hxxps://www[.]byond[.]com/download/

Analysis

max time kernel
169s
max time network
172s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
07/11/2024, 03:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.byond.com/download/
Sample241107-dlynsswpdk

Score

8^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
2864	515.1646_byond.exe
4832	DXSETUP.exe
5132	byond.exe
1780	515.1646_byond.exe
2440	byond.exe
5240	byond.exe
4620	dreammaker.exe
3380	dreamdaemon.exe
2744	byond.exe
5028	DXSETUP.exe

Loads dropped DLL 60 IoCs

pid	Process
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
4832	DXSETUP.exe
4832	DXSETUP.exe
4832	DXSETUP.exe
4832	DXSETUP.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
5580	regsvr32.exe
5132	byond.exe
5132	byond.exe
5132	byond.exe
5132	byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
2440	byond.exe
2440	byond.exe
2440	byond.exe
2440	byond.exe
5240	byond.exe
5240	byond.exe
5240	byond.exe
5240	byond.exe
4620	dreammaker.exe
4620	dreammaker.exe
4620	dreammaker.exe
4620	dreammaker.exe
4620	dreammaker.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
2744	byond.exe
2744	byond.exe
2744	byond.exe
2744	byond.exe
5028	DXSETUP.exe
5028	DXSETUP.exe
5028	DXSETUP.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	dreamdaemon.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SET564A.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DCompiler_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET55DB.tmp	DXSETUP.exe
File created	C:\Windows\SysWOW64\SET55DB.tmp	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\D3DX9_43.dll	DXSETUP.exe
File opened for modification	C:\Windows\SysWOW64\SET564A.tmp	DXSETUP.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BYOND\web\bar.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\drag.png	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\ref\prettyref.js	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\sample\byondapi_sample.vcxproj.filters	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\dreamseeker.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\message.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\output.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\cfg\irc.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\defaultSkin.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\gamepad.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\info.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\sample\byondapi_sample.vcxproj.user	515.1646_byond.exe
File opened for modification	C:\Program Files (x86)\BYOND\directx\Jun2010_d3dx9_43_x86.cab	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\ref\contents.html	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\byond.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\dreamdaemon.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\ByondStub.dll	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\cfg\byond.dmf	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\browser.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\hotbar.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\pop.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\byondapi_cpp_wrappers.h	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\fmodex.dll	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\cfg\joysticks.txt	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\ref\index.html	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\ref\IE9.js	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\license.txt	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\byondwin.dll	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\dd.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\dreammaker.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\cfg\telnet.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\color.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\drop.png	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\webclient.dart.js	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\directx\dsetup32.dll	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\byondapi_cpp_wrappers.cpp	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\status.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\splashlogo.png	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\legal.txt	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\ref\info.html	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\byondapi.h	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\byondapi.lib	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\dm.exe	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\bin\npbyond.dll	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\child.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\dpad.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\label.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\tab.dms	515.1646_byond.exe
File opened for modification	C:\Program Files (x86)\BYOND\directx\Jun2010_D3DCompiler_43_x86.cab	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\any.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\file.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\grid.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\pane.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\directx\dxupdate.cab	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\directx\Jun2010_d3dx9_43_x86.cab	515.1646_byond.exe
File opened for modification	C:\Program Files (x86)\BYOND\directx\dxupdate.cab	515.1646_byond.exe
File opened for modification	C:\Program Files (x86)\12345.tmp	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\map.dms	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\web\ext.js	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\byondapi\sample\byondapi_sample.vcxproj	515.1646_byond.exe
File created	C:\Program Files (x86)\12345.tmp	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\dreammaker.chm	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\dreamseeker.chm	515.1646_byond.exe
File created	C:\Program Files (x86)\BYOND\help\byond.chm	515.1646_byond.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\515.1646_byond.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5400	5132	WerFault.exe	113
1316	2440	WerFault.exe	124
5052	5240	WerFault.exe	128
5508	2744	WerFault.exe	133

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	515.1646_byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dreammaker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	515.1646_byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	byond.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dreamdaemon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x001900000002aad3-61.dat	nsis_installer_1
behavioral1/files/0x001900000002aad3-61.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000089ac4f3df1c89d300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000089ac4f3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090089ac4f3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d89ac4f3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000089ac4f3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dme_file\shell\open\Command	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmi\ShellEx	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.byond_file\shell\open\Command\ = "C:\\Program Files (x86)\\BYOND\\bin\\byond.exe \"%1\""	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2E35AA5-CBAD-4C80-9440-D4720F9A9496}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dm_file	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmb_file\shell\Host\Command\ = "C:\\Program Files (x86)\\BYOND\\bin\\dreamdaemon.exe \"%1\""	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmi_file\shell\open	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmi_file\shell\open\Command\ = "C:\\Program Files (x86)\\BYOND\\bin\\dreammaker.exe \"%1\""	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmm_file\ = "BYOND Map"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B79CAD3-F2FA-411E-9E05-4731218F7839}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{040EC93B-0419-45CA-BD20-A86DA28DB235}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2E35AA5-CBAD-4C80-9440-D4720F9A9496}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmb_file\shell\Host	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ByondStub.ByondStub\CurVer\ = "ByondStub.ByondStub.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B79CAD3-F2FA-411E-9E05-4731218F7839}\VersionIndependentProgID\ = "ByondStub.ByondStub"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{040EC93B-0419-45CA-BD20-A86DA28DB235}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\ = "IByondStub"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmm_file	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dmb_file\shell\open\Command	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmb_file\ = "BYOND Executable"	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmf\ = "BYOND.dmf_file"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmi_file\shell	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dmm_file\shell\open\Command	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmb_file\shell	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B79CAD3-F2FA-411E-9E05-4731218F7839}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.byond\ = "BYOND.byond_file"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dme_file	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dms_file\shell\open	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.byond_file\ = "BYOND Download"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\byond\shell\open	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\TypeLib\ = "{040EC93B-0419-45CA-BD20-A86DA28DB235}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dmb_file	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dmb_file\DefaultIcon	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.dmi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ByondStub.ByondStub.1\CLSID\ = "{9B79CAD3-F2FA-411E-9E05-4731218F7839}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ByondStub.ByondStub\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{040EC93B-0419-45CA-BD20-A86DA28DB235}\1.0\0\win32\ = "C:\\Program Files (x86)\\BYOND\\bin\\byondstub.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dm_file\ = "BYOND Code"	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dme\ = "BYOND.dme_file"	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmi\ = "BYOND.dmi_file"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dms_file\shell\open\Command	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dms_file	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ByondStub.ByondStub.1\ = "ByondStub Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B79CAD3-F2FA-411E-9E05-4731218F7839}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.dme	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B79CAD3-F2FA-411E-9E05-4731218F7839}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\TypeLib\ = "{040EC93B-0419-45CA-BD20-A86DA28DB235}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dmb_file\shell\open	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.dmi	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2E35AA5-CBAD-4C80-9440-D4720F9A9496}\ = "_IByondStubEvents"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B258E730-21B1-4781-A0FB-8D1FDA828D57}\ = "IByondStub"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dm_file\shell\open\Command	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.dmi\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{3F30C968-480A-4C6C-862D-EFC0897BB84B}"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BYOND.dmi_file\shell\open\Command	515.1646_byond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BYOND.dms_file\DefaultIcon\ = "C:\\Program Files (x86)\\BYOND\\bin\\byondwin.dll,6"	515.1646_byond.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{040EC93B-0419-45CA-BD20-A86DA28DB235}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2E35AA5-CBAD-4C80-9440-D4720F9A9496}\TypeLib\ = "{040EC93B-0419-45CA-BD20-A86DA28DB235}"	regsvr32.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 650111.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\515.1646_byond.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
3796	msedge.exe
3796	msedge.exe
4988	identity_helper.exe
4988	identity_helper.exe
3516	msedge.exe
3516	msedge.exe
4940	msedge.exe
4940	msedge.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
2864	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
1780	515.1646_byond.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeBackupPrivilege	4340	vssvc.exe
Token: SeRestorePrivilege	4340	vssvc.exe
Token: SeAuditPrivilege	4340	vssvc.exe
Token: SeBackupPrivilege	1116	srtasks.exe
Token: SeRestorePrivilege	1116	srtasks.exe
Token: SeSecurityPrivilege	1116	srtasks.exe
Token: SeTakeOwnershipPrivilege	1116	srtasks.exe
Token: SeBackupPrivilege	1116	srtasks.exe
Token: SeRestorePrivilege	1116	srtasks.exe
Token: SeSecurityPrivilege	1116	srtasks.exe
Token: SeTakeOwnershipPrivilege	1116	srtasks.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5132	byond.exe
5132	byond.exe
5132	byond.exe
5132	byond.exe
5396	MiniSearchHost.exe
2440	byond.exe
2440	byond.exe
2440	byond.exe
2440	byond.exe
5240	byond.exe
5240	byond.exe
5240	byond.exe
5240	byond.exe
4620	dreammaker.exe
4620	dreammaker.exe
3380	dreamdaemon.exe
3380	dreamdaemon.exe
2744	byond.exe
2744	byond.exe
2744	byond.exe
2744	byond.exe
5028	DXSETUP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4176	3796	msedge.exe	80
PID 3796 wrote to memory of 4176	3796	msedge.exe	80
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 3352	3796	msedge.exe	81
PID 3796 wrote to memory of 1168	3796	msedge.exe	82
PID 3796 wrote to memory of 1168	3796	msedge.exe	82
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83
PID 3796 wrote to memory of 3608	3796	msedge.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.byond.com/download/
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff5e1e3cb8,0x7fff5e1e3cc8,0x7fff5e1e3cd8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Users\Admin\Downloads\515.1646_byond.exe
  "C:\Users\Admin\Downloads\515.1646_byond.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- - C:\Program Files (x86)\BYOND\directx\DXSETUP.exe
    "C:\Program Files (x86)\BYOND\directx\DXSETUP.exe" /silent
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4832
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /c "C:\Program Files (x86)\BYOND\bin\byondstub.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5580
- - C:\Program Files (x86)\BYOND\bin\byond.exe
    "C:\Program Files (x86)\BYOND\bin\byond.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5132 -s 1148
      4⤵
      Program crash
      PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,14164801504717897226,3917684736745247688,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4476 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2172

