b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28

Analysis

max time kernel
140s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe
Size

5.1MB
MD5

ac8740eb6a9cc463f3170310db7f96b2
SHA1

653d4a4c492c42909185a5dd9c05da525679efcc
SHA256

b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28
SHA512

86dacdcda462657d6ea937ff7cbe7bc7c42ab17432a172e59f6198872836f17c1db021da3644dc47965f0f97a6147f46c44c579b62fb0bfe47a7d08797f97cdc
SSDEEP

98304:GVzsP7qqdxzjZbZv+clmQp4b49cZbk8vEIXT6Thv/kTk9p3:GVEOSFTmQJuA8vEID6db

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe

Executes dropped EXE 5 IoCs

pid	Process
3608	HackCheck-setup.exe
2704	HackCheck-setup.tmp
3164	closeapp.exe
628	HackCheck.exe
4164	Replace.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-AG8PE.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\unins000.dat	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-2J4HC.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-7VEBO.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-4KJ42.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-TOAPQ.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\AbCommons.dll	Replace.exe
File created	C:\Program Files (x86)\HackCheck\is-ULI2H.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-JS1RM.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-I7AHC.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-5LG8U.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Licenses\is-HLF43.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-RDGVT.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-V1NN9.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\AbRegistration.dll	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-MO3RK.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-678V3.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-CH6Q0.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-2C6IN.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-UMIIR.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-RN26Q.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-A46KG.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-VAC18.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-037TL.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-RSMO2.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-2GV3U.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-2CP3B.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-MBQ2A.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\AbLauncher.exe	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\System.Runtime.CompilerServices.Unsafe.dll	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-SV79F.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-SAJI3.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-P23M1.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-DPBST.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-CG8JB.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-B2R68.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-AP3SP.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-D87EN.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Licenses\is-T1A16.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\AbAnalytics.dll	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\AbLauncher.UpdateRoutines.Plugin.Base.dll	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-5D3UP.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-5G0G2.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-572RV.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-99E8B.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-1NSMV.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-UEHB2.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\AbLauncher.UpdateRoutines.Plugin.Base.dll	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\System.Collections.Immutable.dll	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-J4FE5.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-JV91Q.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-55080.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Licenses\is-PB5P7.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\is-01TIP.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-G2P72.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-E2FBA.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-3SLU1.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-9SIHF.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-L7QA3.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-THHIU.tmp	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\System.Threading.Tasks.Extensions.dll	HackCheck-setup.tmp
File opened for modification	C:\Program Files (x86)\HackCheck\Program\AbLog.Commons.dll	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-AGRK7.tmp	HackCheck-setup.tmp
File created	C:\Program Files (x86)\HackCheck\Program\Assets\Languages\is-NRK86.tmp	HackCheck-setup.tmp

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-6DO88.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-7CTHU.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-EE2RS.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-KSVTJ.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-49ND5.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-GIOPN.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-3A5DL.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-P9GQP.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-TKS1I.tmp	HackCheck-setup.tmp
File created	C:\Windows\Fonts\is-8ESV7.tmp	HackCheck-setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HackCheck-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HackCheck-setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	closeapp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Replace.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	HackCheck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	HackCheck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	HackCheck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	HackCheck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	HackCheck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	HackCheck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	HackCheck.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	HackCheck.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3164	closeapp.exe
3164	closeapp.exe
2704	HackCheck-setup.tmp
2704	HackCheck-setup.tmp
628	HackCheck.exe
3016	msedge.exe
3016	msedge.exe
5084	msedge.exe
5084	msedge.exe
4800	identity_helper.exe
4800	identity_helper.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe
3004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	HackCheck.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2704	HackCheck-setup.tmp
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe
5084	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 3608	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	82
PID 2656 wrote to memory of 3608	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	82
PID 2656 wrote to memory of 3608	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	82
PID 3608 wrote to memory of 2704	3608	HackCheck-setup.exe	84
PID 3608 wrote to memory of 2704	3608	HackCheck-setup.exe	84
PID 3608 wrote to memory of 2704	3608	HackCheck-setup.exe	84
PID 2704 wrote to memory of 3164	2704	HackCheck-setup.tmp	85
PID 2704 wrote to memory of 3164	2704	HackCheck-setup.tmp	85
PID 2704 wrote to memory of 3164	2704	HackCheck-setup.tmp	85
PID 2704 wrote to memory of 628	2704	HackCheck-setup.tmp	86
PID 2704 wrote to memory of 628	2704	HackCheck-setup.tmp	86
PID 2656 wrote to memory of 4164	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	89
PID 2656 wrote to memory of 4164	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	89
PID 2656 wrote to memory of 4164	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	89
PID 2656 wrote to memory of 5084	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	90
PID 2656 wrote to memory of 5084	2656	b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe	90
PID 5084 wrote to memory of 2084	5084	msedge.exe	91
PID 5084 wrote to memory of 2084	5084	msedge.exe	91
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 2408	5084	msedge.exe	92
PID 5084 wrote to memory of 3016	5084	msedge.exe	93
PID 5084 wrote to memory of 3016	5084	msedge.exe	93
PID 5084 wrote to memory of 2248	5084	msedge.exe	94
PID 5084 wrote to memory of 2248	5084	msedge.exe	94
PID 5084 wrote to memory of 2248	5084	msedge.exe	94
PID 5084 wrote to memory of 2248	5084	msedge.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe
"C:\Users\Admin\AppData\Local\Temp\b27a8a72097cafdae1b3a6bbdd2003544765247c9f3eab25083ea7a642ce2e28.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\HackCheck-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\HackCheck-setup.exe" /silent
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Users\Admin\AppData\Local\Temp\is-9AJCV.tmp\HackCheck-setup.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-9AJCV.tmp\HackCheck-setup.tmp" /SL5="$40286,4292678,904704,C:\Users\Admin\AppData\Local\Temp\RarSFX0\HackCheck-setup.exe" /silent
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\is-FHCCH.tmp\closeapp.exe
      "C:\Users\Admin\AppData\Local\Temp\is-FHCCH.tmp\closeapp.exe" HackCheck
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3164
  - - C:\Program Files (x86)\HackCheck\Program\HackCheck.exe
      "C:\Program Files (x86)\HackCheck\Program\HackCheck.exe" -install
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:628
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.cybermania.ws/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85f7346f8,0x7ff85f734708,0x7ff85f734718
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:2408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
    3⤵
    PID:2248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
    3⤵
    PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
    3⤵
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,2524330001142082172,15638559741089366285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HackCheck\AbLauncher.exe

