lumma | hxxps://www[.]gamezfull[.]com/resident-evil-village-2021-pc-full-espanol-mgfx2/

Resubmissions

12/07/2024, 00:36

240712-aybs1s1eql

11/07/2024, 23:38

240711-3mrpbasake10

Analysis

max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.gamezfull.com/resident-evil-village-2021-pc-full-espanol-mgfx2/
Sample240711-3mrpbasake

Score

10^/10

lumma redline stealc hate logsdiller cloud (tg: @logsdillabot)discovery evasion execution infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

77.105.135.107:3445

Extracted

Family

stealc

Botnet

hate

http://85.28.47.30

Attributes

url_path
/920475a59bac849d.php

Extracted

Family

lumma

https://radiationnopp.shop/api
https://bouncedgowp.shop/api
https://bannngwko.shop/api
https://bargainnykwo.shop/api
https://affecthorsedpo.shop/api
https://answerrsdo.shop/api
https://publicitttyps.shop/api
https://benchillppwo.shop/api
https://reinforcedirectorywd.shop/api
https://contemplateodszsv.shop/api
https://applyzxcksdia.shop/api
https://replacedoxcjzp.shop/api
https://declaredczxi.shop/api
https://catchddkxozvp.shop/api
https://arriveoxpzxo.shop/api
https://bindceasdiwozx.shop/api
https://conformfucdioz.shop/api

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	setup.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3996-363-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 15 IoCs

pid	Process
3944	setup.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2708	srn3nH0crlBmyaDt8jhjnFYt.exe
1520	B1cJ5b0fjtXbaLA1VosudNK2.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
4856	oangiEforglt9Yp3DxEb1z4P.exe
2512	4TVGRlG3lk5SL9BmCQSaBzWM.exe
4144	RwX_qZfQEmci04ZtVMe2idSp.exe
4560	cN55iM7SWWzbc4BnbSeZKnGe.exe
2132	oangiEforglt9Yp3DxEb1z4P.tmp
5792	playpadmediaplayer32_64.exe
5844	playpadmediaplayer32_64.exe
4324	eqtpkqwqodik.exe
5320	HCAAEGIJKE.exe
1008	JKECGDBFCB.exe

Loads dropped DLL 7 IoCs

pid	Process
2132	oangiEforglt9Yp3DxEb1z4P.tmp
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
5516	MSBuild.exe
5516	MSBuild.exe
5524	MSBuild.exe
5524	MSBuild.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
155	iplogger.org

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
80	ipinfo.io
81	ipinfo.io
75	api.myip.com
76	api.myip.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4892	powercfg.exe
4960	powercfg.exe
468	powercfg.exe
2208	powercfg.exe
5184	powercfg.exe
5204	powercfg.exe
5212	powercfg.exe
556	powercfg.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	setup.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	setup.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 2512 set thread context of 3996	2512	4TVGRlG3lk5SL9BmCQSaBzWM.exe	130
PID 2708 set thread context of 5000	2708	srn3nH0crlBmyaDt8jhjnFYt.exe	131
PID 4560 set thread context of 5516	4560	cN55iM7SWWzbc4BnbSeZKnGe.exe	134
PID 4144 set thread context of 5524	4144	RwX_qZfQEmci04ZtVMe2idSp.exe	135
PID 1520 set thread context of 5544	1520	B1cJ5b0fjtXbaLA1VosudNK2.exe	138
PID 4324 set thread context of 5224	4324	eqtpkqwqodik.exe	164
PID 4324 set thread context of 5312	4324	eqtpkqwqodik.exe	170
PID 5320 set thread context of 5972	5320	HCAAEGIJKE.exe	171
PID 1008 set thread context of 5476	1008	JKECGDBFCB.exe	173