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4340

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5132 -ip 5132
1⤵
PID:2404

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5396

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:5140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1348

C:\Users\Admin\Downloads\515.1646_byond.exe
"C:\Users\Admin\Downloads\515.1646_byond.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1780

C:\Program Files (x86)\BYOND\bin\byond.exe
"C:\Program Files (x86)\BYOND\bin\byond.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 1116
  2⤵
  - Program crash
  PID:1316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2440 -ip 2440
1⤵
PID:4780

C:\Program Files (x86)\BYOND\bin\byond.exe
"C:\Program Files (x86)\BYOND\bin\byond.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5240 -s 1840
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5240 -ip 5240
1⤵
PID:1604

C:\Program Files (x86)\BYOND\bin\dreammaker.exe
"C:\Program Files (x86)\BYOND\bin\dreammaker.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4620

C:\Program Files (x86)\BYOND\bin\dreamdaemon.exe
"C:\Program Files (x86)\BYOND\bin\dreamdaemon.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Program Files (x86)\BYOND\bin\byond.exe
"C:\Program Files (x86)\BYOND\bin\byond.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 1844
  2⤵
  - Program crash
  PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2744 -ip 2744
1⤵
PID:2668

C:\Program Files (x86)\BYOND\directx\DXSETUP.exe
"C:\Program Files (x86)\BYOND\directx\DXSETUP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jun2010_D3DCompiler_43_x86.cab

Path C:\PROGRA~2\BYOND\directx\Jun2010_D3DCompiler_43_x86.cab
Size 909KB
SHA256 417eebd5b19f45c67c94c2d2ba8b774c0fc6d958b896d7b1ac12cf5a0ea06e0e
MD5 f7f554aa613eccf065575b8c69717ef7
SHA1 8417886d47c19cf6892f4080ddd5aaa1a49db3e9
SHA512 618f6dbb5bd9d44a8f10d119f5ef644f168fe3d8db986994e8cce31d1f11ff9ac872b389d1f218a82ff8b397bface587f97ca21e8f77433dbadb2ac475e9e6c1
SSDEEP 24576:dOWjUzqd7URYQio4yGDUATxoWDYicd3qRbmXHphTheUB:dtx6RYQiL1DUA7EicSbUJhI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jun2010_d3dx9_43_x86.cab

Path C:\PROGRA~2\BYOND\directx\Jun2010_d3dx9_43_x86.cab
Size 750KB
SHA256 fcc6cf0966b4853d6fa3d32ab299cde5a9824feaecb0d4f34ea452fb9fd1c867
MD5 7749862c307e527366b6868326db8198
SHA1 bce9f21cdb1e101c7223c9e62eca61ec22d6bb81
SHA512 b65a84535b749ade0f8ea1a8ab6239df8e82ad59cbdb07487fdbfcfcf57a565f493f56378e216859a081d23ddf7c671636f53ef821289d66452f09218080f02b
SSDEEP 12288:w0b5pTUIVIRxV+yb+HJFnXQRGr85UpzQ3VztxmHN8DMFy0BJ1lSIug3SqHAlzJYu:Z51NVO+XVLs3VztQHmYjBJb931I1NYIZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.cab

Path C:\PROGRA~2\BYOND\directx\dxupdate.cab
Size 91KB
SHA256 13393a91201e69e70a9f68d21428453fff3951535dec88f879270269cfe54d6f
MD5 8adf5a3c4bd187052bfa92b34220f4e7
SHA1 b52be74c4489159bd343d3c647f28da1fd13d9b9
SHA512 3e2f2fe4b5742a4cf6ee2f6b8c0ca734fd0b3c5431dff112c907231846dd3eebee7b9b8117f0256119614282cc7a4896474a199563078481d48a1204ca96f92d
SSDEEP 1536:6chonoSUr43zmBkraJ8jchLdjH0UyrJ/7BmHA1N2mmoQwjn4mHuWr50woo/lKB9Z:6UonoMaWEd7y1Ds4N2XoNb4mOWr5xn4J
MD5 SHA1 SHA512 SSDEEP

Submit Download

12345.tmp

Path C:\Program Files (x86)\12345.tmp
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

ByondStub.dll

Path C:\Program Files (x86)\BYOND\bin\ByondStub.dll
Size 52KB
SHA256 19a200a8bfca52dac51a32ae710c51f86d0da4578a0235266427cc5d84c70e8b
MD5 458a8f67446d2842ccaf307548c1cb87
SHA1 d089326ace90a59f7a120c66c86d8a569fc24efc
SHA512 f59989eee9bf2832eff25aa23553d97b9d83dddd60cb69d70c6160f15fe2074a70b9c259a7fe27fb69f85bccf91f02dca2a3747b6ae0ba436ce2d534eb7bc8ab
SSDEEP 1536:HPQVVWAadW4ZpvMQvwTEYTo7vw8o7ECQiT:CVWAadW4XvTd8o7vw8o7ECQiT
MD5 SHA1 SHA512 SSDEEP

Submit Download

byond.exe

Path C:\Program Files (x86)\BYOND\bin\byond.exe
Size 1.5MB
SHA256 4d1987b4a2388368a7c49c781aa68f175f1721336f3a786d9ea65189a67d90c7
MD5 3422bac74d47a9aeecd5029aae457ad7
SHA1 209c604c067ffe8aebd8177c4da2ae07abda3f88
SHA512 1d2edc3a9a04db69cfc0c819706cdecaf4bef4c050ee8a851f14dad766f9db054f04c0b15a642ef9e41d4ccaf0ae088bc91fbbb48d9a31ccac9c75fcc0b740e6
SSDEEP 24576:FxgX0raZayfVxchk1CYKimMtlTj3cTr5qqLn3sT6Q54Dvy365+EwGCwy22Xsmqll:Hcay56cTjUqqbS26HCW+vuzwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

byondcore.dll

Path C:\Program Files (x86)\BYOND\bin\byondcore.dll
Size 4.1MB
SHA256 f9969eccad1f23e228f46ce4d31d714abd630bfc291a94fccb4714aca12d9855
MD5 c8d9a86fab0e27569d5f3290fa072289
SHA1 bcb9882fd458d5843f5e5c22b66bded8fe1b8fb1
SHA512 a57024b3fb839e8ead3da080a201b24b25f29fcf6eb5dffa647ddd4c6391c17c38d339fabd05d66a9c892be2d7938238af8a55d32bc999603f3a3a8b8ee032c4
SSDEEP 49152:IhbJlvjlhPzJnsFJtW/I9Djty+6HQRzA+f3VqbUuMkqYrU+vaJqFnP+iChdF7ETp:IhbJluW/I9DEdwRzA0B3HYIix9i4TRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

byondext.dll

Path C:\Program Files (x86)\BYOND\bin\byondext.dll
Size 1.9MB
SHA256 c76c1bdc73c7e7b01936393cdbe37e693ee23136419e0125790ca3a46c82edb0
MD5 15b425a9da83822247209e39f1d19c8c
SHA1 0d68a8c5ee60a682d1a8a4aff557e06c13473032
SHA512 f0be69906f4cbc572f1c7dd2bf510469554f86095f35d29a71e78e14e9177d9b9c1d580499871b2c95ff5b6b8a602253fc2040619c1a562e17beb793a87bb49b
SSDEEP 12288:gI3JOdKuZVCnHhmGtUTMh0swI71MMz3TBxLycv1yXOvuU/yTFhjW+Tl:DJ0KujwhztUTjsPMMzVNycCTnW+T
MD5 SHA1 SHA512 SSDEEP

Submit Download

byondwin.dll

Path C:\Program Files (x86)\BYOND\bin\byondwin.dll
Size 2.4MB
SHA256 993b36d3f06aacb38d96661f17b07cf1795e6c679c4332dd35cea8d2818bfcf4
MD5 d0281c2c6bda21210495885c433cb65c
SHA1 7f762b3be61b4ffddcdb9c0730818aae7b638c72
SHA512 17225caaf110a05c3f20337c17a79b03c129cb162965ecad0d1acf6cc6e03b777863aa87b290f6d108d815267675a2179debe05ba47b39f0e58408ba302dc8b8
SSDEEP 24576:bbrDe4xncHsh1k5zSwdAwFjglgWYlH2BsIG5U3f7qojumDH4SADRH7zqxbW1:znCzrKg8GO3mYuI4SADRH7zqxs
MD5 SHA1 SHA512 SSDEEP

Submit Download

DSETUP.dll

Path C:\Program Files (x86)\BYOND\directx\DSETUP.dll
Size 87KB
SHA256 def6f245762be36cf18b435ba8b7ebc224b9c21d1a1db606a8e8fafdaa97bba0
MD5 9e0711bed229b60a853bcc5d10deaafc
SHA1 2bea53988bd35c5df5c9edcef0bc234c37289477
SHA512 c0b31872e52c8f4270d991c70d1a1c9ef9a4bbee4807c54c05a449cd1607506ab16ff1e74b378651b36e3276322c86cd843565c8a1aa33a49c47322ef4df0185
SSDEEP 1536:OtBqvGpPmOEll4RWxiF9G3ZnVdqkFKJuTJbHo0Xm+jN3i97ZTj4FWMD+ZJqsHPCH:OtAvG5mOEll4Roi2pVVFKJuTVtXVpS9a
MD5 SHA1 SHA512 SSDEEP