Filesize
21KB

MD5
ebb842d5d9fb489c717142671a318977

SHA1
936dc2769c0eb6585a2af1c60f28f52d4584abfd

SHA256
c88f52ed3652a00a0f19c7d6a48384a2cbaa29fe8a00ee1e926d697c7cc3da77

SHA512
5ec129405d1ef0e5ddd3455cce97aa8cdab77827368024698899497c91ab386e9c1636e1c104edcb028cb2e8abd0da4b72d9f4880bf04107ffbbe52e3d8087ec

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbAutostartManager.dll

Filesize
32KB

MD5
8bbc27764bdc7fa88b4f9b705ecd7428

SHA1
6a6965b72cfe4c5a7720ddcf37a4ac29fb6fc7f1

SHA256
e28ffe1e0217e6bab8bb443538490eecaf62ababa6bb86dde51ef37bd442b0e4

SHA512
d002229e19ee4d4ac7824aed0acfa06457133c7e7e38ceddb272eb61590cfc5b0119a33cd5ceaef9682bbf579297e5880e0ecc388fa6bf33bf7372815c1622f5

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbBugReporter.dll

Filesize
92KB

MD5
8f108582e0b7ed0cc664145034660fda

SHA1
afef15faa9a701bb31927a1cc3b975bfb4ef2a12

SHA256
b590f8a1506aa7dfc0359070a52ffc8d71f3697062045dd14d311b50fbce2bdb

SHA512
4bdf2dabe2425569c7d1d9723417c55fd1549907a4639bbc31a47c2edbf3dd6ebb936d7ca79c3ec17ff589cbd965fe17d5c76f4d8a9d758b69f767d02e561afb

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbCommons.dll

Filesize
133KB

MD5
6a4a096485a6e918c8d7b53c680014f4

SHA1
bec91d4659855f8f8fc2587b8301d1539eb1f194

SHA256
8d14b58d25d9bb388320ec3b7db0c5964e0960470ce63e1979ef4c3b8c311ed9

SHA512
934c558b81a8b5bc19fc6c9a0d86d14b007a41202041a8ad41b9fca1e2d4c58d761252c8403dc2f1699204e374816e9c2a88ac69a87df02754aa319b58b81cac

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbDefault.dll

Filesize
525KB

MD5
4711177c27b49b0a57619d5402f6ddb7

SHA1
db93822ea6cfab26197d1c42085888e10aebf93e

SHA256
78be0bb78a3e6dc2f2663ea86d2ec6716d3b83884e0e6aebda45943d90b142bb

SHA512
dce74da3d47feabebca086490fe7d41ec61e05debe3ff8a6c1379cd16e3afe99526f1998e3405ec074d11fa656e18af335330dec9b7fe7b6ad5d317636af3e3c

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbGui.dll

Filesize
305KB

MD5
ac5da121c11fada091db1b778630951e

SHA1
3d259216121b183d92c496e5ad4c5ae3500944f1

SHA256
24908e26ef685c4d430e9a88e459f968c3dac6015876498e798c2ab9b3c25ecc

SHA512
c014384ddf5915120cbc34d03b9efdf9dac27153f4a1ccebfa3c7101f1ddf0dda48a9143e86ddb25e94c7caef4fc1e0372445a8a349c06071187258cd418bc32

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbLanguage.dll

Filesize
51KB

MD5
b418f3772c34543de4b061a381a02319

SHA1
b8e9b6b1538dd1db020dd0a0850c2f878853af2a

SHA256
c7ab747cc3a321d8520d963875d0e82b0f33869bea31e1d190165a828bc1e589

SHA512
f109b2f0214cf55025b2f8f78604ad6ff84edc3e1f55d915d1c89c938e274a99a60539c501d891f6bff1844f4ef3909d73f35f6b65a4844e4f6eb2e3e6b779ad

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbLauncher.UpdateRoutines.Plugin.Base.dll

Filesize
16KB

MD5
fdf40cba8b300d7268a5203b050402af

SHA1
7658f20213aa3091dafbe0b71caa278176a2a13d

SHA256
18bdfdc3a1a24f331e986adeff414cc790b5422aa84d8782c03ee38acddb134d

SHA512
c4e8f02d93fc534abb92856feb3b838e302337114bb7017ab07d8d1668985eb54fab4638919531940c1c1bb10bf26fb1bd177690c7bdf02fea1372824f1d0c01

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbLog.Commons.dll

Filesize
16KB

MD5
7afe01fcf7e10c750b45e610f7845115

SHA1
76bf82429b24d2276313442f9a95846a15a12f96

SHA256
03b0fe0417c112c0bb78425891f492cdec45cf45571c70575f4171fa2ab133dd

SHA512
be3e44985567081b38fee1e03a3669015b553b82ad4032210f27b0a49844c603f853aeb9be5aa9c18c6830518a02cb2f4d7985d0a7c0cad90930ca5ba872667d

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbLog.dll

Filesize
33KB

MD5
1d3a25897558ffb7720279fb5b588644

SHA1
949cce6b711d472eca34522651b082b2281a310d

SHA256
a225389e9f2134e1aa9ac2d7a3ad6ac2447531302010f5626fa3fb4f56d0fa8d

SHA512
4884e82df5fae3ccad43bbe292161ca689adba1438ba89a2652a92d2988128d46d796e252032ed27f34e63c1ab5084f0e758746d423191fb6e9867dcaf1dbb65