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1924	sc.exe
4652	sc.exe
4100	sc.exe
4592	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
2172	timeout.exe
5068	timeout.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
4548	msedge.exe
4548	msedge.exe
4592	identity_helper.exe
4592	identity_helper.exe
4600	msedge.exe
4600	msedge.exe
3944	setup.exe
3944	setup.exe
4144	RwX_qZfQEmci04ZtVMe2idSp.exe
4144	RwX_qZfQEmci04ZtVMe2idSp.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5000	RegAsm.exe
5524	MSBuild.exe
5524	MSBuild.exe
5516	MSBuild.exe
5516	MSBuild.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
3996	RegAsm.exe
3996	RegAsm.exe
3996	RegAsm.exe
3996	RegAsm.exe
3996	RegAsm.exe
3996	RegAsm.exe
5524	MSBuild.exe
5524	MSBuild.exe
5516	MSBuild.exe
5516	MSBuild.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
2544	tsc_wAXM1jCcrQpwwY9mOEhV.exe
4324	eqtpkqwqodik.exe
4324	eqtpkqwqodik.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeRestorePrivilege	8	1.jpg
Token: 35	8	1.jpg
Token: SeSecurityPrivilege	8	1.jpg
Token: SeSecurityPrivilege	8	1.jpg
Token: SeDebugPrivilege	4560	cN55iM7SWWzbc4BnbSeZKnGe.exe
Token: SeDebugPrivilege	4144	RwX_qZfQEmci04ZtVMe2idSp.exe
Token: SeDebugPrivilege	5000	RegAsm.exe
Token: SeBackupPrivilege	5000	RegAsm.exe
Token: SeSecurityPrivilege	5000	RegAsm.exe
Token: SeSecurityPrivilege	5000	RegAsm.exe
Token: SeSecurityPrivilege	5000	RegAsm.exe
Token: SeSecurityPrivilege	5000	RegAsm.exe
Token: SeDebugPrivilege	3996	RegAsm.exe
Token: SeShutdownPrivilege	2208	powercfg.exe
Token: SeCreatePagefilePrivilege	2208	powercfg.exe
Token: SeShutdownPrivilege	4892	powercfg.exe
Token: SeCreatePagefilePrivilege	4892	powercfg.exe
Token: SeShutdownPrivilege	4960	powercfg.exe
Token: SeCreatePagefilePrivilege	4960	powercfg.exe
Token: SeShutdownPrivilege	468	powercfg.exe
Token: SeCreatePagefilePrivilege	468	powercfg.exe
Token: SeLockMemoryPrivilege	5312	svchost.exe
Token: SeShutdownPrivilege	5212	powercfg.exe
Token: SeCreatePagefilePrivilege	5212	powercfg.exe
Token: SeShutdownPrivilege	5184	powercfg.exe
Token: SeCreatePagefilePrivilege	5184	powercfg.exe
Token: SeShutdownPrivilege	556	powercfg.exe
Token: SeCreatePagefilePrivilege	556	powercfg.exe
Token: SeShutdownPrivilege	5204	powercfg.exe
Token: SeCreatePagefilePrivilege	5204	powercfg.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe
Token: SeShutdownPrivilege	4116	chrome.exe
Token: SeCreatePagefilePrivilege	4116	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
2132	oangiEforglt9Yp3DxEb1z4P.tmp
5004	notepad.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
4116	chrome.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe
5476	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3944	setup.exe
2512	4TVGRlG3lk5SL9BmCQSaBzWM.exe
4856	oangiEforglt9Yp3DxEb1z4P.exe
2708	srn3nH0crlBmyaDt8jhjnFYt.exe
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
2132	oangiEforglt9Yp3DxEb1z4P.tmp
4012	yiVFlYJ1A3jmaWIK0M71Aqq9.exe
3996	RegAsm.exe
5516	MSBuild.exe
5524	MSBuild.exe
5000	RegAsm.exe
5792	playpadmediaplayer32_64.exe
5844	playpadmediaplayer32_64.exe
5544	BitLockerToGo.exe
5004	cmd.exe
5320	HCAAEGIJKE.exe
5972	RegAsm.exe
1008	JKECGDBFCB.exe
5476	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4868	4548	msedge.exe	83
PID 4548 wrote to memory of 4868	4548	msedge.exe	83
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 1920	4548	msedge.exe	85
PID 4548 wrote to memory of 632	4548	msedge.exe	86
PID 4548 wrote to memory of 632	4548	msedge.exe	86
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87
PID 4548 wrote to memory of 2972	4548	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.gamezfull.com/resident-evil-village-2021-pc-full-espanol-mgfx2/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb947046f8,0x7ffb94704708,0x7ffb94704718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2124,17974398082892669213,1718347306732992801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Resident_Evil_8_Village_PC_Full_Español_[MEGA]\unpack.bat" "
1⤵
PID:5076
- C:\Users\Admin\Downloads\Resident_Evil_8_Village_PC_Full_Español_[MEGA]\1.jpg
  "1.jpg" x -p3840 "image.7z" -o"."
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:8

C:\Users\Admin\Downloads\Resident_Evil_8_Village_PC_Full_Español_[MEGA]\setup.exe
"C:\Users\Admin\Downloads\Resident_Evil_8_Village_PC_Full_Español_[MEGA]\setup.exe"
1⤵
- Modifies firewall policy service
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3944
- C:\Users\Admin\Documents\SimpleAdobe\tsc_wAXM1jCcrQpwwY9mOEhV.exe
  C:\Users\Admin\Documents\SimpleAdobe\tsc_wAXM1jCcrQpwwY9mOEhV.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:1924
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "CIFUBVHI" binpath= "C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4652
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4100
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "CIFUBVHI"
    3⤵
    - Launches sc.exe
    PID:4592
- C:\Users\Admin\Documents\SimpleAdobe\B1cJ5b0fjtXbaLA1VosudNK2.exe
  C:\Users\Admin\Documents\SimpleAdobe\B1cJ5b0fjtXbaLA1VosudNK2.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1520
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:5544
- C:\Users\Admin\Documents\SimpleAdobe\srn3nH0crlBmyaDt8jhjnFYt.exe
  C:\Users\Admin\Documents\SimpleAdobe\srn3nH0crlBmyaDt8jhjnFYt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:2708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5000
- C:\Users\Admin\Documents\SimpleAdobe\yiVFlYJ1A3jmaWIK0M71Aqq9.exe
  C:\Users\Admin\Documents\SimpleAdobe\yiVFlYJ1A3jmaWIK0M71Aqq9.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GIEBAECAKK.exe"
    3⤵
    PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\BAFCGIJDAF.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:5004
- C:\Users\Admin\Documents\SimpleAdobe\oangiEforglt9Yp3DxEb1z4P.exe
  C:\Users\Admin\Documents\SimpleAdobe\oangiEforglt9Yp3DxEb1z4P.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\is-LMVHD.tmp\oangiEforglt9Yp3DxEb1z4P.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LMVHD.tmp\oangiEforglt9Yp3DxEb1z4P.tmp" /SL5="$302FA,5045875,54272,C:\Users\Admin\Documents\SimpleAdobe\oangiEforglt9Yp3DxEb1z4P.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2132
  - - C:\Users\Admin\AppData\Local\PlayPad Media Player\playpadmediaplayer32_64.exe
      "C:\Users\Admin\AppData\Local\PlayPad Media Player\playpadmediaplayer32_64.exe" -i
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5792
  - - C:\Users\Admin\AppData\Local\PlayPad Media Player\playpadmediaplayer32_64.exe
      "C:\Users\Admin\AppData\Local\PlayPad Media Player\playpadmediaplayer32_64.exe" -s
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5844
- C:\Users\Admin\Documents\SimpleAdobe\4TVGRlG3lk5SL9BmCQSaBzWM.exe
  C:\Users\Admin\Documents\SimpleAdobe\4TVGRlG3lk5SL9BmCQSaBzWM.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  PID:2512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3996
- C:\Users\Admin\Documents\SimpleAdobe\RwX_qZfQEmci04ZtVMe2idSp.exe
  C:\Users\Admin\Documents\SimpleAdobe\RwX_qZfQEmci04ZtVMe2idSp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:5468
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DBGHDGHCGHCA" & exit
      4⤵
      PID:5584
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:2172
- C:\Users\Admin\Documents\SimpleAdobe\cN55iM7SWWzbc4BnbSeZKnGe.exe
  C:\Users\Admin\Documents\SimpleAdobe\cN55iM7SWWzbc4BnbSeZKnGe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5516
  - - C:\ProgramData\HCAAEGIJKE.exe
      "C:\ProgramData\HCAAEGIJKE.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:5320
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5972
  - - C:\ProgramData\JKECGDBFCB.exe
      "C:\ProgramData\JKECGDBFCB.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:5476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFHDHCAAKECF" & exit
      4⤵
      PID:676
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:5068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5068