Submit Download

DXSETUP.exe

Path C:\Program Files (x86)\BYOND\directx\DXSETUP.exe
Size 524KB
SHA256 046041aba6ba77534c36bb0c2496408d23c6a09f930c46b392f1edc70dfd66de
MD5 ddce338bb173b32024679d61fb4f2ba6
SHA1 50e51f7c8802559dd9787b0aebc85f192b7e2563
SHA512 7a63925278332c8e7949555383b410d8848a7834b85f34d659e351ba78cbe4d2ec09caccb2178d801b9b68725c9cbae48a6a1f07f0804a0c41eb51df79b7eca4
SSDEEP 3072:ti6LKecn5W6VOX6dRJar+GHs6Hl56MA6rKmMH2/5Mjt4zT1mFDYkCIEVNUrlfw0I:3F0JarNX6hWs4VRKs
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsetup32.dll

Path C:\Program Files (x86)\BYOND\directx\dsetup32.dll
Size 1.7MB
SHA256 642d9e7db6d4fc15129f011dce2ea087bf7f7fb015aececf82bf84ff6634a6fb
MD5 0f58ccd58a29827b5d406874360e4c08
SHA1 ba804292580be6186774e7f92e6dfb104e46bf25
SHA512 3e3d4f2de5dc5addc86765a2f888487ea0c9ee0208fac60187ddaa9a2bfd73cfd7734836d32805fa43222470c8f6cb9a10e2a099aef72c67ad7c789096e57ce4
SSDEEP 49152:MjnIXtNeOOOOOOOOOOOOOOOOOiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWeXiWq:YIjma
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59
MD5 d7145ec3fa29a4f2df900d1418974538
SHA1 1368d579635ba1a53d7af0ed89bf0b001f149f9d
SHA512 5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043
MD5 d91478312beae099b8ed57e547611ba2
SHA1 4b927559aedbde267a6193e3e480fb18e75c43d7
SHA512 4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 d9e715f3cdfda2c2f9376dbfdfeeefa573ddf29be2a5df23129a545f83a2d43e
MD5 b8ffdde7b60ee6b09b9a4688b48eecfb
SHA1 e8ae33abd7cd6057e3f687cda54773f9f030d479
SHA512 bc97a663c5e076de5eb052acf007d81701219e6ace7f7961fe40571c123ed63a30c055827592ba65926fb545e2b542e6226280e83a17e2589b0bd6f464e152b7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 870B
SHA256 c6d19895e9434b182ce9018bd64d4484fbba130a3484fedac72972046ae2c3d8
MD5 bb5e7c31499349229b7153e718e383a1
SHA1 d41bf33851c00235198ae5e64f1425a153700053
SHA512 f07b3966c3abfd8f0f38ccd1a9c78d9b6838b20a78295c658c795a4adee45a2a9fc145517f4371f0ffa8ce8fb456134b88a96e0857043dced339522e2164f082
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0b6bde3e5db83ee8dc0896286fb63c11b75c55bd03347b5096796cb98579a8c2
MD5 0ba389c7c2a083efce33b0dc477f17ab
SHA1 576bb6b1c1367d4309607b9dcd201f74016e5147
SHA512 252a481079206ba59db18541df2d381f2fcf8219ec7d8f0d9cfde5842470e6745d9f452fb536becd12601fafd254f6f36965ed2c88615f5c221d45f406ff4302
SSDEEP 96:nZk3Ra70kvNwSv0MoiVmdLuz1jImJ8a0WQyV+VpAiX3wI3:nZk3k0kFv0M8uzhIU8aLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d0929bb30e9349b9b1d1a0c1c758b965d7a11fda646d840ead9281fb6761e380
MD5 f47ffb32553458c03815f3973d3cfe76
SHA1 6c7b2ea6fa4bbafc4c2b34537f8701be9f407cc3
SHA512 9f7ee900ece4d09c1f0bea426997d2a656a939deb9aee140a29e7a29f9361d96cb3919ef2f39a36711a30eb125ef199e224881e4b59603712be0859d64c60b53
SSDEEP 96:nZk3ja70kFNwSv0MoiVmdHIGJ8a0WQyV+VuziX3wI3:nZk3W0kvv0MAI08aLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9ff8dd627fd45ea42dba5483d6bf3473fb6797acd83760ad6827f17f240c1b9b
MD5 8050fb092cde86568fcf167ebe1bada7
SHA1 5b89219bb66dc5aa3f7f8e84a3449fe1f4ce7dbe
SHA512 82120df7fbe289b5a2e7c34a7db0a5d981b32a23c3afbee49d529048843fce9ce3a1e7b437eed3bb53e25487892f18c29346e195b7a67a3603582e034054fec7
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGzVp0REe2RUWl/R71hhKW4UYo:M9iIxuERzA83h09RZxASGzVXfleW4UYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6bf0d7581abc899e44dce75585d0ce078aef74bf3692e9b0c927ca1559d2edaa
MD5 cadac874ac0d2f1839f027a00a81f2fb
SHA1 4c893a882c6a2f44a70ae8c45c6dd36b5c846994
SHA512 c8f3677a6e92c240cd1acd2acce3de73597ad1f07fe511fc9c6c460144c07bde8fd9343e32af69f4f38b3e7cf3bcb4ed2774b72ff4693f9156bdd90437b7f36e
SSDEEP 192:3oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGzVp0REe2RUWl/R71hhKWPUYo:P9iIxuERzA83h09RZxASGzVXfleWPUYo
MD5 SHA1 SHA512 SSDEEP

Submit Download

8e98d737-9517-4b27-81db-76455bb4283b.down_data

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\8e98d737-9517-4b27-81db-76455bb4283b.down_data
Size 555KB
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
SSDEEP 6144:m4W6OWkK0An6PtQ3VG7Gz3AW/ZPfMKUPIbs7aGU4toNNQQPi/+sMT/TtpNkppXsb:hW6O/k1zQWZz/QtGo2saBKZIxWoOu
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 70b0c83aca9fca197aa33395f24c68a06c674a4f382fdc982038bb1ae7ef5b4b
MD5 478a40a76e19073af8e36c9d361cddc7
SHA1 6ffe0efe25b030af5b48414c2b3c96701e9f5230
SHA512 56167df1a329b796543ecdcce666abb22760a4dd0370d0d8a8f93bc88e136aff776d32192230479981055ca26d99aad078fab7f09eed9cea4d18176a272aa4b0
SSDEEP 192:MJAFJL9oBiV7a12YJrtkp1NDusAksz2ZUhmkspSRRPQRe1xjJVjeQwRJo1V0uJNE:MJWJ1a12krtuJ4pmXmlJVjeQwRJoPe+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 10KB
SHA256 b073754eaea1778bb524b423df5a61be2ec55a45402c04d58ddf951a373ecb70
MD5 559c71de92f0d4b7ce47f95ce80bc230
SHA1 5b9854028013713b487ceeb38c39fb861f1b1518
SHA512 1f23e2630257471a34933a4c2794054c275b4afcf90679afa52786298a8e6153ee7880ee19ec67a6679a2c532c92f365980a8aa0f0534a7633a4b9fcfc63fcd2
SSDEEP 192:AJAFJL9oBiV7a12YJrtkp1NDusAksz2ZUhmkspSRRPQRe1xjJVjeQwRJo1T0uJNE:AJWJ1a12krtuJ4pmXmlJVjeQwRJoZe+m
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3DCompiler_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\D3DCompiler_43.dll
Size 2.0MB
SHA256 2f23182ec6f4889397ac4bf03d62536136c5bdba825c7d2c4ef08c827f3a8a1c
MD5 1c9b45e87528b8bb8cfa884ea0099a85
SHA1 98be17e1d324790a5b206e1ea1cc4e64fbe21240
SHA512 b76d780810e8617b80331b4ad56e9c753652af2e55b66795f7a7d67d6afcec5ef00d120d9b2c64126309076d8169239a721ae8b34784b639b3a3e2bf50d6ee34
SSDEEP 49152:DpX9JVeE9HP6Zpy9KyhMI50Du8LljslNsHSHFUq9OiapbbO5Akb:H3P9HP6Zpy9KyhMI50Du8LljslNsyHiS
MD5 SHA1 SHA512 SSDEEP

Submit Download

JUN2010_D3DCompiler_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\JUN2010_D3DCompiler_43_x86.inf
Size 1KB
SHA256 5dd568919e1b3cbcb23ab21d0f2d6c1a065070848aba5d2a896da39e55c6cbbf
MD5 1a86443fc4e07e0945904da7efe2149d
SHA1 37a6627dbf3b43aca104eb55f9f37e14947838ce
SHA512 c9faa6bb9485b1a0f8356df42c1efe1711a77efa566eee3eb0c8031ece10ffa045d35adb63e5e8b2f79f26bf3596c54c0bd23fea1642faae11baf2e97b73cf5e
MD5 SHA1 SHA512

Submit Download

JUN2010_d3dx9_43_x86.inf

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\JUN2010_d3dx9_43_x86.inf
Size 1KB
SHA256 6b33d32da02f664092d44b05237990f825b4062c105a063badcf978648b5e95b
MD5 a11deb327119b65bacce49735edc4605
SHA1 0be2d7fa6254b138aa53d9146cda8fedbba93764
SHA512 b0134a3d6f2d576e5fafb601014ab66fef91d661013acc8a7a9129940369a1d9ed5c0f228bb1666a4e891f09b4b18e83f0cb2080047aa84fa45ab663e5739a31
MD5 SHA1 SHA512

Submit Download

d3dx9_43.dll

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\d3dx9_43.dll
Size 1.9MB
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.dll