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbNotification.dll

Filesize
51KB

MD5
7ea2263f92e00da34cfc64bf376178f9

SHA1
d72f5debec8745c3abc0428c9c1581fbe1221889

SHA256
ca9eaa08728304860534393b528397c4f1f3cd55a78f7b67a914d69145bb948d

SHA512
b197b3a5f7a827005a47ee265899ec68f337da305c9d4aea5189aca11ec2a2f7c2fdcaa26495c9ea9a8473c663f28d0228ee7cd841dd7db974887616dae0f021

Download Submit
C:\Program Files (x86)\HackCheck\Program\AbRegistration.dll

Filesize
286KB

MD5
29e06a252c26c5410c88bb2b9db2a304

SHA1
5462a10363cfdd3e123aea9a89304564440674b5

SHA256
5fa33c35403719f810d5527112c7fe67b35da3fede63b5b128668b377c00d7f2

SHA512
b70f1d976deb12fd042fc24755c15c0031e0b596982dde31912d40699ca9dca448d7fa6378867f6a310f6c70d3a4dd80ab9746adc8ac158f4e4aeb17d158ce50

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.cs.lang

Filesize
2KB

MD5
a6d9afc372cbd163fc2f4d06e6e8d270

SHA1
7490dc10c64d3facc3e2406d86773a19562433bb

SHA256
1cacbcbe02f852dd86d0339205694fc0d646f1717f0c91384d906ea4e2ae0de0

SHA512
c99688f4d4b980f7b1dc6b54698cebe188e25685db3d4a5c6ecafe988e72232d539989a68bbbb043bce1c389069609e82aa599279b6217aa775e2daca0be763b

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.da.lang

Filesize
2KB

MD5
48282d5d0ae3804d8494787653d11cf5

SHA1
f275f428c492aa5ddf66d99ac067450ef216a572

SHA256
a45461e4bd5630f6c0d2c827307a34e6f84c08c033880f555673e084f1f12326

SHA512
967191fad0876973d3d7a027dfcf4f1cef7bea880a2ebc4e13b9314804b9b83797d183d6bbb5ea43ea036afa868a1c2b0b5f8f0ae54b61988722a71b30cef4b4

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.de.lang

Filesize
2KB

MD5
2a0cd43e6330a4fa77735fb192e479f2

SHA1
0574fe2dccdd5cded5b2c8bcc16757443e83bfb0

SHA256
fb9ed47ae631c4576eda2fe6a54e9959eccbe3605a37aca52b94dce953049686

SHA512
af78e2c938c58364b510586c93807314e90fcc1e0855a526679b21bc57989ea0873c997ca463cc5232e5987bb1b24f25ff8473969e69e0a599ea8e5aebe5bcc8

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.el.lang

Filesize
3KB

MD5
1f963282698ecab57139c3070f9859ab

SHA1
6a6f99c8ea1b69d3853a9c10f7fc20e2e51e5c5d

SHA256
220708d0854a328c4648aa553a6de97f3230e9e8e5d78071361300261723d1e7

SHA512
abb2d285d9dbf6cf5ee4535bf4db8dfdb33cf14f2b7b25bd7681d32bd243256487a5d387518ced04fe0a72aabc9975183b7f538203134f484e824257c981f6f0

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.en.lang

Filesize
2KB

MD5
f554bb26648051624635037f4747a10d

SHA1
cc0eb4fe1dfe49d30a143d91b94342f88435c7b2

SHA256
6c75df9f7b2d6cfb5c40a174b16fb42356374f127310cfbc360cc5404dce8207

SHA512
1527e8b37282bc1bac4581e21931530d6e353ffa644bde9fb37b89454d27e38c1b0cfd794f0ac32491c1789f20ca7585631b42cae6b905d1d96c66eb9b0ee6c8

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.es-ar.lang

Filesize
2KB

MD5
6d8005a391ac5a80dc362fc890eb1441

SHA1
5584cb4aa4afc51816149aed43b2699f54b2e950

SHA256
8929e6401538219fce4e4d6d94bdf2f759646a0e02c252aee171c1bfce547e71

SHA512
4ce0c227bd54fcdfd0790436390cd671f3346a558d9e757161d980daf140703f0fb1c7e148fb426c747857622be0913f4228f7184a845d9dc688cd68ef4287a5

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.es-mx.lang

Filesize
1KB

MD5
04bf85db4c87e6c9538a39be5494c0cd

SHA1
3554bf01e347db6d2d6245262e362fa59b54baae

SHA256
921d5679509738f6f8eacfa525321b0ceb6d43f6d22b2bd0480dc72e2cade846

SHA512
1fea7f4b115610a5c91e1f78601069cf307a3d71c2fd38b8fd6d61a26292c965089087cb1a130a88e1f5d5fbbadfa489915f0081621a6a3ff2b1a0be95b8dd6b

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.es.lang

Filesize
2KB

MD5
a63fe34da6991c42751e23881c05873a

SHA1
cccaa68ccf2851333b9faa41d6e98c13312504be

SHA256
ce0682475ad87d07a80ddb8acad6c40264ca5654753bda17d031754a636042be

SHA512
40d4a158fcc087f8a1ab942e9ab72079ea8325b2271099fc59dcecab1895d2565cfc09447d66ae8dc450aeb47722298ef974d0ac8da70161a63112164a086467

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.fi.lang

Filesize
2KB

MD5
d997404064fe8a4be1f71bf77f8c68d3

SHA1
eb992add944b0a6d77fd335e176699020e5b6fa4

SHA256
83283b858784433fb891b0e92c706e0764a53c3f7572438d3dc1c05fe9b2e2ca

SHA512
92475af2380791909c2120c3423b41164d1523173c8fc966997d42f24666e8959900073e664a45eff9cf4713ef40dd28a1da873eed0306656124aa517898e784