C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
C:\ProgramData\lmguvcpihozg\eqtpkqwqodik.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4324
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:556
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5212
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5204
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5184
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:5224
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5312

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xb0,0x11c,0x120,0xf8,0x124,0x7ffb93f6cc40,0x7ffb93f6cc4c,0x7ffb93f6cc58
  2⤵
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2208,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  PID:5208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1756,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3104,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3372,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3692,i,7167554540637952071,4396915362403145315,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:5452

C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
1⤵
PID:4840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffb84ba46f8,0x7ffb84ba4708,0x7ffb84ba4718
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,13520056270646944344,8480137819697774919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

CFCBFB

Path C:\ProgramData\AFHDHCAAKECF\CFCBFB
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ECAEGH

Path C:\ProgramData\AFHDHCAAKECF\ECAEGH
Size 114KB
SHA256 2d2968f191b8ae8a35c217497004c579d896bfee1b8dd48e48f54ddb2109f418
MD5 90a154a5a49cfdedd79b04b752a1eeb6
SHA1 ca2a9ac4b15e745c203d811c3275779d9cd7d957
SHA512 11f8f95d16223da10783e72898bed150439d431ee59bfa16e7a81b0965c00d525081cf2d19a5e8e7062e7ab9375b44909002dafc69578463a1e86cbb27fab52b
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cFqLVumf:I02m/lxhlnmhouHMVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBGHCG

Path C:\ProgramData\AFHDHCAAKECF\FBGHCG
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

FBGHCG

Path C:\ProgramData\AFHDHCAAKECF\FBGHCG
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

GCAFCA

Path C:\ProgramData\AFHDHCAAKECF\GCAFCA
Size 48KB
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
SSDEEP 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

IDGDAA

Path C:\ProgramData\AFHDHCAAKECF\IDGDAA
Size 8KB
SHA256 7d40708556c923d621af3fa7bfe69445771d9aeff6df0f8c641c9bf99e1c7dbe
MD5 857e654ab4b103d49e41d8934caf06a8
SHA1 242bdb4559c7b939986c7c5954d318d98460b5ad
SHA512 cdb602dbcf8f23615e836a136fe4ff5c6f79f0ce8f80221eb3c76b6ccc206f114a390b065c254f2a5118d144dd8026494674e2f4a02f931bd2a3f8710ba1fbbc
SSDEEP 192:X5nJRxTfvP2miD6cdCj60baX8iyN5RrBw8VB:fT1iDHkGaNwK
MD5 SHA1 SHA512 SSDEEP

Submit Download

JDHCBA

Path C:\ProgramData\AFHDHCAAKECF\JDHCBA
Size 20KB
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc
SSDEEP 24:TLYP1kwIrnLbXYFpFNYd+6UwcQ8ri5fB:TcPawkLLopFsU1+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

BAFCGI

Path C:\ProgramData\DBGHDGHCGHCA\BAFCGI
Size 5.0MB
SHA256 0e6de06c4f09d0baa87e59dccd71451d85e5541ae52a03cb05cdb05b06b8b8a9
MD5 b978b7e995de191f782336202b95a312
SHA1 a4cb363b6cca5002e32373dcd52850d54b92a21d
SHA512 63b8f554f3115c981ae39a26c706e615883ee54fcdbd9a16a458aae60b68422c72662f3171691f08ad2ff57f118c4c2f6d463852d657b663fd5289565b7ec160
SSDEEP 192:28rJQaXoMXp0VW9FxWHMofnQhMmrTA6GJK:28r54w0VW3xWNf
MD5 SHA1 SHA512 SSDEEP

Submit Download

FCFBGI

Path C:\ProgramData\DBGHDGHCGHCA\FCFBGI
Size 96KB
SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
MD5 40f3eb83cc9d4cdb0ad82bd5ff2fb824
SHA1 d6582ba879235049134fa9a351ca8f0f785d8835
SHA512 cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2
SSDEEP 12:DQD7rD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQDnS232mNVpP965RayKN0MG/lO
MD5 SHA1 SHA512 SSDEEP

Submit Download

HCAAEGIJKE.exe

Path C:\ProgramData\HCAAEGIJKE.exe
Size 431KB
SHA256 f3f2ee666e572cea6eb5bcfd31fbfbc3b0edc9f99db528bb0a640751fb223033
MD5 51c75077bca69383b83b1c94c2406e05
SHA1 efc8d7ef37661dadc02171817ff344c84790683f
SHA512 607455d7fc1bb272c03f24205fdbb401ef3b7b09d192b2cb62e9ec271fd44bc5bc83ae8b620446ded5f9998aee3a47d9966ee5b84bb9f5ac7b11648f119b664f
SSDEEP 6144:LwcfOnB0WvTtMMR0Q+uGQ8n97bfrd1NFqGOGOwqGz5n3eU7FhdSs4ztWTH8S8EO:CnTvT729zd3RObwqGz5n3VFLqS8EO
MD5 SHA1 SHA512 SSDEEP

