff4bb58c743c19ea29da46f9d0ff9ec5be543d88a1484e55432acc2c835101d650d2a63f37e025020e22921d4bf513c0d599ddd1fe5e4605fdf6a7538e1671b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
feac56f0d9d8eb90890ad4ba3892bfb6

SHA1
53f0df54ee2ed4629f779516d10a9c3d1be92594

SHA256
52c2c6470f2353e7e68d342042b617976140d22b3cb0745b92813dd285d6e215

SHA512
d46e7aa4b3385cca153da43660a8fbbb4e4b67e47b4db04ce3dcfa1ba6e3d95ea309133cc856cc8089ad87fc2ca4b4ce987475e9db7611df617b9f5c9cce74af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
99598ef6a0ecdafac00aaca4da2287c3

SHA1
36d56f6a07a73623fbab1f74deafe7b2a122c917

SHA256
730ed591f40941c792cb45fbcf38ddd8c5892784c4bd5c8d3371a9af1372a9c7

SHA512
f525b98f02a30efd958ae840317436d5710370f2f61c068bf2bb2eacee5ea304e489c045755e937f790fb2971dca6154d13bc6c6fa5cd878977072821fd69e06

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
24faa613823905469643e0801d178678

SHA1
a1170a66dc72d53ef61cbd49b43d814849e5b805

SHA256
fd170bb81646d1bb20559ab6ee5fbbf12efbf30711695015e00d34bdbd2b0abe

SHA512
43b636fd8463f87c9e19449df8c14a9eab6636e0793d9476e6788cfc18e4bce110063401b072e180d9036f679e12654f4258282787954aa006b9132e176b32eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
db3b0a51c2e882a97ab30f9b116cad2d

SHA1
290854dd81afcc0498b9f085abe1d63105789aec

SHA256
0d52a23a04eefcac75a9c690f7d913f1832e1e3df67a6d2360b3d48186adbdbf

SHA512
46c7d68cfdbafe120a7ea130c2ccb829b8835e06c6fea0b1a2b947eb5b326863e940a0b7f42bac55898b3fa0aeb5ee289f5adbfc65404b04e3d94c8461a91cf8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
521B

MD5
c18c5d73ba4689705ec75fbe7933b845

SHA1
bdf9f1033be7f73dfe022676dfe2bd391a516524

SHA256
d1a75d0979ca0fa6a4a822bc88c0d1c4d0cf3b5c09286e6e2d39f7367961fd28

SHA512
9e12b313865efdab4754c612e7f0b29ef3c72db36d366aa1d333a4b34d9124392ce6ee622b18f07a98fc8437991f090ff41fa5acc26059fb76d58cc0fe752095

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
6d2b2544beb57bad9cf4b52fbfae9dce

SHA1
ff94783f14e89081dc041e6a6437de5dc2f97c58

SHA256
784d097582f10ba1d1b861f769a8ee0885f7df3784a8e71c9d9ab2b3e9d5b263

SHA512
58da3b2e52c6b309ca785b0c5b76e03a5aa268662c5b806a424cb29948408f0ff41e77c33f64aa86ecafcb547453c918176682e020cb57e78aa506ca9b4b24e9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
59fcc594c9d1f6ef31e9b5a3a8389226

SHA1
6cc037f12ee8c94cd4387cb930275b6043328c65

SHA256
78394ec0cad9ad5d5cd8b9c10bb0b1a5c968cf2ef36ce656964db1f225fc0415

SHA512
7e4ffc29ada98d1cecf18e3e719a77f25ac31e43e4b4121bfe9c56b14b398ddd934a04572daf5181864e24216ee6da74eef1ac0229c47e5a486575fca5cb2072

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7a621a7ca14190da90dd56a313c054ea

SHA1
80756609d89e5fd35351dcd1e194b5ab240e8bee

SHA256
518e52f0b11af0104efdb52c8540163651c3b89c4b6d72452d03140b6dac102b

SHA512
fdac421d457a8fd78419dc71281d6a1bb5ae66ea2d20a17f3af37e9ddf34b951ba019d35acd5b640ad7dcf78b9ef80bffd126a5f17832500ed2a26960ff45e41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
6fce86c3daa69ba06b06be411d497b0b

SHA1
84d632e8d893e40220238b6db9c0b169d9f5c141

SHA256
b95b8c61e9208617aee46901d0f41d464baa753ae9c6dc48f79ae73f07af75e0

SHA512
4cf8121acf5e2a8ca17b7a62ac586fb6b960048816d96fbe7ee92afd30df8b2d947bad93c7ece7c78ce1cb86a58aadf78d60d554e31d76cc08734ca823c3b494