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.fr.lang

Filesize
2KB

MD5
39348231183beb6ff577d33037aebc1d

SHA1
2b538f4c907379c81254cd29e4432f17af9b5543

SHA256
cb7c59df2452c94a742c519764b30d439489d196c11ee5d8a56cbb8fd259a098

SHA512
dbd3959992027a16792b0f31e71ab0ae13406b1da39509cdb75312348d994eeda34def10d9342a0b7caee3ba6e409cd2166fb0a5391e6a9530466dabc1b3930c

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.hu.lang

Filesize
2KB

MD5
e2061d398b23cf140ea2a6c68f3ddb9c

SHA1
ce20948c29aa821246d6630bbe97123ebdbecd0e

SHA256
a2f6a906b55cc9dd84b4d6afa06a21211e7f2c3a67ca56d81ce20eefcd43e13b

SHA512
3352d9490b4036fc5c193b5f57abd53883ed0a32f17f29b5e47d2b721a85e0be5d40a42ccfbf46e8434cde96bf40d69aae13a75d3762ad9dfcd89cb984c8bd72

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.it.lang

Filesize
2KB

MD5
ff53e9c6649002bf70b19216a558b778

SHA1
cba2dba38aff1f63971f12ffc51395b065a783d3

SHA256
479d080cac958235f94ae10842c128f28ff8a9fd9adad71746c946cbe80cc7f8

SHA512
9bf46e8e59a73c8f888c5c74123343e43143d0c3df0da7968666b4e29169c2015a1ee5dc2041d876bb4ff89d3cfede83d130c5cc7f078cb167d292a2fa9dc126

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.ja.lang

Filesize
2KB

MD5
30ef668a848cc3366715cfe602245ded

SHA1
d392eeef50f0ee93429a1420fbb7d12ca3e1280d

SHA256
80afe4680a80aaff1ac2a5d0eb86a24280b42d8caf47801661372855e83a9911

SHA512
502bd806cc6abc626a820013fd21851196d475abe9facffaf2391ca42bcf8f1c8416bf253b04d3020792642f09287f00b80fd3ce80b14484daa6c0a43dbea4c9

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.ko.lang

Filesize
2KB

MD5
f430ac1ef8ca7855d98a99f22cb70c30

SHA1
e14850b0b8065794686308e2fcbb729fdc2f6ad0

SHA256
18ac1391c6d9be59142a3b3685008b774ecbf981b1f0237b5f3dab2845cab27b

SHA512
9787f8ae24c832692b99b89b3b414276630039e86b1030a116f2edf54dc2907f0f7318e2342544c97f17b8faa3faaa884c9bf49c1093fbe75cf191495ec0d8de

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.nb.lang

Filesize
2KB

MD5
92d6fc446ad02f040cf8d44efe7aba9d

SHA1
be888aea4549767db0d0de0090e9a1e5a306f6f2

SHA256
b125d09500a81603abdba5220cbc682298217ffcef30b36fd3df8ae51611f689

SHA512
acbe7c907d81623e3eb3531e466fcbdf8579b62a509a0fac2bdb258b20480d3be836f4160718eb24fa8da4ee24ef86ceb23892d985b407bb1906ae11f8e1a4c0

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.nl-be.lang

Filesize
2KB

MD5
4e5d0171b80ad3ae4786e659e7e376c1

SHA1
aacb8b38cc95ccab38b04b33a49d2e12df983e64

SHA256
e42076c62c66ec16db8da4076adcfbcdaa05037d3d7af95b1b71595794f55ec1

SHA512
8a1af5a96be7e7a99046045baa31a8a9fdeb77b2c65988728ebbebaf558a0ec9b228e1cd9651a4c3d90b1b88ec5c4f3a57446d3f732c489e37e4625faf27cd14

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.nl.lang

Filesize
2KB

MD5
c7130bb52b7a50d0280f05f25ed61749

SHA1
6d6e161a378aa16e56f60b306e3c048535ea9b58

SHA256
15ee1016ad7dfa4152e95b866fa8aa268306a630b25f0eb2246873492595ac8a

SHA512
f8fa81ca4bf331097574e44d16d2a9420c2e2028d597f5dc0579ea39a6d6cba4a58bac09b3665eed4dd847f751b8a298dbe704f40479c32de8bb1011b72c6961

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.pl.lang

Filesize
2KB

MD5
a98089a62b1fbe0bf070a170080dd49d

SHA1
a5684ddd0c23b6ea8de08769263164b3d48e9a3d

SHA256
579aa8ce6c81bdda0b102d14331ed1e4b791adac5f15a9386070b875a398ef8f

SHA512
46368ca5e5499465e2e7167fd81d84e807de4178a7b458ab91c355aa6e80c4b4f9a55325e0e6bf1f0068ca5adf2db3c3ba9a2974766ebb521f63d50b44c463b5

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.pt-br.lang

Filesize
2KB

MD5
b29c84bf43664a73ea4c6fe9a6140cb8

SHA1
55e58f6a08d1fa60426033e704a92d24d8abcb85

SHA256
f355cee8f743d61caa93b15fa22a3c4444f425201a1ffd289e676cb1e2f88008

SHA512
76faf74a5506644d452692bd6af3acb98f79242926576b021873c77c0b99a748dc1d2a2eefcc392d899456c2e6b974e496c0c371e922872f1a35874923e345b4

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.ro.lang

Filesize
2KB

MD5
706caa735a807ebc3caedcab0986d85e

SHA1
fa6163264e8cec4a9e4223b2a878b14cddf03ae9

SHA256
c97716484eac637b83011a0fbc58b586bde6425e05d7d568bc4f6789db071e91

SHA512
0c23ac486b8ee1ae2ce3b17fd7faac4216a8d7479356125650c595c3a87ef6e7e3f4362ffe70b77dcc28ceca04455bf8606e1fcb3634279e84c37036295c369a