Submit Download

JKECGDBFCB.exe

Path C:\ProgramData\JKECGDBFCB.exe
Size 518KB
SHA256 1850a11acaede15b70cf7fc93830cd13ed4855f5e6226ef8110427fab9651ddf
MD5 64ae8807b8359c84c00444c2cbab6236
SHA1 db15781e8050dd032b0bd67315283089aef9dd3d
SHA512 6e598e9d74d1df6097e0594f0b2f6d06ee07eda98ba91eb9f12500c50bf6d5edc2b4d35165b67b31b627ca10504aee8d7cb1755d7d8b227229c93ee444e2787f
SSDEEP 6144:K/YU8Hd8WCoWM5qcOotxvqzdCODY1eIQfHc5/mcYpTH5vQATH+2+dU739nNjp2M7:7HvComlwToHcfoTZ9Te2Lnb2MDaMScEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\ProgramData\freebl3.dll
Size 669KB
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
SSDEEP 12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\ProgramData\vcruntime140.dll
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Size 471B
SHA256 da9bbebc50ba4463f66d800e4f748bd5489d411b93e2b14b72e9095c33545d69
MD5 baa2409ed7f6a7e8bba952df083e96bc
SHA1 d8ad93370da697703762fef037a411218e800a85
SHA512 7404f98c6312fbe3c5ed747738de2655ca4bec1357f9566dabbb630ef110d39bfa03a5c5cf685d96c885ada550ef007358f9a5921d291dd0e2a486e41dd3d216
MD5 SHA1 SHA512

Submit Download

EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
Size 400B
SHA256 61936bc46ad3f7d8c004777a5a71013fe0baab533150ba1a301d7b11b6b2a1bf
MD5 805519122f480341669660ea6c7c61f6
SHA1 aaf5f60d7b68235436edb787993ff716d9e5374d
SHA512 3f5be586cfe045648127c456c7ce8c5494e31308f2a51f0967895d7fb37ac131b97c9b1ba890664b166ff78398a1b82c4da5644404353c0d79a6ba31683b5059
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 8KB
SHA256 feb1fd56cc99dfba59ea3486f3cb2021cd5d6005e92f2b2842f78a06d70411ea
MD5 3bca9f5c5d9a78310219ead394df585f
SHA1 a2cf28b0f6b866af856132e49cac5c00e6138469
SHA512 94261be97572ebcd6265459366ad277d0d5ea34cbc40a17a298f352f517402c635fb183e2d75b2b710c788d351b5a533ea6ea621486dde99f6ff4bdd68a5d35f
SSDEEP 192:Uk7cEdph0ejWHV+FRL6eFWRPo6yIsnVdg4:Uk7tdyGRgz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 92KB
SHA256 f68c0fa17df24a4f91634387531370470c988ba50047e387d74403532fc9587f
MD5 cd4946d5c5c52eac310cb29edb1019f0
SHA1 6f54e0dc18f8f9da7cfd7d55f6dcbdfaf6b547de
SHA512 52cad8dff25482fc49814d9d538a30397f04afea09a2262c748f7b17cde7aa84e13d72b34b72e4eecfd9386657e09a97d19fce3402d3eb0ccdccd0e3925fb025
SSDEEP 1536:Io0CT4JUAaS7uRlZTxY0c4JG+nSqVu2Ln0xGrRpIoq26tZ9lp0IlKoIcs6zMF:IoBMJUAaouvZTu0tGilJ7fV+oq7tBFlM
MD5 SHA1 SHA512 SSDEEP