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
aec27b0d0018075e86831bb05e9768c1

SHA1
c869e55a0e1c4ed2fb19c78a88fe36e2e5f66ae0

SHA256
d96801d400fa4d75302bb259437221c49c7c105be1eedf288527fb578a9e02b6

SHA512
54819bcb1fb7ab8c500b98c059d05573ae9e006a04420b790aa4bd3051b57041ff8d8f612d9ab694212c6e0b84f73b86f6f3b179e12f77ad89b1eb5b0bafbbbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
81bc367085b67b0a11ec6c2dc538862e

SHA1
134af9ba69359eb5f818dab7f82075cc59940d2c

SHA256
36f03b68707c3e4a48628258d8d9503641a298535685631ffdef306fef55e7d2

SHA512
fedba0400633ab5353971885e90bdd30fbc0759c8d5371ff7433d077697299bb49b58bb311846a9dac41bdf343e260ea97837a5ab6d6cc27f1b31dbeaabe91cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
365e368d8d267bf332661aa1ec2871ad

SHA1
c9257db98d65e09502bd0ca24a339560c121567f

SHA256
4e4efab59160c30a14e85723d3961e62fee4ab6a2be97cfb9cdb9d46ee43ac31

SHA512
36396e2efee953044afe85284b6a47141b6dd491426fb2d1f2964689269d90b2b36e989554eed2cc2edbf22328c042727230d6b3235e51eece1dd1463e762cc2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
520a3a346b70fc1d95a32af967cd33e7

SHA1
ccd11705ccfdca92130feb9903450f28c7573e30

SHA256
cf19467a63c8bc64a007bc91ffa3fae40b56dc046674fb632f040af536aa3de4

SHA512
8533d56858c80ee5a8e6fb44159942ae68b1c5a57043918629eecee52c3e0ea428dd5b2ca9486d0ee9d826e3d756f8e035a08c4472974ac170e32e341a88cba5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
cdd9a8399d4a19209e5c61aaacc8b8cf

SHA1
5b0eeb366a1841b884ec86a08e280b1530715e25

SHA256
3e485843be0c3461f233238d0bed070c7949c665c95eae6b76324ae9d0301462

SHA512
501d217a7ad15daa76bc9205d862865f8167be723eb949708e226ea350a6006d9abcd0232a0141035593dba11dd603b8b2be7d0c8f8132980b422d421f918670

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
263KB

MD5
06df7112985e50655c476389a76e7c7a

SHA1
04c5512d2e8b5838298e8f7141fcba94eb4f0c26

SHA256
2fca804d58d9976d3413f078821186c5dd49f5f1f287ea7a08e0656248145966

SHA512
08a917fc6f10245a8e01f00a88ccd0e0fb2454af7fe00d09d5fe684bf830ad2794a767554f3667f2fc99de8961c37b5806fa7cc1bf1862df8cddfd6710ae648d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
263KB

MD5
63f5653cce7adbf5e34ad762ef929e53

SHA1
ad04da2350be589a54b0c4e8504cdd05663a7717

SHA256
4bb5eafb95bf0df5169e9c6f3b45e739ff8d43e22a95fb5378340911a895b854

SHA512
f5b26ee10bb45b4a603afc17f73b40f94f2ff57ab8b0275e58065bbdf2a03bde158c30213790125f1b014d4bb777e27ef8eac53a474f608d39c8b69185668d2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe60a9d1.TMP

Filesize
88KB

MD5
ecce3ee2226c56ad2ca748633c5770b0

SHA1
dca4efbb4ab0c3a8fc745423a57a489581d37e4f

SHA256
cf2d579ed1b0fc521ff45a3b9f55b3a74be7cd4d4bde2d355ddfbd0b5c7b4200

SHA512
b815a3921c14772b0c6f1c9329941072ef855fa59f2d0ddd59be0564630f7adbc2ea478c921d344c6843dba5a13ac6fad83fe689c3ff9fee52036660feadf4fa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fb4325b6-8922-4b6c-9d90-47ff47f9fd12.tmp

Filesize
94KB

MD5
4e7e8a768f1430519cd8d40d798717bd

SHA1
98a00d884d537d6c0789dc4b641b28606a1ddd15

SHA256
7416a8868b7223401c4ef9585ea302a520f45260d494149b9e124ba714bd4ac4

SHA512
97b38292d1af0b7d6a084488d4bea3ac74c33e0ad1623d19cad6812bccf57c6b0847269bcb062ba9a1a8cae9a3dd61e966cadf1d379b90dbd7a7cc0c9c2f6913