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.ru.lang

Filesize
3KB

MD5
1e55fcc9e71cab0e47b18ef92b74c6b3

SHA1
cad9cc9ef9b83c90955a76cfc7753618968e6dc7

SHA256
5566b83de39da1e7bfb33cce4466dde1b446444edcc029d795c57111c42eb7f9

SHA512
7c50fd4356739b059f6f18897ee9f89ee055ad1480a254aecd132d38903388766794eaf64e42267f277a8ae8faf48cb66afa7d9349e8ac5ffde0ec7864ec31e2

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.sk.lang

Filesize
2KB

MD5
bc03942579c9acc20275fa8351911bb1

SHA1
0c151ad02475224065a4eb8e98df64e5d979db3e

SHA256
7aec25ea8221a0c70758230f6199d32477aa4a0b3de76f608c37d8503dd16532

SHA512
564847e0cebdd9feb0c7927093edf6e5c4f23f2642c480868f0d071f3ca646025efae4cff3568edfffc36cb2d596f74d4ed55462498188aa8a15ef783f36a569

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.sl.lang

Filesize
2KB

MD5
0238c8496ccf4441e0f4f027a984bb9f

SHA1
421d0f5529bcaeb6127b677d363347cebfc7ebe3

SHA256
aa9a439b009562783d5517243c4bb12a9d79b363110ebd7d4ec32b9536a639ec

SHA512
ef066a68125ec90728bc3a33a0541289ed003536b356a407836f848406795cee522583a7e7ba61d461fbf890dd37d6b1551169081bb1f13953daa8024e1720be

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.sv.lang

Filesize
2KB

MD5
84c8334ee6f999ec3a97a20fbaa9e64b

SHA1
62f180ffa6be12fa3631761cea13c1fba59d6a16

SHA256
a62b0fed517c194e3db27275c2f29bcb61d9618e5d1f8a29949d5b80881948c8

SHA512
213ebf7a739fe45334d319dd838ce416233d9d769f1959483ba2d71722e3a9700f1780e87f76e286b983427520042de773ceb7c2fdde8a38ab2bb5913676ef6a

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.tr-tr.lang

Filesize
2KB

MD5
2870193c262d90ebef4fe8e8dd41c0bd

SHA1
4ef0294358bb157ad8e65aff4813317aee45acf0

SHA256
aa9b6bff3bfad946e9b4c4bf6b661315ec982e9a49b5962d974ba25582d1616a

SHA512
72ab7cded3fdda36ebf33e601ea19a5275aaf0838e10caef95eaf0f72311c07205dd867a711a54087ccb8807dafcb691b5f48a8c0629fff278b7f708a4abacf5

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.tr.lang

Filesize
2KB

MD5
914b2860029ed27935cf93046ef2c19f

SHA1
2f183f43df02dfe948265fb06c341f4f8c70e879

SHA256
7dab0308d5f56b3d748ce878ae080f61726ec1e94f8ecd8043683e0970d77d26

SHA512
d7238576618763a192e3f0a2bc4de9f1f7268202a70e294fd762522f07ec531608e2bdd115ea3416c16213b95ffbe61f1eeadd930872b0ab117e8dadc2e7a01e

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.uk.lang

Filesize
3KB

MD5
f76c68893f5f818a0d5b7634690294ea

SHA1
ec52e60a9254ee2b3ec11109d4fdb22781ecde61

SHA256
472fef7c77f7e416fb60c6321a23efb8407fc14a7e6fa42d221f74e9344feb0a

SHA512
97087d3fd299c6b0621bb21897aa1ea93050a2e50bf54f76a03306a30d897b9f819bf2521b0140ee3edf0b40fb8cec756ac51785b7ed7355f1d0f50786e96aaf

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.zh-cn.lang

Filesize
2KB

MD5
2b502aeacbac8b9d7a9254f8dc3a58c3

SHA1
266f6dc70750ef81d29c921b9bc54b88240282cf

SHA256
86d15de44b1a7a20e9c8a5c0606a417f7ed5649967869bec73a68ed52621c6e9

SHA512
47f25df69bd0dd83bfe6821d371faaf8a2f3d894faade8d6dab8cbe12bea9451c49d9acb3fbe76dc0638adfd08e491f65229abcf6833df221606986c04338cdd

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.zh-hans.lang

Filesize
2KB

MD5
92a4750a9cf239ec2930ab4395dc5922

SHA1
53a0f608f834a14bcb05ee59934fb2dc18589eeb

SHA256
a0850825d5c99af884986e334e49baf8a630c4e20a6420c8bcd7b449a9dedf9d

SHA512
4578d3ede4aa93d674cc2691b7b12a6e93a34c3461da8496994b208a326a7dec95c5fa280dbd12be0749a4338d87ae0377edb821937a267fb3e3eab3328c3a8d

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.zh-hant.lang

Filesize
2KB

MD5
b2ae4aa7ace75762d295c4ea52a09428

SHA1
06574d48a43e1557172ccce28fd68736efdae55d

SHA256
8307d762d8e3cb100c09dfab16103db1b0c87684bc4c867f29fd8320fbb93fd4

SHA512
aa869230935bd2804681537c34620a5429e2c0a8a273b67061279d5abab080e22a761a72dca04f827a2333080b32b9286cc871fc1316c9cdd13eae0045d171d0

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.zh-tw.lang

Filesize
2KB

MD5
aec088c40e3c0ca9893a72c9c178788a

SHA1
9750fc8864d962f2e1bc66595afdb8ba14c77ddc

SHA256
8aab9ef298532a7ec2600c11d4be9060916f26d94488d7cf30ed3936b29fde38

SHA512
97422946c91d3d9c4da73992ff289b23f5ab231d3748e8a78087ab81573873e4abf2b5cbbed5298fac5d168858370ababd30ed8dfc5b900a9f354bfeed0bf815