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\dxupdate.dll
Size 168KB
SHA256 6dcad858cc3ff78d58c1dae5e93caf7d8bacb4f2fcf9e71bccb250bf32c7f564
MD5 94202f25810812f72953938552255fb8
SHA1 c1e88f196935d8affc1783ccf8b8954d7f2bfb62
SHA512 65b66d07ef68e0d1e79f236a4800c857e991ee3ff80ece4cfdd0b5f6083ea16f8a52d351c3af721cb05c06394ec91b4b5e3cfa4b0f0879f7549f3e3ed035e79e
SSDEEP 3072:By6LKSOwGi/9S7BLfsdg3/Vhxo4yYbfBu20jPzwRFvxdGF4EdRDWXGTHzh/KV8ce:4wGaI5W4/Vhxo4BJV0jLwTGF4IDdPEe
MD5 SHA1 SHA512 SSDEEP

Submit Download

dxupdate.inf

Path C:\Users\Admin\AppData\Local\Temp\DX53E7.tmp\dxupdate.inf
Size 12KB
SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
MD5 e6a74342f328afa559d5b0544e113571
SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\InstallOptions.dll
Size 14KB
SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
MD5 3e277798b9d8f48806fbb5ebfd4990db
SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
SSDEEP 192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\System.dll
Size 11KB
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\UAC.dll
Size 14KB
SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
MD5 4814167aa1c7ec892e84907094646faa
SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
SSDEEP 384:3A7q72y8XYDSDJe7H+KXKKK2KRKuKZrjVo787foI7:3sygyraXjQ7Zl99
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\UserInfo.dll
Size 4KB
SHA256 510e466a715933499fb9d5a1753b483826b2bf89161b9d466dd2ad7e52ede2fc
MD5 c22c9d7b6937b8960fba4c8a145076b2
SHA1 2e45c2dd6e5132a942fe940dccdaf771e0f9e81e
SHA512 b3b93fb97bc0d16ac35a1f0e877bcf42324e19d21839b025329d1b27d8e96bc9c0cbde0a8d60b23fd0c864f62e3c287461108c6abecf53ac488de1fc16b47d6e
MD5 SHA1 SHA512

Submit Download

advsplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\advsplash.dll
Size 5KB
SHA256 9bf33690090655e91389469beb5dbdd45942192f2e2486c9fa82fa6d74a0f88b
MD5 15d8eee287329e2030c34c6bb3e62c87
SHA1 1de23c0883f7a80a489e140c55b16970dd0264ab
SHA512 6ee495dcefd131ca490d6f3077643f49598184c3a49f1f66ed7a6d1559ebb9266c8c87cf49c06cdde8a6cd0643fb46f83d13aa5f27ba0c90de4791cb8bad29c0
SSDEEP 96:XqNXqwK188CgAtXvZBkjDf0yf9ysrtWpywol:XAqrg1XvZB6kYtWpy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\ioSpecial.ini
Size 553B
SHA256 48a404ae57d86b7402696387cbd5d329073c0cb33ad686a8c1b56feba8179488
MD5 149f67e56eb40ef54328f8ab9c9a8861
SHA1 e7b3472880b953c5b99bc582995fab67dd80ad1c
SHA512 9e79161a0c8c31970a391630c653adbfa6fa47995f0da9c06195c6e0fa52d0be1c94f76d5a5aa9d592581c279e5edc13e824938969541ead87000883a9527389
MD5 SHA1 SHA512

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\ioSpecial.ini
Size 614B
SHA256 3437aa93eca6512eae88d294c160781c031edc0e9c8ea758042483df7aca7a55
MD5 df3018546c28ae253b8a7dcf1d5c8bc5
SHA1 fac9a44c02ba2d8045563230c39031900b33c3c1
SHA512 ecbd2481a61dee7e144223ba9ca5ea83d7e58506115c8b3feec11e2aa4535f69d127546ca4edd0181a3fde44a87428ebe03468ba24fd9360e6e0e0a3345e5c38
MD5 SHA1 SHA512

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\nsExec.dll
Size 6KB
SHA256 288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
MD5 b5a1f9dc73e2944a388a61411bdd8c70
SHA1 dc9b20df3f3810c2e81a0c54dea385704ba8bef7
SHA512 b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
SSDEEP 96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsProcessBYOND.dll

Path C:\Users\Admin\AppData\Local\Temp\nseEE2.tmp\nsProcessBYOND.dll
Size 4KB
SHA256 a54e0df29e251120ceb49d05e9977950f5b25b873e6222672eeecb100bcbb4a2
MD5 7b6cbde5da4391fe1b59b5e66e1a8507
SHA1 2c40a98b29acc6f71b9020cfee926fe375f8b068
SHA512 4a9fb8e571e62169e0ae8a7adc471f43c6f7fa55fa6301433e75d938326764e97ac10dd18c961da69f53d99793f52a3466d14059e5ded50947c456b570cce561
SSDEEP 48:qYP/MHYBXYBxHRwYCI0owmJOdkPm4LYC5sRryBH68xlgAa4GEbL://aYBXYB4Too7+f5s+HM4GEv
MD5 SHA1 SHA512 SSDEEP

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso266C.tmp\modern-header.bmp
Size 25KB
SHA256 26b00aa88edfb27dfd208394b81af4e909d28ef5219a31380c3fbdeddef0e112
MD5 044093109ebef3c866a65a435010baab
SHA1 c66e7dffec846e7117c3447e78e9463dff5041c8
SHA512 e5bd9644cb17d478d13e1ab776bc38adf96e1712cc0f857353876a6575f465030c44aca7ee2bda860f19de7665889a22a8bf22bd84e5bccc4770a195f8cfd8b4
SSDEEP 768:6y9GHdV2dO1ENVf41PJs4Lje+clJJwzTt+OC/mKyyih4koIIGM4DDAquvvvvv:ea
MD5 SHA1 SHA512 SSDEEP

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso266C.tmp\modern-wizard.bmp
Size 150KB
SHA256 67a4b5579f6e751159bad822da105858b68f4080e5f430b79ee1b9bd4ac05040
MD5 a3fc51b1bd19974e46db7b52f90ff5bc
SHA1 f086e6993066e95b0552f812608144d9b59abf0a
SHA512 18310e8c8092106521a8457ab58a86ffd751e2ea0e47341713203abd87ef605d7c99cfd45739725a81b7a69632f0acb73e87d6b9187a295763373370406ac017
SSDEEP 1536:eQG6fXBq+eQUZZAfs35JbNtq4VWAMBWnd:JffRq+eQUZZAfsJJbNtFoA5d
MD5 SHA1 SHA512 SSDEEP

Submit Download

spltmp.bmp

Path C:\Users\Admin\AppData\Local\Temp\spltmp.bmp
Size 320KB
SHA256 cc8a70ac324f641536677bfca9d7bf0699e5741bf0661d770c9c0640526372fb
MD5 e0f5e79c3fcdb02dbd645e70ae9f0661
SHA1 d32e34138942c3826aee36f6b4d0a4089578337a
SHA512 45e96511a60b1b0f57fd70db028eb8021f4b142e6bcf0ffe018b60ae5bc1743f10b805887e3457b50c77411c872895f98980ff5ca45f56de0238687369d9ab9d
SSDEEP 6144:rwPEQZEpZBHrHA9fJHSJ1f0ZAkz7Zxqepgb+3L7qiIgGGYhj37:nQZEJ0P7Zxqepgb+3L7qiIgGGYh37
MD5 SHA1 SHA512 SSDEEP

Submit Download

alert-corner.png

Path C:\Users\Admin\Documents\BYOND\cache\alert-corner.png
Size 163B
SHA256 c6346da78f81081080a28fc2f25a924b2eb278531b4dc18023f6f79e0d79bc6c
MD5 812572f4edc1eaaa64244c9b53fc30b1
SHA1 c967f1f097a25553a4e842e517ee8f58adb44870
SHA512 f2da280f9eb5a8040a82a5c114a045ea17a35ad6277a861ca6cd8c40b78edf6cba657f5768aefac94c5f4e9a488e6086c124eee969cd06f6bafa142910db4bcf
MD5 SHA1 SHA512

Submit Download

icons-arrow-left.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-arrow-left.png
Size 104B
SHA256 0b840500e4037de21cfce4a40006bd2f38d82a13a92cdf05c47c877828b484c2
MD5 047a8dcb58e937c86add9d3c481b0954
SHA1 97ab26ed4797e95a2a9da37c0ef80cf8f8852d3f
SHA512 2c647af13aab87d6694289dcb84c77ac9fccdfc9185656b3e18f3f08f93aed4e7bf99eb41dcd0536d7aee5d415ebe3f7a48fdd124eea594fafbb5aa7a44117a9
MD5 SHA1 SHA512

Submit Download

icons-arrow-right.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-arrow-right.png
Size 108B
SHA256 1fcadda5f2489d0c3559bda38b9813ce4b14e0a63be7ee861d6520c461c0e50b
MD5 4010e827273276eaa5d566e252866b92
SHA1 9f27f7c4d70c5cf996df37d3b19241afd2f9871c
SHA512 d7f7de016f546fa54a2c5caa8ae86bada2238393215e9d5359a22aeccc00e02ae220b70b6fcb351ff773c5f88a5c7ebad2cc7f9dfd95579a23088837a542c166
MD5 SHA1 SHA512

Submit Download

icons-arrow2-right.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-arrow2-right.png
Size 117B
SHA256 8a8398701c822dacfcbf194fa4e6df2673d42bca394ef8c094f159c740601729
MD5 dc9144ca3b832f5d56b00280e5de792d
SHA1 0191d906602f32f7c51831311a4e9540b655821a
SHA512 a89847741b18717dc37210273526013b1f584418974718bd34ef25df6675ad1163ee7a6b3e013a489140c6fd895ca97c291274e6f78f2689d4953fb1c3d7dc43
MD5 SHA1 SHA512