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\818a2557-01bd-4d8b-8827-b6988cff695a.tmp

Filesize
8KB

MD5
401c61f95426863bcad825b840293e63

SHA1
185ff1bfacf2d722120201839cd3bc9d0b216b89

SHA256
325717d2be7954894b7e13f7f8301c6e7a6a33831dcbb9a9a2a49eea1c1a946b

SHA512
46a33688846344fcec5f907aeac7ee28a3ad6bca7c17de7f2b8cb7d949b504bf5c8e4426f5af0762ebdddeac874c636c53d774532e8897392e7918a454071953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata

Filesize
150B

MD5
ecedf1d3b8eaf5fa6033bbb103139b40

SHA1
0ac0e8da4bc9abda07969b0a3b8f4f3c92202c34

SHA256
e41f3e0996bb84266b68eee51440b1d2424c2066990ed4a9e93ee584456f11a3

SHA512
45ec6bd7bbf815166b6fe58d9286a62192c4cfbe8be16d8830f0465dc41109f3b8233b2d52c8d98b7355dddf40844fd6081bd6809878a55612d87acae19e8c1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\0b095174-04d9-4465-92a7-fccb97ef73f7.dmp

Filesize
732KB

MD5
3913c1533ee9d542b184d0414f0d4991

SHA1
26e3bca79f6f4ad93aae6079a2df4cc914b98abc

SHA256
24e9072de4baf0af9458ade58a72df41df025aa6279e72b7b4bc2e7238cd6b62

SHA512
3e4580dc754831fe099ff4a73e267100676efb63bbdf38f9b09ba1c68eb2c61273ecda077b06de533e3b8d6be0e16b42d00e9cfb19aae79904623982c1a78482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c69e88a110a2555b24b1d9898e00b36d

SHA1
2f0527b132c11185513ba72920b868451fdc3cd6

SHA256
a109bdb7100a58b4f027a31c34f74610f6a9d28b0d0126af2ef9a7b289e80623

SHA512
534c1214aa2dce7faa26c138c3a73d290be9a4f24de339de67e4baca25c43a782ce2326418fcfb962580177c646b882ae801247c8cd5d825cc81d74af8d5b458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
84a7ea0aa0484aa3d79b0584b2a33d65

SHA1
6557291ea0bd33ce7fe5cb31eceb4ff0ea687587

SHA256
923b2fb70f9c18ba0328ab5e3efbc396c0f65afd75de2e344bc6e44758432535

SHA512
aebdb678481316e4f432fa928a73ced847bc2e48f3965fcbc4f444859dd31b269507d8383671f2b0276dc17b8251e729893045c73da3c263cc8a19ce12d1b436

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d265d071ab43dfd02decb864438c3a8f

SHA1
d54f5fef443df8997bb3d50ab1ee1cc1c3d098ea

SHA256
118be01d346544f22b902ca56e6dc8422e0916b9c5671625fe8484914b415525

SHA512
b462e8b0775eb2824fd859d2ad2984dd4c73474d1a080bff532c192b6634a47686cfe68ce518dccc49be4eec78d4423a43118d3b6f122a8900d54eef1c2c04b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Filesize
331B

MD5
c780eca64f46c82624ccf7274fe6a255

SHA1
22e243d9c755e648e11f584fdd133c83c50ab981

SHA256
5eb2c498efd253b197e3adcc2da49c901d34992a9e860d7f86c26bfd6f8fa6b2

SHA512
3cbf804e82f76900f731de0c0b1c465805548e4cb9f73d28725ef7a8d4adf673de71e990e0ee6385120667bc4e23c3974cb726152d7c0ae3685024eb56ae9dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
61B

MD5
4df4574bfbb7e0b0bc56c2c9b12b6c47

SHA1
81efcbd3e3da8221444a21f45305af6fa4b71907

SHA256
e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377

SHA512
78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
513B

MD5
423e2d4418b001bd92002a0f48a31687

SHA1
d37302f0827a09d2be7b02b5d674931028ac78e5

SHA256
4d2c9739a03a1582b0385c2aec7555f5afb5e0cc88004e154c1698cbc11fcfec

SHA512
d09af63d295dcfdec5980601399ab81b8f4f2d50642c1d79ca274f08fc040121cf4b14414e953e5410142bf0454f92698940f9c6514cc254f0976a927809ed67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
43bf3da69acc304484b1cca7c8151cf1