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbBugReporter.zh.lang

Filesize
2KB

MD5
4e2ea4c80e33050c71d2a2b8e0a40b43

SHA1
be19ca640fa9059a506a8f11d382d294e95a4c5e

SHA256
c7ca0393da1ac5601dfdf04f0eff1e8ca8656c3e5b5ff9d71365f75e3aa85493

SHA512
160d734ca42fff2cc3805649ebcb30c88ac056c834ac24c6b30befe0f9c5af76eed1b4bec38b1abbb3b84b9aba02c8f7c9a5cdbef1959a77d6c599022b09840c

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbDefault.cs.lang

Filesize
9KB

MD5
a21fcf8c00ec8d9b4a8434dc664e8152

SHA1
6fdaf38ef521755d43d77b80b39b8c716a9efb5f

SHA256
7fa946191a4bd648e179013abb73d769e0568ab2c893da1c9a5dfd09c8f3c5c5

SHA512
21c8012545c820cd99bc31b877b5edc7d9f2cba81f92efcfe7bbf792c32db1d21215e02f44597a85a5750fcf874d3b32e27857a1aef95c8c00ee5fdd3651dd89

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbDefault.da.lang

Filesize
9KB

MD5
0dca10cca464f316b8db4a2dd2057f74

SHA1
b647de873c584f64b17527e38bbf614b039837b0

SHA256
c4f80c0121c62cdd9a975f4df4def29a4b35c180bb1c1285f9c2bfa21ccaecdc

SHA512
9b5d3d8a62bdfc7a3981316eec3290e034352a88412f5a8f6f73011a62c29005edfca891b4d9b8687a55f167bb5bdcdb2b8d87889b90a7363c2de0c8dea2b62b

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbDefault.de.lang

Filesize
14KB

MD5
23165bc57296c3ff08a33eaaf036f2f4

SHA1
5a5f26acface3c2a3a99c2541ff0b4c7c1e2a1ee

SHA256
99c993572769f0a268c6f017973adfa6baa30b86d7666650d0393f20b61e7342

SHA512
96d7a195c2aadecd1cceebc8a70866c63cd4fd28c69d5b129fd43e75e45d64314dc9b3e228cc32368466437efc6e4f99c9cf3e30bdd3f8884988351bbc7dbaf8

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Languages\AbDefault.el.lang

Filesize
11KB

MD5
8113ad3618c1d6b644a7645d45577a03

SHA1
7eb26ed6a4d5e94042625e9497b7270f6fc969b7

SHA256
4dbfa138fa1c99b27074050b38708f563ef21b59da85cd7cb285d8392117d867

SHA512
6ecaa458eba70eebb3c2e68bc332756ab3d01cadcc003bb01687007e2266330cf0adf608c9d4f0e6bdb71cfc2c15fbc2398085365a8f00c21a4d472d9ac99eb3

Download Submit
C:\Program Files (x86)\HackCheck\Program\Assets\Licenses\is-HLF43.tmp

Filesize
11KB

MD5
d229da563da18fe5d58cd95a6467d584

SHA1
b314c7ebb7d599944981908b7f3ed33a30e78f3a

SHA256
1eb85fc97224598dad1852b5d6483bbcf0aa8608790dcc657a5a2a761ae9c8c6

SHA512
e2f81cb44129e1bc58941e7b3db1ffba40357889bace4fd65fd254d0be1bb757625bdf36bf46d555eb3ca4b130dcd1c05225caec28d8472dccf52a63dbd6e185

Download Submit
C:\Program Files (x86)\HackCheck\Program\HackCheck.exe

Filesize
2.5MB

MD5
9ae2789e52040a213653fbdb9d0b5c36

SHA1
19a44e247fe381ca7f1f368b7e8a9ee1623a5318

SHA256
80ba4f6f8ad3616e901c672b5baf171ee551da300d60313f59d4033010f803ef

SHA512
b5e7896a0c875e6007c0a60b425f8bc1c5ed29cee4d035d790420c7d3b213d01362a5212e154f59ad9e53f9613a4247ca1ea5a1a7c63fb3220f366602f9874f7

Download Submit
C:\Program Files (x86)\HackCheck\Program\HackCheck.exe.config

Filesize
3KB

MD5
e97b962ff392ec182878053913b717c1

SHA1
2330d9660ce5e71f0dd84b3460d56394b3241f78

SHA256
811cf588103695a46b9c2712ca9c9f3c1f51ebba35313d565f4dbcb0991fc171

SHA512
e4c54eb5029e6710b3b9df83619c7fbc10e141e49a6bafba30d84791f2a75ccafe3d75aa04a574f8a958e034cd2ce1f298077cf6d3aa37fc0a314dc415f7df4f

Download Submit
C:\Program Files (x86)\HackCheck\Program\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
26KB

MD5
970b6e6478ae3ab699f277d77de0cd19

SHA1
5475cb28998d419b4714343ffa9511ff46322ac2

SHA256
5dc372a10f345b1f00ec6a8fa1a2ce569f7e5d63e4f1f8631be367e46bfa34f4

SHA512
f3ad2088c5d3fcb770c6d8212650eed95507e107a34f9468ca9db99defd8838443a95e0b59a5a6cb65a18ebbc529110c5348513a321b44223f537096c6d7d6e0

Download Submit
C:\Program Files (x86)\HackCheck\Program\Microsoft.Win32.TaskScheduler.dll

Filesize
336KB

MD5
db685add9bedb3d2e66ec49fdf2dad22

SHA1
3e22e660baf7645af71985b2ea55045e82c19b2d

SHA256
a24109ff6ecb58252804571c40c02d704bcae034ffee0812d1c45bff0ebd5d0c

SHA512
7df970e1c59c68ebc025774471b1fe558ac5df0a84d8e6a15af118b5b9c78defd648fb3653b1c2d36d572c37b04270dc5b8659aab10c4e8a1da44ef46a9cd6f9