Submit Download

icons-collapse.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-collapse.png
Size 187B
SHA256 68ddcb73b6cc7f0d9cd9f6e453a03b342bde18049f4c10bdf8055fb99c2c756b
MD5 c1820ee2d90bac81e7515bf71d4f81fb
SHA1 5158e87543f060a7729dad873cd912e5bba0115c
SHA512 1ffcd48fde9173b6145eb36a3195d9021bb0f73c500c1a1d3fe85f3e666464035edc26379013cb0e3a7d7ea291a8f06bc65c47f76e23a79ced6994e748b17fca
MD5 SHA1 SHA512

Submit Download

icons-expand.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-expand.png
Size 124B
SHA256 11bf0dce3d2926c64a7384e0c112c32a5b6a62362379ca76b49d458842a69dd1
MD5 c26fad1c7fc396528169581bb3424a55
SHA1 3bba8d395a736ac891479a34de45f834b248d480
SHA512 9a3bb4136bf8e88fda659f703a01ff1a35d89c184ebbfa560abe74b88f4a01687327a4695d11b1cab80115004da82a8aafd34f8e6b3ca2a1eab47b6ff118037f
MD5 SHA1 SHA512

Submit Download

icons-feed.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-feed.png
Size 289B
SHA256 d99fb2aa246cfba8a03e294551ed26cc4bbce7acb232010dbafba534af37465e
MD5 ba08c00ce16c736b6d928fa2fd9fd6a6
SHA1 8f2dfbc7ec0f70efc2adb995548353e2a28a04c5
SHA512 b1beb127df6f7ba291c14b3021ccaea9127f20553ba998918968d757c57eeb8b8f9c89d3c7f482fe9c51343bef7405d75795519592183b1fe134c23a343e7c19
MD5 SHA1 SHA512

Submit Download

icons-friends.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-friends.png
Size 254B
SHA256 f0f0025137c11e10ac7ed53fd60fb31db87b727585eea0830e0c2068c90a77d4
MD5 e12be01f17132e624955bdb5cfeac22f
SHA1 9303382ab76f9f6217bc4a5c49300f8290f43c55
SHA512 2169e753dd48ceb7c9df11c08fe9f3e01a7c565af8cb5cc8749ed61ddc016ba446f7830950f2c98f361865721acfc5efdb1ae6004a6b91975119bf63534be9f1
MD5 SHA1 SHA512

Submit Download

icons-games.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-games.png
Size 248B
SHA256 e71f70ff474fec2e05eb576bd1c50e0d3955574fd0a624e2cf00098b0927c99a
MD5 a970afb74f339800b6926369bd4a67b2
SHA1 27322262ccc054f4b2a6faea11bb5b7312c3ec6d
SHA512 2a9e1e6ec76a3a56a4fd35b344f5788b6ac027ff77dc005a8824178d27a51e4cb652d8dc9ed78f414fa928136bd21352be7126467d305d61ae3b03f4af45b767
MD5 SHA1 SHA512

Submit Download

icons-home.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-home.png
Size 129B
SHA256 ace8b8792e41906c0feefd563c72acb1892ac0a585a8710ab8d35b5bf969f014
MD5 022c5688f87176ce5e4e2553b46334d2
SHA1 4760161fb8f785cf2ee756cdaa3bbd9d9d2557bc
SHA512 fdf0ca50bd8ff7e9e75aad2191df3f85296fd8c838a3793285890cfce1b606a9b3ca573eb83d22632e4e04e61f3f597ecb3897ddd42843a85ae3461250c150df
MD5 SHA1 SHA512

Submit Download

icons-loading.gif

Path C:\Users\Admin\Documents\BYOND\cache\icons-loading.gif
Size 3KB
SHA256 91668c8538d06c370dbeada7895070ad3eea244a677b5a76c10abb49275b804b
MD5 e34592c9385cac00bdf18bdb87d52d76
SHA1 6ec4ca32d167003f94a8d9c5f44aa3ae23f4d9a4
SHA512 3e5e0e6fe79f911f7b22905ea61a91196f960428ea7d4059d0536949ddb26b8d64aadf727df808573291f20a7f28f787084e1ea57ea5d4bd4058ccf20f17010d
MD5 SHA1 SHA512

Submit Download

icons-menu.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-menu.png
Size 248B
SHA256 bd98eecce64d16a8eb700aae7653b23ceb1d7645f8a3da981cfed73fcf42eeb3
MD5 b910d8fa75a42ea9927dce72bef5f8e0
SHA1 83fe304c87e1569f7849d8e389f5a2132583ce06
SHA512 d4946bb195a17ac4eeed49a82cc838f5e5f03569951fdba52a960dcc6e38132b35948db13fcbe94f7d30e1287ebe2e932b67b23ba0039acd548d8390283bf538
MD5 SHA1 SHA512

Submit Download

icons-resources.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-resources.png
Size 243B
SHA256 bafe1dd108992466af7df29056bf20bb8cea8e97115e5ee27a22d2cc036f4b01
MD5 14c37b63f0cbcc79bc80d6641b43c227
SHA1 e52e9a69884b492d8f734845f66ff9993e688771
SHA512 e114cc571dd3f2b4f1e0436c4457d46476ffb4602c9a826bc29ce202c2ebc97ed5a7ac03e8a286372674e8df267a28d57e5fc39c4c4cab33493369b82873ae15
MD5 SHA1 SHA512

Submit Download

icons-search.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-search.png
Size 206B
SHA256 09443fce7c948638287a3386dd66d24682a312f21855290fc4b494561aecb0d7
MD5 242cd82acb5344008d4205eada0da3cb
SHA1 6c1d6348a24dd7ee42e67bbbd3632354d280d493
SHA512 c5ddab5350aac6d04d7cfa1e9c3c528090764fce1fadbd5853e1de50bec0f21e869a4d096d13346a9e9e4741217495d0f46f56ae9462d035a4ae96ba9decd6f5
MD5 SHA1 SHA512

Submit Download

icons-tabs.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-tabs.png
Size 124B
SHA256 716e639c1d0870edf34cd9cb07beb4302775defffc4bbf62d46068668d714158
MD5 8102dc0fb93adbd9ef86a9ecb0f5c340
SHA1 1b821fae5b3a7a741f88512086daf1c1901eef60
SHA512 2dd4a2017409b29b044552da0ba962facc46c73c9e3e8b9c64daf733166b4bc43db73c1f4c8688484b5ce564362565b57ecc7ca00575660388076484eda25464
MD5 SHA1 SHA512

Submit Download

icons-update.png

Path C:\Users\Admin\Documents\BYOND\cache\icons-update.png
Size 265B
SHA256 c1e8d18e2ccfde648d7148a516cf3f6296ce89def9211fc3d99a7f9c24400944
MD5 14e1ed67841322c59fc6742fb717b59d
SHA1 703f868d175149adf81660a0bedfad46da734565
SHA512 e485eadc50eb3eef1247d52cb95afae9a7006b2faae379d1aaabf7ff518f7956ec37c1cc71fa6b7c899e524a64f46a44b759c13342995623f8e71a64cbe6b935
MD5 SHA1 SHA512

Submit Download

scroll.png

Path C:\Users\Admin\Documents\BYOND\cache\scroll.png
Size 783B
SHA256 d1c2cc7ea2d2f7cde81f7ac7dca69fcb01df768e30be92946cc2d5e35395bd92
MD5 463a0c47f116c3099ebe442ba005ea86
SHA1 efeff69396fc678adc7446114364cabf8b3e8734
SHA512 5167d6fc9433afe0caabc99886ef4704f0374186e951f6d6ef8d3fba8298914676978b48aa80ccb638c9442900b04bf7d17d734491b8e52e96c087e6cec64a53
MD5 SHA1 SHA512

Submit Download

scrollarrow.png

Path C:\Users\Admin\Documents\BYOND\cache\scrollarrow.png
Size 789B
SHA256 7708f2d4df80be8c72ebd20968340877cab2332ba74c37cb90184b2a5c0b00d5
MD5 fba03c1e9501a7c80ac9969a0e8b147c
SHA1 d86c112aca21208ae570659e5286b081311395dc
SHA512 1fc7e56fffc642d2faf21b586fd0bf389aacfaec9c53078ec4c012f125d0437d7acaadf392b1c0ef663b30fe46ba034e6d8db52ef73c259543e901f83cc4b1af
MD5 SHA1 SHA512

Submit Download

scrollx.png

Path C:\Users\Admin\Documents\BYOND\cache\scrollx.png
Size 190B
SHA256 2d07f102405a6c4d5bb67ca82191324997ba1c4a1ca42fe221b93d489f81ec7c
MD5 0d601414b6fb4bd28f1966dec40b2961
SHA1 175b567f507e0f9d768c012eafd633b32bdf78cd
SHA512 cdae159bf5accbd7dfffa836709924957d2ff813167bcd02e9c371fc1c580952bd972043951bd35bd409f7c705f6c8cdd2df1f8b4cdf88eafa4106c06d7ac1c5
MD5 SHA1 SHA512

Submit Download

scrolly.png

Path C:\Users\Admin\Documents\BYOND\cache\scrolly.png
Size 196B
SHA256 eefd4b806c8425901aaedcdff79302b4df62ad3278b2111b24e2269b55d2d14f
MD5 12c96b29271e84ad63f5ecb453957200
SHA1 b80eae0c5126d835c038a413603a0c6f226d7229
SHA512 561a9b863918b58699b9da53476e432606bd6551cf96f224d6a5809211f49d63e72b052b1936d4405c3eace5ddde6a259fa54e73b2df48d8a24247486f2c0870
MD5 SHA1 SHA512

Submit Download

pager.txt

Path C:\Users\Admin\Documents\BYOND\cfg\pager.txt
Size 75B
SHA256 02f7dcc2e417269d029f0cdb588dd8bfa9ae423c9ce5262f50326387b4d0e32f
MD5 20986b78408839b6a9fcd50bd1e45c97
SHA1 c6a3eb155253561d62a1857b7fd846e01da68bcd
SHA512 8b678d262dd2d806ae65d03beabf8b7fa0d26c31c0ece3d2e3ad7fcc6e8789c23c4a9bff81d53a2b4f7386de6648491746ee4855799008426f2b78bfce672d56
MD5 SHA1 SHA512