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Size 2KB
SHA256 bb65e24fd8681e7af464e115fba42ff7713e933683cbd654a124c0e564530bb9
MD5 60ad21e008a8447fc1130a9c9c155148
SHA1 5dfa21d14dc33de3cc93a463688fe1d640b01730
SHA512 42a2753f717a4984967907fa69200e8a464068a6d4a226803cf9503ffb7fee540ffc611b4c905cc84f3623639a6aa93003b390f9c38e601b59f171a9e90bd9b6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f
MD5 75c9f57baeefeecd6c184627de951c1e
SHA1 52e0468e13cbfc9f15fc62cc27ce14367a996cff
SHA512 c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b
MD5 10fa19df148444a77ceec60cabd2ce21
SHA1 685b599c497668166ede4945d8885d204fd8d70f
SHA512 3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b0d9d480f4331b592c84ff259be0aff5d6c12f5b364d231c895e598cc27f260c
MD5 d841d133005e747dae8ca6f332f0cf52
SHA1 f59ee82045110d072f3c07eaaef05b4ea8b4615f
SHA512 2e7059c881995555a703e9884a28c71b27ae0cdfb4fd0209abaaee4b26a2ea6e74aa5e3b13d8f4a28a10f58dafcfb98832b0a693bf91d21ef8222a166f18e160
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 f543a3c32fdcbc355a31eedab5b8d59c4f6cbec46beea3fa708c9c3572b3f409
MD5 7c413f6ce82da92b606e8f5ebcbc1add
SHA1 2e6db83bd4837a53244548e5215191bf8990a07d
SHA512 4d81300ab622244bc1a3e88a8dd6310148dca9765e9596ae1ed066115377488739e48b8a477d2c5b063336e1328c0a65acc672747444a1c1f339fb46a8cfab27
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Size 20KB
SHA256 b1cf5c23a04c263dee217073197dd85984b15983dd506ef6866f200a55626e5e
MD5 6995b998cea6317dc61cd601cb4ff303
SHA1 05f28da8198eb27441e337e2ed51cdd1303653be
SHA512 197bd82aae74203f5df2881d27296d757f0920337f2a7fd5022acdf2e1e520494c70bebe0fca434574ad39330c3c7435daaabf74258bc7a67de4ccf35415888a
SSDEEP 24:TLgbXaFpEO5bNmISHnCWmoqv6UwpQ9YH5RZ6HfBtEOGW1r+1:TkLOpEO5J/KnvmopUOZD8BWO1M1
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 124KB
SHA256 7c0da692a754323631f61b065f4d2f80965f62b1fd2c468c64fac057916e2225
MD5 41522d6c8f1245146af3a5c349268bce
SHA1 e4aa54f9eca8a03faee1f1ca0e9eec49594c68e6
SHA512 95e9c5e4c6210c4309b16ad2282b40f89547f717c07ccb815ef4163d25b71f33415ea6223e138ad07c79045eca69d34067bf6b6ded5f94aeeaceb0543e399a7e
SSDEEP 192:x9VvhILGBzMLG2c7GsFsIGBPGBdV3n+bDo3irhnyTpvVj3XBBE3u6GBsVLN:zgUwoGujUPUdRoU3iVyTpJBBE3u6UsVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8617e598970cb3e645aa54ff1c80ac13c1f23e70742e4598b8040a5b45898ff0
MD5 d47e1e65ce7d8dadced0870386b1686e
SHA1 9ba7933c44d0518bcc32fd00d2769e92f3c3cc63
SHA512 8ec0f2717b3df7ac17ae8f6b0b0b53f2066ee38e9bf56792d02f3a72937b778585a9c1632f8e7e4215253f9492960b477fd9aa93b106e015d67371f6fc858e7f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ef55e3ad36a1932563f747e4873f0273e33ae07f83a7a67913758788b6a95e17
MD5 289585f2f74747545522f20816656a84
SHA1 e82da8d6a06b9b33674b1f06013da87e3867f478
SHA512 bc2544f0bd0bcb39614de6d55fb5dba7127f08ee4dfd322b79a3b6cecca3efde9c8221d34e8dcec664ba02e076a429aa6caa3840b894aa49e2cc02cdeb147f35
SSDEEP 96:nDkDxm/vQYmqQu1QUHwpvWMoiVmdeHjsFKZ//0Q1UWQyV+VDCziEwb:nDkwkzu3HGWMXQ8Z1ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ed357ea38b55fc65c7c0681cb5474f8a97da80ac7fe1308aee9a39e6d82d1f73
MD5 0a728580a512d7f70388336f031e8b72
SHA1 7e0a0919ee0a7be60cc819141928b6ab2df25c39
SHA512 add3a053f706b7282ec20313c86f2fe13a82ac5cbf0f8713a07275e34d987e1853f74b0497b9e5f1bebe7dc63d42bdbc33f2649a647e4aafa3dee84926128500
SSDEEP 96:nDkmsQFxm/vhmqQu1AOKwp7ETWMoiVmdeyJRMHs/mq2jsFKi+/0QR+UWQyVeiVDc:nDkXMzu6OKNTWMCJR//mq2QAZR+reJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 bcdf5c3d46210e0a72762fca628e3bf1193579c4dc743a2a44bb489dd6b89ecf
MD5 80c1517801a67aa4ec1a586d725714eb
SHA1 16cb585092870cd64846f50cedad0d8c7820e2ce
SHA512 76a7d1cac885a78bcfab6fd5175dbce7c965f1b0b63d2b78cd877aa37c0d02c4f74addd11e9f64579176631a62f5c3b73027ceb829db10e7d7ffa43693c6c1b3
SSDEEP 96:nDk8sQFxm/vhmqQu1QwKwp7ETWMoiVmdeyJRMHs/mq2jsFKj+/0Q1UWQyVeiVD7l:nDkxMzubKNTWMCJR//mq2QbZ1re8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8b3a45fa2a42ffb1385789c554eab619cd060a6e76e1d47d274b6b80a7092d41
MD5 946313e27ca2039bc986c521dd3ac73f
SHA1 670dc506ae23edc35418820c0468365c3b2bc8ff
SHA512 aeb794c2266a18972c22172f331d8e00e0c857a1a18ffff93c3b96fedd5ca17dce122bac6e563de03516db700e0c29e9437de4fed5ce40f7a3f2f32f9331cc30
SSDEEP 96:nDkDxm/vsmqQu1QUKwpvWMoiVmde8un1r/mq2jsFKJ//0Q1UWQyV+VD7AiEwb:nDkwfzu3KGWMMunx/mq2QqZ1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

c6a17376-2b7f-4d37-8156-8edf6896c6d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6a17376-2b7f-4d37-8156-8edf6896c6d0.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
MD5 aefd77f47fb84fae5ea194496b44c67a
SHA1 dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA512 b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 076d784083e8cecd0492337b1dff9390f78001bb1ebecd36a8d69856bc13d10c
MD5 fcdf713bf57f05c82cc155cddd019a7f
SHA1 2d00d7921c7b2f624f90214a7640d30fbc67a1c8
SHA512 8a302d41082d4c577d8e701bf775cfdfab5485bfd2db94ac0fdc90944e32ff40b8f78451cd6fda50fc6c9119d8745a2abb2525d02ce9f1a494c491018c636e6a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJTET5lzPe2RUGGH+7LgcTT:A9iIxuERzA83h09RZxYSlpD7Eh+nD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 85283182cc32dfed29a2f9a059c0fe0643603fec82abbd829cede0d55470feb5
MD5 5aee552cacc7cfe6c4a7ce1bd12bf41d
SHA1 b6b133325aa491f8f0bdb0aa4092aa777a4e7025
SHA512 b5a9d1c43b29fa4a1671336783ffa5f9e0a5db85050f22c912ad3f26d17992814fea302b78c0e648f0b25f49809d718ab5af1f33fa27193be567ba0da366d0ce
SSDEEP 192:2oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJTET5lUPe2RUGQSM+FLgcf:y9iIxuERzA83h09RZxYSlA8KFEh+nD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f01fc8d8edb89d76812476343a81ecc8aa3f351951c13f69b953deed5bf1ecf9
MD5 ffcc3771c6dbd3c8c521829d962d3d68
SHA1 964e7087c8ea55a4fdb9cf4d982014d5c732d3fc
SHA512 5e51781e068e1d096a3705a233e1d78542f157992c021a05cd32fbdff0c6907e5ab62a61cf2f44ec2fcbfce1cf7047a5c9d9649803c6b7d0528548a63b9339a6
SSDEEP 192:2oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJTET5lUPe2RUGQS6hT+FLL:y9iIxuERzA83h09RZxYSlA8nKFEh+nD
MD5 SHA1 SHA512 SSDEEP