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Memory.dll

Filesize
138KB

MD5
f09441a1ee47fb3e6571a3a448e05baf

SHA1
3c5c5df5f8f8db3f0a35c5ed8d357313a54e3cde

SHA256
bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f

SHA512
0199ae0633bccfeaefbb5aed20832a4379c7ad73461d41a9da3d6dc044093cc319670e67c4efbf830308cbd9a48fb40d4a6c7e472dcc42eb745c6ba813e8e7c6

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Runtime.CompilerServices.Unsafe.dll

Filesize
17KB

MD5
c610e828b54001574d86dd2ed730e392

SHA1
180a7baafbc820a838bbaca434032d9d33cceebe

SHA256
37768488e8ef45729bc7d9a2677633c6450042975bb96516e186da6cb9cd0dcf

SHA512
441610d2b9f841d25494d7c82222d07e1d443b0da07f0cf735c25ec82f6cce99a3f3236872aec38cc4df779e615d22469666066ccefed7fe75982eefada46396

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Text.Encodings.Web.dll

Filesize
77KB

MD5
c77ae3414d78c1f082c65415fae69661

SHA1
3b35461d86a774535ac226ca9706fb50332de20a

SHA256
c792bfe3f43c894e20339252d159a96a20ccc6e13322b2d382570ff97939e501

SHA512
08941ba8be5031cc4e363a916525437c62b409576c91c10fc72795faa10bc989f0d1797b576802e208dfe4305a4447c0299e2755ba92f97f531de1f56fd5865a

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Text.Json.dll

Filesize
568KB

MD5
962630bd48df30b2704db18658887f7a

SHA1
b57d63dd1442a9c350fed5eb0b509835809523fb

SHA256
1f2452eee60a8c4ef3a894ddbac663f91ebba3eefee54e1b7c424de1f82e6b6b

SHA512
2182418471c12421bf885f31e6b2120e1ddb4ffe4c16baf527b10bc307c48ef037e26a2a3a8d4fc37b7f5bf2694c0330ef6fb7cd07ea5a638ee978ea85b8868b

Download Submit
C:\Program Files (x86)\HackCheck\Program\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Program Files (x86)\HackCheck\Program\log4net.dll

Filesize
274KB

MD5
bec5b3c5dfc413a8783056f2e30a0ced

SHA1
99fb987441174bea0751dd2e531eaa9398ec81c4

SHA256
b26a06978f6629ddd350bd1d456183bf7f11972f5e29019bb66b5d40091c189c

SHA512
1b6612ab9dc854c7650500d588fb2eadce4334476186efe4d3c53260a3d3f304d8600d6e372c41cf42c59656e841ed76ddd889d47780ef937f1da3c8cba61043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
4a85dd88c56167a36338050307d79329

SHA1
c702593d8c867fc9261b45cdc14850459e496538

SHA256
6bb140bed234f9297ff7b104e8a2149af7ffe95e283421bb36c561c9fc596faf

SHA512
84158826e90dfb2103fda19bdf47b6c5cbc7f245813da4c7e16300ea5a106151d3cca2b73a5259a80f6b14a4d7c5c0ec96e5c20470b6cdbb1dce330e934ddd7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
55d81dc2e30f7dcf28a9391fe1e40d39

SHA1
0a93a5a147e5d12da461d12db3ad02c2ced24ba9

SHA256
84494f305bda844c92fb182b8e2efa097320ac157c82d32163991e82e9edc9a6

SHA512
eb02a256c6f7c592f2eccce81b0eec4fc7d1adef196061ebc628983bc0ab4023718760d2783fa6e3c1b1248753fcca3c40ee6ab51ec1fd8df6b57e0ba29bbbf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81640e86ada4bc3ff572ce0510ef904f

SHA1
f05822c0c1d6574eaccc2b42f1ecbfef83a275b5

SHA256
cdbe23d88565ee53bb44f74f2a80e9acbafe433aa1fbd7d53cfb0def69339f4b

SHA512
574e8bd6539a76327345fefac4c67c0421c9d2e22c06330593386dd1e686eb88bdf473b8d84ad4d181b0e3e5ae8034e1e28a37f18bde843aaad481541c0bca52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
532db53474859c8ba15c21d1e2d09467

SHA1
48194dc2efc696f1459c443ea4fb79b91a84e5fe

SHA256
312ec66aed5e6c435236e56ebde8c93e99d2de93346a1ffc5c1f56fdaec27ebb

SHA512
ccae84495f0e785e1557adc47e376ba9dd152adcd5ae7b954a26bcbb0dd806f80f6c903d6a21913ec2eb7818639c4b94bcdcbd1d1f54fa27bbba8267ad8bd8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6525d1f52ce40391ccf04e38118d2f7c

SHA1
18fe080c0b885344bef9ed41d1bad2d65fbef661

SHA256
b0e22d069752985dfdaf129cabc5cfe35fb6931ec7c3347e9e2eefbdfe90a9d3

SHA512
1cb79c2f8feecddf178072ba77050ffd1f84ab7f0f2a4b03d9d21cbc8e5ab6d3265726dd24d2befe67144e5853b6468cc572a3a957690835620704dc57ec01c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\CyberMania.url

Filesize
4KB

MD5
f89e823b83f9edc863ae9e35ea0a5949

SHA1
12db7e3d70e47bd97df335c74cd7323dc48a778d

SHA256
7fba1e8849a88298272be247c2b22ef4a50ac1bc4c83a4c02848bc131e622088

SHA512
d3e297af4eeeb3b8201381fddc426c33ab543db80c0da2ef7ee000ad773cf6895d7221ec17b95806377ea74488f8db7354e23d13c43d87599f6b02631e379d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\HackCheck-setup.exe