Submit Download

pager.txt

Path C:\Users\Admin\Documents\BYOND\cfg\pager.txt
Size 75B
SHA256 a75f410179c051cf2d2d57664132e2952248ee36c5a89de9a65eeda0ca2e895b
MD5 8355edf1caffd4f200cae91a1ab7185d
SHA1 e592f253c614dd9f83139907012e72f4335fe552
SHA512 278457d177778879adf4d68c3a001f21ea1024f0ca706622bfc4fa7d6bd2af07cd120ff9ee2d53556e0b8427d9f5c1773948948ac4da732389c6d3122d06ca1d
MD5 SHA1 SHA512

Submit Download

pager.txt

Path C:\Users\Admin\Documents\BYOND\cfg\pager.txt
Size 75B
SHA256 a9f4107f7916fce11e36da1a13df95fce6234ca16e3ae5da5dbd5c1771a3a790
MD5 eed7155b2e89e6ac22ff2fa0d3402a75
SHA1 f9c5cb35082608e425e98bbc073a9e0e9f369429
SHA512 7ec8b79da4953c745a57eadadc0053c401245bb021e60842691d3e6397b1fd0af8cfde8c39fdc0ec21080e070d6af468547909aca97d315734f2af6519efa777
MD5 SHA1 SHA512

Submit Download

pager.txt

Path C:\Users\Admin\Documents\BYOND\cfg\pager.txt
Size 75B
SHA256 0e71b78b37522d08b1b16b0859bf520d0403111e686991e0a1bb5e2d2b058875
MD5 bbcf7035f59b98034d40118a4c690b80
SHA1 fb6784c312c59ac446b92bc196af37fa8d455601
SHA512 58a17228c238439680c3b87bfcee35e79bbd63eeb0f58362b752851d28c37a3bbddc1de658aa0d275f3d75d28dfe355e280acf721297820c257034390aa02667
MD5 SHA1 SHA512

Submit Download

alert-corner.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\alert-corner.png
Size 248B
SHA256 f58bab3dccdcb45f512873c1376bb48b40e52aff928a9eb0f141fea01e697e99
MD5 4ec32d749c1b5826cc85f34104bf2828
SHA1 29c891d658fd33d64ac25689aac7633ef32d0e85
SHA512 b2e1bc49cfeab3650e4b7dfef8fd927d906eb3e6b25688bbbea829a78ede7cc93e04b8c9a2c88ff68bdfe76b0e19ac97f988183271cea04d5a98ecb4b5f6d6f0
MD5 SHA1 SHA512

Submit Download

bookmarks16.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\bookmarks16.png
Size 424B
SHA256 83f0c5fa30939b9966c3d7c4a3268bf766c50442db8e6004d227e7e8a32d971d
MD5 20f227f6ca3438053bb7863e1a3f8d15
SHA1 60f9dcf914e213ef44beb512989be57a70302ae6
SHA512 28130f2a876be1f4928d178db50df3562c75ee87dabdd2a7d39351a714307c027447c64e84217a0b28db63f942de1e42f8dd3881bd6f611985e7dc684211ed22
MD5 SHA1 SHA512

Submit Download

bookmarks32.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\bookmarks32.png
Size 759B
SHA256 47024f763ad1f8c0af65634505523ccf795fa384050e1d70969b7956c169f6ed
MD5 b4470be3f4ea929b41d319784abe91f8
SHA1 24d4cc739ca072be05c3dde614eddf8c2725c016
SHA512 e18f6ebfb84eedb6084a870896d185f509ca2844019e84949a6cc71de04001fab34091ac8b1f6b0c5339dfb7d32a5a1f7177b3d874c89574d61c8159b662daa1
MD5 SHA1 SHA512

Submit Download

dev32ba.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\dev32ba.png
Size 2KB
SHA256 608519991aba98d76463a8f032c86a37d006e86af836fd6b31280d9c9aa4e63f
MD5 7c214efe5cbdc8f6f5f4dd210757eb68
SHA1 257e8cbd91d2e7c10d52ca8474b3eecfb1db097c
SHA512 cd251bc8ffca41280af295112a42ee48e75fc59d720bb36f849958974cd0967e3650635e8d42fbe622704fa21f1fcee6905fd6921cf8bb941dfcd468115bd0ac
MD5 SHA1 SHA512

Submit Download

dev64ba.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\dev64ba.png
Size 6KB
SHA256 b22d82fa0c4dcbeab3326a73c7190668fdb1615b507fe876d284bdde1f3bf161
MD5 c3f748d7e6ba04acf68c9e1663498aa8
SHA1 f89099d1a5863dff9663bb1632cc75757a9426fe
SHA512 390e9251a4487ecd8787d103ebd9e5e008aba8d7dc82fdfe10fd26f0c552678adec92b58fe192219d92724b0d2ec4836758b192581774ea2917270b31f287216
SSDEEP 192:5U6YW6FPmwH+TKyPbvkeRRRnwHpClxTLpfGs:5Tv6Fb+dRRnAC7HpfT
MD5 SHA1 SHA512 SSDEEP

Submit Download

game32ba.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\game32ba.png
Size 2KB
SHA256 8ee4fe89629b354d3df54793069902dfbbe1a25d2d3b24f671311857d634dedb
MD5 90fe5967020f69268cc096cb5fd73b81
SHA1 bbcf981202a33ce156ae1c909acb7b6642387737
SHA512 eddd0b1f040e16dd1bb815c132e7a000f012a30f3f386ddd95a23bb371db550cc71b00729b0961aefc7a5929353251717d64e428ca1549cf88191bef3f554746
MD5 SHA1 SHA512

Submit Download

game64ba.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\game64ba.png
Size 6KB
SHA256 58c53f2dabbbf7680707ff3dd9f5edf9d02f445dc6b120fe57ccdc9e26fd7980
MD5 f39e40ef1d6e44ebe2a7b3f73bb0eea2
SHA1 fb3a20fcd74f1d643749b92100c13171b7957045
SHA512 a6a31aaf63a35710749f4faa30f64b97c2e282f1597dca3aeeeb8131c7afdf3abbb4997bbf8196c07c266a9892a3cfbf52d76c23af2a4431e77e6f223d7143ff
SSDEEP 192:6RQTFeg/A/7Km86fAvF4a2NrvvbYrZoazU8O:6G5fA/Gm86fC4a2NrLMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

games16.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\games16.png
Size 495B
SHA256 fcd1abd1397e4107640e1629cd93f3269bb1a3d75a58d0cd6ef6613305ecda7f
MD5 f6f05110f9a8aecb4ec65cfc16251bd8
SHA1 384bc03f207ea443e6f54a3f2420e0ba4e2d8885
SHA512 342aff256dfcaf7f208ca646787000a684369f0ca99816b6ecf0980f31fa714d681de3d6cbea9bc718ec34ece673e61ad170969d9ff59dc4233169f1c855095b
MD5 SHA1 SHA512

Submit Download

games32.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\games32.png
Size 1007B
SHA256 be929438bb4cebc9fd8ecb1f83373ea343b5ad5956478c573106dfdafa4f73a5
MD5 04f9c95d6cdb6cb77843110a1c62750d
SHA1 705c8d39dcd674238e4750b9eef7899d58aac0a8
SHA512 e6e35bed342ed7806fe324093ac50ae913308ea6e5e5ba666a66ece9dc38ef382940d09f1748af23afef3c4b7280c89d626b4c1ab550f5a9420bbe7a2b3eaa6b
MD5 SHA1 SHA512

Submit Download

icons-arrow-left.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-arrow-left.png
Size 114B
SHA256 96564dad5a2a4eafb169bcc14643d9727cf69ded6e577d0a65f0d48e34de6dbe
MD5 0316a9bee6403811ee41564c2192c6fa
SHA1 9c67f4bb7382f817db355bf350f2a619212ac723
SHA512 fc26623038dcb9d031bce2427d1915e5b06e5b98236078f04bc064a796d527b588d74de24780724c4781fdb8663326a11c3e02372024ec2ab4cacf81b50615fa
MD5 SHA1 SHA512

Submit Download

icons-arrow-right.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-arrow-right.png
Size 118B
SHA256 ea1fb8c22e14f10c710f35f0f592e456204bcf978c3f5a5a5647b9443989e02a
MD5 df55e8580dca09931655cedd61850e3c
SHA1 18b96efda82ed2cee57750d63e74df0e926f6593
SHA512 d9f80d38e651782ba03521145ffc5304d036b313a8c52b792d735fa62473b93bbccf11bcfbc69d4132d33bbefeba950edd7f02650e655cdf95a16d4b50cfcab5
MD5 SHA1 SHA512

Submit Download

icons-arrow2-right.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-arrow2-right.png
Size 125B
SHA256 04d14e47bdad0e248018eac039f3e24ac9504671fb5fe5128e960168bf846001
MD5 f6250c832373ba641bf325e0951d70b4
SHA1 bc6b340b205b4aa7a4b2886093472fb721c0348d
SHA512 83ca9c58368cfedf5f20e3f0d991803aa79a798d67c29d38823dbc4ae728be039bf44842fbe697fbf868b917c85391b0e85721763c907b04663a64c68e4d9fcd
MD5 SHA1 SHA512

Submit Download

icons-collapse.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-collapse.png
Size 219B
SHA256 7514f55ace651787f86ce9452b736b763e66d95257b2068623aafdfc48ef3c11
MD5 652a9ac2c83be45e00730937f7889d9b
SHA1 6cd3d8fb78889cd4130c32be03f16d229ec29f7f
SHA512 df87346a5d493584e017c03fcd54dab5f318b303f7e61ffb583fccd54610e0ee64fa3814e99d2a93d83db262bbac9dcd8762f405a42731c765d8012275274680
MD5 SHA1 SHA512