Submit Download

playpadmediaplayer32_64.exe

Path C:\Users\Admin\AppData\Local\PlayPad Media Player\playpadmediaplayer32_64.exe
Size 4.0MB
SHA256 1db55ecc1c20fa157921ac2ea2d666cd34c9bc6ce1ddfd97352d4a64ea6675db
MD5 b21fecfb5494efe8b1ba82f7d1ceed1c
SHA1 a7af9f1e50d821db226e0db223fb9a7ad3247998
SHA512 8d02e264860260bf5bc3e07c7f64b7e9c196d363a7e0885795d2aece74878fdfae5cd8755df7ab4670128518868a3f65b2d52026ac8385f4f1345edf1ff47545
SSDEEP 49152:8C2b3YL2sDqXBWNRcExajf7UrW6HiBmnPY5LuBy3yzI6C:8C2bY2sDqxERcwsf7UrW6HiBIY8dzI6C
MD5 SHA1 SHA512 SSDEEP

Submit Download

GIEBAECAKK.exe

Path C:\Users\Admin\AppData\Local\Temp\GIEBAECAKK.exe
Size 162B
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
MD5 SHA1 SHA512

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-F697V.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

oangiEforglt9Yp3DxEb1z4P.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LMVHD.tmp\oangiEforglt9Yp3DxEb1z4P.tmp
Size 680KB
SHA256 b4ce69b89a2feb3d0853152f248714fc8ab9d78b8ecef106275c5fd7ab67101d
MD5 7a4fd26eebfe84b68512370afd9dc222
SHA1 b5ccd3b1bb51d3eabbe8f83c704b7db73a95eab4
SHA512 81ec250bbeda14ba9d0498f9cc765d3ae6f3371bfc0e3a1e7a421c7ef39cfd9f96a4d8e470aa549e29fafbe713af5067076ea0d6d99acc49ae42b558b58f68da
SSDEEP 12288:q0QfKb7nH5lrPo37AzHTA63I0ihE4aEJOrNv4gM/ReTAseY/XExy8:qfKbT5lrPo37AzHTA63/cfa74F0TAi/0
MD5 SHA1 SHA512 SSDEEP

Submit Download

1ESsULQbg6aIeDDCxvhBupws.exe

Path C:\Users\Admin\Documents\SimpleAdobe\1ESsULQbg6aIeDDCxvhBupws.exe
Size 495KB
SHA256 be313b9a7ac35645767985623681585149054673e44a2024093f6bf6a9ec6d6f
MD5 2b1d1fef1f2ad67a0e1a5c07590fb798
SHA1 d762cde716e2ef38d835a0309da8d78e07caf408
SHA512 09a57583c4ee35672b955b8242b242eef7e0953bbb745c6d4eec331da9e079742873c571b59bc2b1c9b04ff2241fef4bffd8011e8f9623d067765b77629d9457
SSDEEP 12288:/a/Eq7ktwIB8rIwJ0rAmv8fajWiru/pCaEdwqM0eul32BnI76BM:/8EqVajWk6CaEdwqM0eulGm
MD5 SHA1 SHA512 SSDEEP

Submit Download

4TVGRlG3lk5SL9BmCQSaBzWM.exe

Path C:\Users\Admin\Documents\SimpleAdobe\4TVGRlG3lk5SL9BmCQSaBzWM.exe
Size 522KB
SHA256 461e9dce0283bb4446c8d6457ebc3ba4c28126d34776f3366d2cd34746b8c8db
MD5 73b729f7c55efad3fb1b8bd25e24f0c6
SHA1 6bbeda77f3e22647859c2235d17ace4e61d5ff2f
SHA512 e12ca523a84e7f1ceeb7075ff2e3f19e9731bc41a9cd45684086c57e87b2eca21a641138af520cfad4c48f1596da805d9278c4343be9a7e47b9fdcda3c5332d8
SSDEEP 12288:5k6zW3hDY0YR3JIk2b/0j2chg4lj8eo/0FEiSPEO:5NIYvR3JIRoj2F7e9FEi0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

4TVGRlG3lk5SL9BmCQSaBzWM.exe

Path C:\Users\Admin\Documents\SimpleAdobe\4TVGRlG3lk5SL9BmCQSaBzWM.exe
Size 522KB
SHA256 61f3a8412782136c807054eac83b40a9edbe29b35791b18e827523b120f00dfd
MD5 1252940d70a332b74d557c29e7dc9cf8
SHA1 876a2684b0a6b537fe4f9777cbc1495c03153ce1
SHA512 9c6097dca84291eecd4fd49e2d4d96c772059bf6cba3a10d3ef6a61db586998cbc87ce1f2dedbdfee5eb9a21e1b0b0cdafa1de522dea1c1969e1076649f0b30a
SSDEEP 12288:v22DY0YR3JIk2b/0j2chg4lj8eo/0FEiSPEO:vDYvR3JIRoj2F7e9FEi0t
MD5 SHA1 SHA512 SSDEEP

Submit Download

B1cJ5b0fjtXbaLA1VosudNK2.exe

Path C:\Users\Admin\Documents\SimpleAdobe\B1cJ5b0fjtXbaLA1VosudNK2.exe
Size 4.7MB
SHA256 b4c8cabdb454ad0855960445ebd98b9b7b5fab255c62a36d5b34ae575ccee0f2
MD5 9635389d4492a1bb338d7467cc79a84f
SHA1 5bf4e06b683c07b6b59da041bc81fdc0e2accf5c
SHA512 106e536e589a4f76176ea5ecb564f46b6f6d1dda2bf33431fff682a3b2ef8fd4df11b6101118f52e14bb46ea2469697ac5738be07fc97fae28c7ec41dbaa5508
SSDEEP 49152:ZadqSJa0AzAku0pfKEae72f9tMcf3gBXkjV5Eh/GRJcwq7lSv5TG11kA:IbJa0AFjk5E8a1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwX_qZfQEmci04ZtVMe2idSp.exe