SHA1
3db46d75f143274d3e5f87d0dcae9d0bee1f9a24

SHA256
98d2716fdf10b2926be988c7df5d19ad01c992eacb1664f9cb3883a48f12a526

SHA512
4142e6a64adf023962e620a6927403e461d76a845dac0b9c1a9baca19676c40cbea59765c55e4e075bd789cbbae10e65f5ee466a431edcf632f528d5641b18aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec266b32ddb7888912962972c7ffefb5

SHA1
10675a6c86b686c16a3fd1d19e59103a791efeaf

SHA256
dc548076d2a5fe4738d70fc985d2fdb2f01f96f1551ca85592141ad02080fc95

SHA512
c940b5bde3fd2340caa9ceb978844d64cf7fc1a9aef053e5e684f33387a35a3f36154c68f40187a20e79f654e47c7ef9a3350bf040153a4a75493e4dee24fd16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce2275e09e2bfe9a5516a24892edc805

SHA1
009389b4720f1e7c5f3f0edd27fe30bda15ac560

SHA256
798ea591b9a672c44140283bb9e0035648ac4097681da8c128bd319a68626fc7

SHA512
cd942eb8109c4c1fa2545b7de3341645b86420ad494e1201085b88434d97780220e1dd0abb226185419f1aae4228a7ef622c7ebeb925ccd5943bd5960ade15a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
893a808045ac9ecea33f2176f3f5e552

SHA1
24c1036035b67ee82bfc885de3c894659c79b751

SHA256
fe07bdb60e75c7f34f7917df6a533aad9bdeb0f0d698430b30033fe306939422

SHA512
2c00aca0178434a850d058814a1202e66a465d3e4fc546c74614a99b73c001cadc1107f3d75d4567898271c8b0b60dda2e6b1379e75a99565c00b42b36fd2d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
80f75d745f91657e13947c7c109099be

SHA1
5b5dfa04912d47f3d401d565c844f3c86905a427

SHA256
9cb145ed3bb53a4eba53075d6092ebdffa09b323939e866adee61122b033379c

SHA512
3eada32b6a767d95c1979a1cd95dc6c91e7928fa60eb012616153a893d96c29b5f110b75e075cc0ea13f7d00d3f03790eb6871cbf1618f728837cc6ffc5b032a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
0934ebf3adb70b19dc939a50815853c5

SHA1
97b3b4ae47b47635d1a43b5d1a05c5263a93e557

SHA256
09d6843e20a51a713fbbb793b09ab4a721a252a81555a19f04f1bd77f5e239a7

SHA512
567333263c8c7ed49616b942cc81a242c0856dbd685a67b6c0ab07f484999e82c3c69336a83914a168c22d44f8d89c686dd2204d2f1b6dffa096c4c2bfc42702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
cdc89e653060480d4c6346c19d4cf808

SHA1
4802d1211acc65a6731255f3d7ed52f6a0d37a35

SHA256
4a75008b78f1a18049fa85615309adbb44e92d1a7f4246cf5fd8c1945ed0728e

SHA512
0a1091243cb3cec1abc82a8cef7ac8752f01b25f5e8dea638259dedbf3f915d421b47d8361ef881cae4935e8bceb9be4c5493344ebd7392eda45a0481517acb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
7e023b4494a5b0bca6ba22a82fbae6a2

SHA1
faed9d041e70804b330e0a065c092bbc469284c3

SHA256
a7340b380adcdefbeb94bfbe9bf667ab6aff8320db661c9ed987d30d94597bd1

SHA512
a24b66b418a913020b3fe20a1e28e30576b1fb81b45b3b483a7cb81c7f85a60e25abaf5cc2bb77acede745e2e8bc058893fdbfea71651469ebf8837b61e0c895

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c72e3356-5607-4bbf-97fc-a7b17cbe2ff6.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
998d826f7802afbb11f5d016473f3ee7

SHA1
e4ecaec8f7baaae824d11bee1d4fdd7424926c5e

SHA256
6ac6e7042e0321137cccaf5d32ad31b13eae9de1b9ae028e21fc676c6b757983

SHA512
6e430aaa900c9fca650422cdb9d3740a206a999d0cdc6818b9c9e948cd0bda42f7940fe25589f9c4c18fae9b0a5e019cc773d78c7d0b143584fcf27eb5d9d25b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9ff6fc960d16c21caafa1e75ce91646b