Submit Download

icons-expand.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-expand.png
Size 146B
SHA256 2e2dcfc2cafcdef1b2802c1cb0b8a60440967b607ba3b5e208991442f7fa3c37
MD5 59e55cf3ed8de30d4f2a0ac8376af2fc
SHA1 6730cf665b8d9e725427726e865ad898e99422cd
SHA512 332223d54bbc24237e59747465ef38634dac6e69d13d4014039efbc564850199f6d93d7efe53fcc8fae27c51bea6644c111b7e113ee5e1fc894f5e5f532b5337
MD5 SHA1 SHA512

Submit Download

icons-feed.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-feed.png
Size 342B
SHA256 adcddfbc25c6012476f345836dff0e0f3c61a403cc0686353b05c1017d1d2281
MD5 b2d544a1ee6ed2a1a2e1b6523f867516
SHA1 2916790a9123f7a1963fdacacc0f49afa598848f
SHA512 5a0fcea581dfb597b4386dec0f5a0e0d2c776e395612a5128f6466adda6416faafbc509dc6eb8999f3876913c9137f9b39f224e026aa6df1492e7ffbc7fc8b8e
MD5 SHA1 SHA512

Submit Download

icons-friends.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-friends.png
Size 291B
SHA256 527196d8a4339adf0f3b1c43e3c1526e9ad999563eb2e9a9556402645793b441
MD5 089a2b79921d8ee8887fa4abc968dc52
SHA1 fe7a5314bd0ab305f8b04b57aba0e24b44f5f3aa
SHA512 6c3dd621a1fdfc07161df90d09e3be3f136cc34d98699d54560b65161e790168fb72d3d4da29fafab815cb231057d835b03d319ea1da108702982e8d9e477b92
MD5 SHA1 SHA512

Submit Download

icons-games.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-games.png
Size 303B
SHA256 87647dff31bdec5b37665ece40607b7f48864fc06b05906333f980cbb0fde314
MD5 56444178772525dc83e5a174c4ea526c
SHA1 11d4deea39bb3c4a6d9e74403d91c2a4416e4a3f
SHA512 1163074352fea3addd3ed50a14c6955bf42154f6b19874738fe635c72f233f7a13273dd24db97514d12ace8454f29be089676091a458707c370efd1e9e00ced7
MD5 SHA1 SHA512

Submit Download

icons-home.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-home.png
Size 152B
SHA256 0d80f62dc480ec5ba0c8d9c259181bb3f2b063c23f69ab7f45ebd8ab273db607
MD5 e1b648a85af63feed70f0eb345c530fa
SHA1 9c867b3297b72d4b2ba1ece79ca4e12f34011d8b
SHA512 8e80b9c24a9be09c2caf7dae2840d09fdd3d1069fe92ddafb7e3684ce75413e41105271015f4cb1c5bead8be63bde0fde3c1488055ba45a0523c6f3a9f18b4af
MD5 SHA1 SHA512

Submit Download

icons-loading.gif

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-loading.gif
Size 2KB
SHA256 d04ab59483ddf195f2c03f4f053079b127793ca6ce6848a511c76f434c0c4d13
MD5 cc958db5383b4dfa0d8f41568bc3310f
SHA1 3d605fa22408a7e796cb7ada1b3fac3ef50b786b
SHA512 4059dec03553b9f11052109d9b132dc2ac3f81ab586b1502ca74b08b473a5f4b39314bd6997c05075d0ce43f641688794922341c078c4206bdcbb913eefcff65
MD5 SHA1 SHA512

Submit Download

icons-menu.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-menu.png
Size 298B
SHA256 8fd55a048c9ec8fd78a98c38636fd211aef51fabd0188005e362bd5b2c03f184
MD5 ef150c2124694e56e19ab93a851ff157
SHA1 758baec409bdcf74081b91eb6f9c8faaa0d2930d
SHA512 32a4290be27bc1156ed1e0d32453d458567064ddfb0037bb38bbc96d93952a952d77bd02f02c0e47783d62034ea7048d2075e3986357c42e9b47b1f0ff9ede8d
MD5 SHA1 SHA512

Submit Download

icons-resources.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-resources.png
Size 287B
SHA256 e8a08202e112be89582842dd4079821de7027c1e3bd7b43811336e3fd4674e67
MD5 773ed3561813377a562024d8849d9c90
SHA1 3f97d65e2863d14d7eed0fbfa5abfa9f2a155a85
SHA512 595f475f7ee01137cdfb5978d507007bfae56db92c3036829d6216d6ff384b98061cb6fe4cfecd1af81236023b940a42b7dbe1f93a9cf50c0b5e5be6004f7ddc
MD5 SHA1 SHA512

Submit Download

icons-search.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-search.png
Size 234B
SHA256 3dcade90a68e5abfd20755f2f1a485179db1f763a43a5d25be0b7f01585a1406
MD5 fba6eda5fb36364520da9934c722cdab
SHA1 fb35e8fc924c2f7e3f430468a6ffd9b0671c7b43
SHA512 ec14aa81908d297e76d778adb379c79af6c29fba9e6f4fc0aff84acc91713c788dcd79a6832f47da0e88b280a0df879462ceff721f0e3e2f3e73e43c5aeedace
MD5 SHA1 SHA512

Submit Download

icons-tabs.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-tabs.png
Size 135B
SHA256 da0200ee9dca5c0f71f977e7b5bbdf0b6288264b88f1c265473577a7eecf56cf
MD5 793d031485a58373f22cbaf2f44b4fb8
SHA1 c2251ef61b2b7a506aa2f93f73eff62c43f58542
SHA512 c0f36c964799078208d50bc8334a5aaaeeaf2b5adec9410264608dc60bbbb9467f6454eb5f9574812732d2e8b4e5e33edd15b734fb14a7c7e7dc9cb70119246e
MD5 SHA1 SHA512

Submit Download

icons-update.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\icons-update.png
Size 134B
SHA256 fa1c6485db2fe35055c6608deea50a87bf59e9976eb2f133efef8c4bc1db27f2
MD5 bd4216a59d92f17364e5d40f667ade45
SHA1 400d56c2c77b066c657294d0edb3685154f791aa
SHA512 7115a1ee2b2b6f398f7f368fc3a7342e4432b6b101f26745946de684d454977028f492e6d7ee55ad635330912bc89cc055f34130dbd07c7e12c332629370a353
MD5 SHA1 SHA512

Submit Download

jquery.js

Path C:\Users\Admin\Documents\BYOND\pager\custom\jquery.js
Size 76KB
SHA256 a9b5d47854d0e4ccc82bc9e3bb2caf02dedda53d22f2aff34bdaf090eeed813e
MD5 994cdbe61b3eecbd659957760c192654
SHA1 5649823cb791a96077bc4f967f21927625d97715
SHA512 423bedc745ea7ba3c8034b2eafd5d704eac5a577cf2b4d2d2a7ba1808bc68f18e9b5937a29a33d73b3981d3ebea2abbfafaf865069a882eea26dfe3c34dbea63
SSDEEP 1536:KqlVunnadmaVWfGx7St/7VBfuwNPY9TV6k+tly3p40CSoPjCAl6jHkA4x9K:KQQadLo7aVCSojlakA4x9K
MD5 SHA1 SHA512 SSDEEP

Submit Download

member16.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\member16.png
Size 687B
SHA256 b1b941610df7550b922ae951e9bde59b1678a797b506c9c54ab2db33f22d8773
MD5 7cd215b3b67d73f5088ff247f4e1411c
SHA1 8ffc24536280631c5ad1944f3e425004df413d0f
SHA512 56ae6d6ab4bebe02bec5b076a0e5001e15ce179704ffff20a70dcf251ff89964c262c6e939147f5abf2caeee6611e29077c61f4fa8ac78a7b97223905a602403
MD5 SHA1 SHA512

Submit Download

member32.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\member32.png
Size 1KB
SHA256 1b441f51f995c9b4ab5b2da012bb5a38cd761ac862abf8bbd69e7f050c7b27db
MD5 a49c836906c23f29215f181e0e0f8945
SHA1 40561557adefff3d81f0bc833476b1d49a5ddc84
SHA512 de517581e9cf9257a373826595528178ea5b3f14fb99975e992d7364ed87b84b57f1b309b4849837cc19bf39b24c54c934419179cb636463a4d16a15ece897e9
MD5 SHA1 SHA512

Submit Download

member_avatar.gif

Path C:\Users\Admin\Documents\BYOND\pager\custom\member_avatar.gif
Size 2KB
SHA256 5e4e6d92fb8f830d2735ff1c88ff42a769a0993c610cb48b77345bb0a947adfa
MD5 921171dba03e620253ba22a753db4559
SHA1 d0bd5bbc1ce54bb1993ba7e835b47e99c669368c
SHA512 8515444b7e6958794e0b8729b6162f64d39b894dec9d6729f543344e23e68ad48f05058a4ba683131a5fdb236f70fb6e58ea7554cc2345d6a84f009f0c48c146
MD5 SHA1 SHA512

Submit Download

multi_player_icon.gif

Path C:\Users\Admin\Documents\BYOND\pager\custom\multi_player_icon.gif
Size 1021B
SHA256 1ae01f1b31d3ad305d528c013a01569fdfaac0b854bd5d0ce87b2036c40f12d1
MD5 e50617b8a05c57ea1e8a6bc0178971a1
SHA1 e826fdbb15201624d87dfa43e5377a7549a89e1b
SHA512 56e6668a44d9a7b23cee973e30d105bd17b83072a407ea72419af149b28779e769d0e2ccff6fa4b39a42f496c25f7e14fa0f41fd71ffa0113998d4b53381b237
MD5 SHA1 SHA512