Filesize
5.0MB

MD5
173e608ac1ba919433422f8a91f2874e

SHA1
e7d273c23a2eba3db51c0f527f37ab53779b4187

SHA256
095d7f92551741cb1cfbb7aac4b4003e47a11403cb685dd4cef958df083e894b

SHA512
729a0eb3c583d0c22f98948b70fe30955bf991402a55d691225d28378de73db1e7448b763b16ce5e5e1cba4e2ed21abd81cb5df2a5ad2d3741738c7d6bf898fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Replace.exe

Filesize
506KB

MD5
d3d1502865195d02da1070fd53291172

SHA1
23aa710f10836ca2e8f326a1ecb2002751f3ac1e

SHA256
6bf493f28b19283ab3928c7f09f623acad1a4d72c718133021fe0d1ca7308b3a

SHA512
66e57817f28b6651c3c013a6031ce1b53a169f0e64e8643f61d5bdd93df1b04fe560a17474fe92670961abb77961c89c1c79c498c45bbd428e43235683e2e0d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9AJCV.tmp\HackCheck-setup.tmp

Filesize
3.1MB

MD5
4942af10fe93f7b90958454812cd3af4

SHA1
964e0f3144fe397b2559c8289368aa0b4335e4cb

SHA256
acbbc96a175b697447dda3e938ce7314a4332a4783e734e7b66c0eca6b82cc3d

SHA512
a48a047b8358177f83402d188edc03d2cc56d54bf5218f85bc29e22020c98675943c8305b38d66f3b8b53ac9866d902a4d23b99a3c9ce537b410ca76b8eccda8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FHCCH.tmp\closeapp.exe

Filesize
227KB

MD5
9a2bbf4de6279c9321969c6257f48939

SHA1
4fdf355fa10fbd61c1d4c47e21e66b09493a1621

SHA256
40e33b4ded6db4e96b7ba89770b248d62ffd5f9175e2e0b58692084ce3b91a10

SHA512
3afd50668327f518e0d5dfe8200f43ee29cdf8dea8667e31131005e1d0e67acb96f4c218b2ab1f7a3ee926bf600b57b046b5c21ba40de779acc03d130087a4cc

Download Submit
memory/628-777-0x0000027D802C0000-0x0000027D80304000-memory.dmp

Filesize
272KB

Download
memory/628-718-0x0000027D7FF50000-0x0000027D7FF96000-memory.dmp

Filesize
280KB

Download
memory/628-726-0x0000027D7FFF0000-0x0000027D7FFFA000-memory.dmp

Filesize
40KB

Download
memory/628-728-0x0000027D800B0000-0x0000027D800D6000-memory.dmp

Filesize
152KB

Download
memory/628-729-0x0000027D80000000-0x0000027D80008000-memory.dmp

Filesize
32KB

Download
memory/628-688-0x0000027D63A70000-0x0000027D63CF6000-memory.dmp

Filesize
2.5MB

Download
memory/628-690-0x0000027D7E1A0000-0x0000027D7E228000-memory.dmp

Filesize
544KB

Download
memory/628-692-0x0000027D640F0000-0x0000027D64116000-memory.dmp

Filesize
152KB

Download
memory/628-696-0x0000027D7FA90000-0x0000027D7FADC000-memory.dmp

Filesize
304KB

Download
memory/628-694-0x0000027D640D0000-0x0000027D640E0000-memory.dmp

Filesize
64KB

Download
memory/628-700-0x0000027D7FB80000-0x0000027D7FBD0000-memory.dmp

Filesize
320KB

Download
memory/628-698-0x0000027D7FA40000-0x0000027D7FA5A000-memory.dmp

Filesize
104KB

Download
memory/628-702-0x0000027D64130000-0x0000027D64140000-memory.dmp

Filesize
64KB

Download
memory/628-704-0x0000027D64150000-0x0000027D64158000-memory.dmp

Filesize
32KB

Download
memory/628-716-0x0000027D7FEF0000-0x0000027D7FEFC000-memory.dmp

Filesize
48KB

Download
memory/628-775-0x0000027D80110000-0x0000027D80122000-memory.dmp

Filesize
72KB

Download
memory/628-776-0x0000027D80230000-0x0000027D80264000-memory.dmp

Filesize
208KB

Download
memory/628-731-0x0000027D80030000-0x0000027D80046000-memory.dmp

Filesize
88KB

Download
memory/628-778-0x0000027D80130000-0x0000027D8014A000-memory.dmp

Filesize
104KB

Download
memory/628-781-0x0000027D801F0000-0x0000027D8020E000-memory.dmp

Filesize
120KB

Download
memory/628-787-0x0000027D00910000-0x0000027D00E38000-memory.dmp

Filesize
5.2MB

Download
memory/628-788-0x0000027D800F0000-0x0000027D800FC000-memory.dmp

Filesize
48KB

Download
memory/628-733-0x0000027D80010000-0x0000027D8001A000-memory.dmp

Filesize
40KB

Download
memory/628-735-0x0000027D80020000-0x0000027D80028000-memory.dmp

Filesize
32KB

Download
memory/628-720-0x0000027D7FF40000-0x0000027D7FF4C000-memory.dmp

Filesize
48KB

Download
memory/628-722-0x0000027D80050000-0x0000027D800A8000-memory.dmp

Filesize
352KB

Download
memory/628-724-0x0000027D80150000-0x0000027D801E2000-memory.dmp

Filesize
584KB

Download
memory/628-737-0x0000027D800E0000-0x0000027D800EA000-memory.dmp

Filesize
40KB

Download
memory/2704-795-0x0000000000400000-0x0000000000725000-memory.dmp

Filesize
3.1MB

Download
memory/2704-23-0x0000000000400000-0x0000000000725000-memory.dmp

Filesize
3.1MB

Download
memory/3164-28-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3608-796-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/3608-15-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/3608-18-0x0000000000401000-0x00000000004B7000-memory.dmp

Filesize
728KB

Download