SHA1
79dee426e27dcb5f56fdca38de6b4879be1180df

SHA256
a0d26b897a5633b2853acf80b420edb8897d3667be1c4c31ce22a288ed5798f6

SHA512
ca11e5e8a4708f6a8ebc54b661ec6672e7787129e5e8d352c365aa527837779fbbad741975da98e06ad52f39ca0091d0893a21171e5c6c884e8917548c04a43d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
84addcab5d9146bbf65e262e752a5a9c

SHA1
8b667e7a9f6142310cfdbf314ca1aa488d4b64e8

SHA256
766b5d8f2ebbd6fc28c6a21e238e260f40fe8002065ef59e4d5c4a590846c870

SHA512
6da99447f8837df7f159fa1cb240211df96d1f0b693a3a3f0ebaa8a667d1ef97ab32a288f040987fbb6a7a6e4aa56f491cb857e81b9edee6cbb6795df255cfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\Downloads\Cracking Tools\Cracking Tools\UD\x64\wompwomp.ini

Filesize
47KB

MD5
acb539c166943fbe6519cad0b0b96841

SHA1
a1637bd84b74c4053cc022e5156b336843206c08

SHA256
9dac49125247d1f6e6e79ccb40f7c756ec5e041a537dfea58fae7d254f7dd025

SHA512
e44e615cdbd6a7f703b020c9fc3b9bfa1cc064c8c446b8a8b59947db35983e378bb45f5db8a88763c70e9ca988611d6d654ce95422c90e52d42b160b1c13e7fa

Download Submit
C:\Users\Admin\Downloads\test.zip.crdownload

Filesize
9.5MB

MD5
9d8cef8e094649f62d84bb2a25646567

SHA1
123e1af9da02afd861662de61178f96dace12f0e

SHA256
ccb4505bf63d19636e3722d46d296a86864799284c7009716c48f2be62529aa5

SHA512
89524825a97a2d5dfc4d12e6e89e1711f44e3ed2267ea7ae48193139bdc13756b1a386254074f625090c97e8c26eed3f4caa4f721e53465e8fc93abb7cb8ff01

Download Submit
memory/1296-438-0x000002186E7E0000-0x000002186E80A000-memory.dmp

Filesize
168KB

Download
memory/3272-1055-0x0000000057D60000-0x0000000057D75000-memory.dmp

Filesize
84KB

Download
memory/3272-1060-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3272-1061-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3272-1023-0x00007FFFDF1A0000-0x00007FFFDF6CE000-memory.dmp

Filesize
5.2MB

Download
memory/3272-1025-0x00007FFFDF1A0000-0x00007FFFDF6CE000-memory.dmp

Filesize
5.2MB

Download
memory/3272-1024-0x0000000057810000-0x0000000057D5A000-memory.dmp

Filesize
5.3MB

Download
memory/3272-1022-0x0000000057810000-0x0000000057D5A000-memory.dmp

Filesize
5.3MB

Download
memory/3272-1027-0x0000000057D60000-0x0000000057D75000-memory.dmp

Filesize
84KB

Download
memory/3272-1028-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3272-1054-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3820-1049-0x0000000000810000-0x0000000000811000-memory.dmp

Filesize
4KB

Download
memory/3820-1035-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/3820-1053-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3820-1050-0x0000000000820000-0x0000000000821000-memory.dmp

Filesize
4KB

Download
memory/3820-1052-0x0000000000840000-0x0000000000841000-memory.dmp

Filesize
4KB

Download
memory/3820-1048-0x0000000000800000-0x0000000000801000-memory.dmp

Filesize
4KB

Download
memory/3820-1047-0x00000000007F0000-0x00000000007F1000-memory.dmp

Filesize
4KB

Download
memory/3820-1046-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/3820-1045-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/3820-1044-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/3820-1043-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/3820-1042-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/3820-1041-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/3820-1040-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download
memory/3820-1039-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3820-1038-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/3820-1036-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/3820-1051-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/3820-1034-0x0000000000440000-0x0000000000441000-memory.dmp

Filesize
4KB

Download
memory/3820-1033-0x0000000000430000-0x0000000000431000-memory.dmp

Filesize
4KB

Download
memory/3820-1032-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/3820-1031-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3820-1030-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/3820-1029-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/3820-1037-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/3820-1066-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3820-1057-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/3820-1062-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/5632-424-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/5632-425-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/5632-422-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/5632-423-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download
memory/5632-437-0x0000000140000000-0x00000001417FA000-memory.dmp

Filesize
24.0MB

Download