Path C:\Users\Admin\Documents\SimpleAdobe\RwX_qZfQEmci04ZtVMe2idSp.exe
Size 5.5MB
SHA256 c704eed11dddf5610cfdd562175cf85f8a89a480652523fa0b354ff5972f42ff
MD5 a89de627197ff0dbe147240d3923dd0d
SHA1 0fd9234b20347980b9e5cd1f2f940bb406e432a4
SHA512 4ee5470d4928177889607826c4be3241618349b981264a21ccb2b3dce0273d3c9281e9f47758d8fd494135c89cecae079c9d66cfe19393be9348ae6a06db1f7c
SSDEEP 98304:TFCUOPEBGU8mnOKPZeWFTaQyJv5M0Q+yngghUrj4:pTOPEgfmOKPLaJzxB
MD5 SHA1 SHA512 SSDEEP

Submit Download

RwX_qZfQEmci04ZtVMe2idSp.exe

Path C:\Users\Admin\Documents\SimpleAdobe\RwX_qZfQEmci04ZtVMe2idSp.exe
Size 5.5MB
SHA256 4bdfd59b483a10eb95136609e25962884d8c6c4c97249fde304dc19b504768c9
MD5 983dff02742f5837caf4346840a2781e
SHA1 068034b6154abcb93cf7cc63b43a1b68b74cbcc6
SHA512 a7b5eb217a829aaeb902467d046d5dff1886bccb7b29c7081a5c512411dedfed2ac041d4ecbc7a29944be3eb643377aecd42cf15a7b32d759ab598a91059802d
SSDEEP 98304:nY/z5D4MPXHgcQI0pjKY6po40sv+nWwy3ir4:Ozp4MPUpwpo4Eny30
MD5 SHA1 SHA512 SSDEEP

Submit Download

cN55iM7SWWzbc4BnbSeZKnGe.exe

Path C:\Users\Admin\Documents\SimpleAdobe\cN55iM7SWWzbc4BnbSeZKnGe.exe
Size 5.4MB
SHA256 e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97
MD5 d7a35e65bb9b48b344ee09594ac3193d
SHA1 face507db72044c594b930f0adc1cf6e841a2963
SHA512 7122170e3b7edf14c96d04237e01015f3341182fbf5f8f7bf849d53fc04aee46b07ab7eae9a61e519ad52eff4f9af11e61ca0ade2f1dd784884e6e52f6f07090
SSDEEP 98304:nzDWWQWDUAe4qfKOmBKtFr8yVkLZeulQ:zFQWYAegO1TVtB
MD5 SHA1 SHA512 SSDEEP

Submit Download

oangiEforglt9Yp3DxEb1z4P.exe

Path C:\Users\Admin\Documents\SimpleAdobe\oangiEforglt9Yp3DxEb1z4P.exe
Size 5.1MB
SHA256 ffcc01c78c68b19cf86cbd8cb24d9e6e0b7eed46786bb017982cb65cafa97c07
MD5 acd3f8a4ea798061f640fdee4feeaa53
SHA1 7ae3e8056ad4ad5f32f48586eed522f28ec85db7
SHA512 8b1138a9acf6b8e7424c243b06f45bd2d8d475aa9ad88e9d097633151555d9d4c6f1d031989f2da8e4982cbda625bd35e82e5070d6523736918d9ffca8125265
SSDEEP 98304:CqPkVTFYS8bfoN7L0crin6IpAao6rkpoeeNAuQxi:9oYSx7hrm6rYAuQw
MD5 SHA1 SHA512 SSDEEP

Submit Download

srn3nH0crlBmyaDt8jhjnFYt.exe

Path C:\Users\Admin\Documents\SimpleAdobe\srn3nH0crlBmyaDt8jhjnFYt.exe
Size 624KB
SHA256 a33d54a688d79b5259c592a272c13b2286b72bd33dc689dce4bde3238e3a87dc
MD5 d7eabdfd98b0c197296d5e5e467b0ca2
SHA1 b0905b0a0267214969984dc47d0ef945d46abeca
SHA512 6a46fbbd18c72c79db1d0d15e45c9da61ed4fe926a6604944add4ea7b296c64c168aebc38d268bce173e2ca8555b7765b8d4dc4f4f2a47d437d5bd875bd116b5
SSDEEP 12288:4wvD+34eokaChv9XMC5AdCntR8hfMOhv+16OF4sOGXnx5CVpQkAyCmoQAu:fDsN3K3hvDs4bGXnuVpQJ6Au
MD5 SHA1 SHA512 SSDEEP

Submit Download

srn3nH0crlBmyaDt8jhjnFYt.exe

Path C:\Users\Admin\Documents\SimpleAdobe\srn3nH0crlBmyaDt8jhjnFYt.exe
Size 624KB
SHA256 466a3bd558ee7bfaeb0e57c0ba3d824d21fa0f98ead8876fc46a68fa8d0ad987
MD5 427bc48b113ab6f76876b638142714cf
SHA1 7a3d40f25712ce26adfe5962ad123b51ba0baa6f
SHA512 8f3b473804afda32b1722424cc0dc1d114720f9e87d148776539a3c849bc420290e2846f61a56cf0b548cd5126b8bd73764fd85812f1b42b8d7053658da1ba59
SSDEEP 12288:QE9UN00o9TWB2wMqw29CK5OMK960x6DhvwzMZ/KbYoVIg4B:Q+UN0LJfwLEd6cOh4IYYoVIg4
MD5 SHA1 SHA512 SSDEEP

Submit Download

tsc_wAXM1jCcrQpwwY9mOEhV.exe

Path C:\Users\Admin\Documents\SimpleAdobe\tsc_wAXM1jCcrQpwwY9mOEhV.exe
Size 10.1MB
SHA256 0d990bedac4696a67ad46dbc686750086f72f4795ed8a6121782ba3b0dc736b5
MD5 3b24971c5fef776db7df10a769f0857a
SHA1 ab314ddf208ef3e8d06f2f5e96f0f481075de0f4
SHA512 f70dccd6fd95516eac21b0cc30c70fb5f17c3c8f1f3b28fe3bdaec6053c2de53daf68caf422dea8861e4ab84f3dd7be36965c6998c1380dbf2a05a2a74b36b28
SSDEEP 196608:7PyWqZApuYuBDhM7GsHkE5j5hKAbsZ2i0zdKRVZ6FspAE5EFH73AUYR:7aWNRuBDZsEChnK2VziVZdu3h8
MD5 SHA1 SHA512 SSDEEP