Submit Download

news16.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\news16.png
Size 822B
SHA256 24df2120da11dc9facf1122a4acaa68703215358be5761d6d36ae338ae2fd1fc
MD5 8a8d7e5c56050099e34b960e0577edc4
SHA1 6d4ecf558a09b4156a4d2cbeaeb39a46c8d829ce
SHA512 eea3cfadbd49dc572e07901b8b6f83cc644176a7c61765a78dad7e9af6fb928e32e14f13291ccd6ce0c662c9b4cad5ff7456f140e63a3e0bf9c1150af62a9f15
MD5 SHA1 SHA512

Submit Download

news32.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\news32.png
Size 1KB
SHA256 c5d0aeedd0ed0918e9d143e3d236695ddb6156c7486e2e9c8cae4c163bd5f6ae
MD5 9839105db2fa6e6c60818b12faab8acf
SHA1 5f0a58d7dbeeb53cfbe6e07a4d615b622f3494f7
SHA512 96d326842982b9d9362c68a9d5c8da77eb6640945e3da79c2c81a2fc2d4dbbbbaaebdf15d82007e26fe0f534ab20a307e6476757bb2a91b04894bbadf1fc1469
MD5 SHA1 SHA512

Submit Download

nonmember_avatar.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\nonmember_avatar.png
Size 742B
SHA256 36d8226910f2c8d41198c5c07f6c377e2e48492128a8c5ed7606af3e80596f16
MD5 9e65704cbaab4ee2b232a019ab6848a7
SHA1 51ed7a1a40f888401be143795ea54fcfb79ca129
SHA512 abf99fb9dc6446e8a9d25561c4b654689916d8273924d4397d7260ee15be77f862630261971072c0505e71a99c617bd2fca42fe4f7ed2da4610acae04802991d
MD5 SHA1 SHA512

Submit Download

pagerhome.css

Path C:\Users\Admin\Documents\BYOND\pager\custom\pagerhome.css
Size 41KB
SHA256 0c944588a73318a5dc6f9b77ccc411962d9add995646bd358a7b707ca7c6ac22
MD5 aae567e038be042efb38f18d2f075f71
SHA1 d942953e1a08b433d0462907ee9ff13680fd3ab2
SHA512 954545c6a3e7c9d049e51f917184b26755ba54a88208bab51273ae5e0f44d4050182c5337945d1bba43a102610afbee8df9e9a832200e5015df050462b488f77
SSDEEP 768:OMWrtdFEA4MI9b/8TmTHXT+yiBMMxJHHMk7w5a:OMq1EXFaTmTHjYB
MD5 SHA1 SHA512 SSDEEP

Submit Download

pagerhome.html

Path C:\Users\Admin\Documents\BYOND\pager\custom\pagerhome.html
Size 2KB
SHA256 ac5046577e8b1082dac07d1e85691f1c51f66846c007f5213e5601812fd0be18
MD5 7e84e5c1c980558513b45a327fca89f3
SHA1 7af253a263b095cdf4b154f23715513374e7a5a7
SHA512 fd50b2c3873ee0adc4e0c964ed3b740f3dd783e1b0b3d5e23b574a4ad1c7931859c8d6944dac2a807df4323b11d205657656c08ef51a02e4c60d48c0fd5525d9
MD5 SHA1 SHA512

Submit Download

pagerhome.js

Path C:\Users\Admin\Documents\BYOND\pager\custom\pagerhome.js
Size 255KB
SHA256 d9e646c1c3cd2f098a51ffff9d7600c863a68e7119bc94d191896f33d98ff40e
MD5 4b8fb5cbda485d4c82c72ab9d88b9444
SHA1 3c79ae4b1a801060914ec10522879ffc024cf05b
SHA512 23007bbc93136751c6be7c717166fcdff185be89ef161e975f4e7488be77e00b9182791b166d8b5d74ae5892a4c147a962c51e58a0d5db6ef10076e8253d1297
SSDEEP 3072:1tK4/AhwHqxA35j4dESQ/xa49tX6blo1FVfvBus++00+0lGYAgsQtL:1r/AhwKx1ESQ5ai6bUF9vBeYAgsQtL
MD5 SHA1 SHA512 SSDEEP

Submit Download

pixel.gif

Path C:\Users\Admin\Documents\BYOND\pager\custom\pixel.gif
Size 43B
SHA256 7e928161cd626935d39ff08188caa3f3a918811ca87194082dedf28b697ce6fd
MD5 ea05ec2274832731bf2413a6192a245d
SHA1 d36405c92765acc00a3f0b73c02443927f439d2f
SHA512 19f4a1311d2346a335dc2be4b014bea2b2e2ebcf8a243b4735e45fbb26628c4d9aa11efd3122bac7aa846d1f990e8d9150384ea5a402712a7ab63df8022a012c
MD5 SHA1 SHA512

Submit Download

scroll.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\scroll.png
Size 444B
SHA256 2be5a298697b0821e00e1cc4a7ff8eb1afdc3e771da280f05806f3a7d8484854
MD5 d33f984fbaaef73244bdd2fd36650477
SHA1 299fcc316ad258bc4f7f0977615d62a91e100736
SHA512 07d334487bda927381f371bbcfda5d67d52e439a8c570e6ffe4fb7487cf407b4f2dd3cef986b6d957e2966ecb7be7e7ba52e394c2f3111bbdc02d109208d8582
MD5 SHA1 SHA512

Submit Download

scrollarrow.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\scrollarrow.png
Size 576B
SHA256 a5ad08c8cc8e264d9e06cd77cd413e6733acb312c74b872499c45f07d133aecc
MD5 53dc4f3b65d799e9c0ededfa3174a901
SHA1 08950b1c0be8bc806cba90b9337af2e821c87fe0
SHA512 0ac40c971b2add2e8357d6e2ff8730e0e8911815c846ed8d0669b27b33ab06441368c5e0159637a9b7fd3924a535901748279f22d9f7bbea54f26aa17524545c
MD5 SHA1 SHA512

Submit Download

scrollx.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\scrollx.png
Size 118B
SHA256 97772e739975ed8c56f3d387edcc817734af6458598f541d2e7ffa9e2483639e
MD5 d82278712ee559a6f5df1956115caacc
SHA1 fcba1314ef306f5dd4ec6241f1eb9802fa67f645
SHA512 4aab12dcc1756ab40f473abf87216b3b19e7d86e82a61151c46dd38490fd0286ac2aba9c39fbf4204255b3fed7b50ad11cdbb3c22c72ee78116d002b42ab438f
MD5 SHA1 SHA512

Submit Download

scrolly.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\scrolly.png
Size 109B
SHA256 04dd87497daa775744e4e5aaa6ed394869a628cccaef02b32be6645841eb83bf
MD5 1c60bd1b7506ba5c9038a2eb7c8b57b8
SHA1 c34a69be3b089a608136a4e1cf3e86782ba22a40
SHA512 9bc9f9850b2db09472ef911a1b6178caf606a29f823c2314fed42c28fb057a7b36d3c42293c882d92c60604a7261eac1ccc5edbd2adb6fb09320e0c0d5d07410
MD5 SHA1 SHA512

Submit Download

update16.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\update16.png
Size 724B
SHA256 957cce23e7a3f1a4f6a0333b493144c14a33d62264db1116db9aac68678d34d7
MD5 7f1664bb1b1eeff0948180b65bc82ef3
SHA1 3c1182b6bba072eeba5470f2d53408322331b767
SHA512 53db248229b4449df6f00d4197c0916d96d606fbbbe8b0f2f4b41b78ec5c28a186d7435d1b42b5e5c4216b7dd6b3059698074b9ee27debc70c286c876ce45b72
MD5 SHA1 SHA512

Submit Download

update32.png

Path C:\Users\Admin\Documents\BYOND\pager\custom\update32.png
Size 2KB
SHA256 93e247fb5e161540e56974f457ed91c0e089109e8c94a3e0123c67acea31906c
MD5 972de98ded4e59e300b8c13a32c2ddef
SHA1 d457cba43382f27262424fab99d3104c315cb594
SHA512 e8e48e1cfed4bbf14fd47ae57fa0a42b1c92ec20cf1f0f70123fcf8e51a32f980b323133b244a2bccf320f09e149b21f18b17a5ba5c7f2972cd5b970d308a89f
MD5 SHA1 SHA512

Submit Download

515.1646_byond.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\515.1646_byond.exe:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

Unconfirmed 650111.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 650111.crdownload
Size 7.3MB
SHA256 ac1015d2ba7c011020874a3afbf2eeeb4582298a2940bb4274a1a7ffd00e4e5c
MD5 06de75ca11b9e538af04f78cd3164e83
SHA1 b981f63444309c984e67d654ad904e059747df5f
SHA512 97ee3974e7720f8752adb6b7d121330ab115cae74e3c1232d54c2dc0c15b767dc54597e20e0b2a66de3cc45771687e424472ab89f83481582eb2fa3e2ce77d9c
SSDEEP 196608:wxMb9J3/hXfJi0AbHvNP0zFZXmEFhMhHIw4U26HGLSr:GwvvpA7654dk1Le
MD5 SHA1 SHA512 SSDEEP

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 12KB
SHA256 eb265ef56946ad22af90efa3722eb93e7db084450492e27d76d8653e800070ee
MD5 5739a290292c6930583716fb5b3aa5e9
SHA1 a967a207fcf2e86aaecfaacad01bacf0654af219
SHA512 94ab8bb1cf57cecab08cbcc464bb9843cb0cd65a5807e741b3c255239f79bc1c587e97764a9d60a65afe65f70af02a1c523e4cbd48acd78d2d77bbc353b9eb15
SSDEEP 96:shgQLSL9LEiLO7D7vww3qNwrOxU6NxJA7fbvfU8dtRKX7HYHIo7h9o7Bd73cn1pc:evcpEsHss
MD5 SHA1 SHA512 SSDEEP

Submit Download