Submit Download

yiVFlYJ1A3jmaWIK0M71Aqq9.exe

Path C:\Users\Admin\Documents\SimpleAdobe\yiVFlYJ1A3jmaWIK0M71Aqq9.exe
Size 2.4MB
SHA256 41fe619fbe5a96e2be0cc43ca6e2ab6712b2914b5dfa08cb2ee4f5a43248bbe0
MD5 7ccebfe91b4c5b3c8feec467941c3557
SHA1 a3ddf2da7133f6b2478eaaaccf98c3fe12e6db69
SHA512 5b09099bfea89b8d14ce2f610b0471d536d56a53bc580b3315a7c81a99511809495e75a93185728b906a4bccbbef9f3cbe0bc899bde44cfbbdaa455b80673635
SSDEEP 49152:2JkMGnfYQFtf7CZvtpIhivte1xNIgRL13DpIwtSqaL:PTnfYQFtf7CNjtAvh1awt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resident_Evil_8_Village_PC_Full_Español_[MEGA].zip

Path C:\Users\Admin\Downloads\Resident_Evil_8_Village_PC_Full_Español_[MEGA].zip
Size 4.6MB
SHA256 be5cab1c27f02733eba30e051d119ef6d619ee3d09be9550c84793db8fd72b5a
MD5 b2b4442a20fd317b06191203449af250
SHA1 4e6b8bf5b083071802573a7f4e4191ab189b64b0
SHA512 5b2c01ec196cc1466ff579a4ad561ef44539d2ad5b4920b99954a3051a0fc0db2fcc90ddfbe38dcc58f7b6e1ec05388b6034a67911a863e8cd307e6e563e8a5d
SSDEEP 98304:4xjq6rix+qXx+OjeBtFN9MdWsYs0/E20DEq4Sz:4xH+8qBi9N9MdbYsvH4c
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

memory/3944-180-0x00007FFBA2F10000-0x00007FFBA2F12000-memory.dmp

Download

memory/3944-338-0x000002409C190000-0x000002409C2E6000-memory.dmp

Download

memory/3944-240-0x000002409C190000-0x000002409C2E6000-memory.dmp

Download

memory/3944-181-0x00007FFBA2F20000-0x00007FFBA2F22000-memory.dmp

Download

memory/3944-187-0x00007FF6273E0000-0x00007FF627B83000-memory.dmp

Download

memory/3944-186-0x00007FFBA0A80000-0x00007FFBA0A82000-memory.dmp

Download

memory/3944-185-0x00007FFBA0A70000-0x00007FFBA0A72000-memory.dmp

Download

memory/3944-184-0x00007FFBA1670000-0x00007FFBA1672000-memory.dmp

Download

memory/3944-183-0x00007FFBA1660000-0x00007FFBA1662000-memory.dmp

Download

memory/3944-182-0x00007FFBA2F30000-0x00007FFBA2F32000-memory.dmp

Download

memory/3996-363-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/3996-534-0x0000000005920000-0x0000000005A2A000-memory.dmp

Download

memory/3996-536-0x00000000051B0000-0x00000000051EC000-memory.dmp

Download

memory/3996-630-0x0000000006A70000-0x0000000006AC0000-memory.dmp

Download

memory/3996-535-0x0000000005020000-0x0000000005032000-memory.dmp

Download

memory/3996-502-0x0000000004F40000-0x0000000004F4A000-memory.dmp

Download

memory/3996-541-0x00000000051F0000-0x000000000523C000-memory.dmp

Download

memory/3996-527-0x0000000005F40000-0x0000000006558000-memory.dmp

Download

memory/3996-369-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Download

memory/3996-367-0x0000000005370000-0x0000000005914000-memory.dmp

Download

memory/4012-664-0x0000000000430000-0x0000000001016000-memory.dmp

Download

memory/4012-346-0x0000000000430000-0x0000000001016000-memory.dmp

Download

memory/4144-371-0x0000000005830000-0x0000000005982000-memory.dmp

Download

memory/4144-365-0x0000000005620000-0x0000000005828000-memory.dmp

Download

memory/4144-352-0x00000000005D0000-0x0000000000B5A000-memory.dmp

Download

memory/4144-353-0x0000000005480000-0x000000000551C000-memory.dmp

Download

memory/4560-403-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-393-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-370-0x0000000004FB0000-0x0000000004FCC000-memory.dmp

Download

memory/4560-351-0x00000000001E0000-0x0000000000744000-memory.dmp

Download

memory/4560-364-0x0000000005240000-0x000000000544A000-memory.dmp

Download

memory/4560-368-0x0000000005450000-0x00000000055A4000-memory.dmp

Download

memory/4560-423-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-397-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-417-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-419-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-421-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-378-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-379-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-381-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-383-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-385-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-387-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-389-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-391-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-415-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-395-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-399-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-401-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-405-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-407-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-409-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-413-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4560-411-0x0000000004FB0000-0x0000000004FC5000-memory.dmp

Download

memory/4856-342-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5000-587-0x00000000092E0000-0x0000000009346000-memory.dmp

Download

memory/5000-603-0x000000000A550000-0x000000000AA7C000-memory.dmp

Download

memory/5000-602-0x0000000009E50000-0x000000000A012000-memory.dmp

Download

memory/5000-366-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/5000-595-0x0000000009690000-0x00000000096AE000-memory.dmp

Download

memory/5000-594-0x0000000009610000-0x0000000009686000-memory.dmp

Download

memory/5792-553-0x0000000000400000-0x00000000007FA000-memory.dmp

Download

memory/5844-557-0x0000000000400000-0x00000000007FA000-memory.dmp

Download

memory/5844-883-0x0000000000400000-0x00000000007FA000-memory.dmp

Download