healer | 0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259

Resubmissions

10-11-2024 17:00

241110-vhz6ws1fkc 10

10-11-2024 16:56

241110-vfsn2atqer 10

Analysis

max time kernel
527s
max time network
458s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
10-11-2024 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe
Size

405KB
MD5

c8fed0fa50014ddb18ad75f74d2e0e00
SHA1

c7ce6ef6413f991efa11284160e44067c7c19a3d
SHA256

0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259
SHA512

0d3480d3d542f0d558f681c6d5127bdf2a94eaabc065c928ee21e0d8b26df5bbefc1b24fbf76cac3e3333f77cfbecec386976eea829dca2a1644b438b25e740b
SSDEEP

6144:6Sp0yN90QEilqnRgZqLtts1Pc9XuZm8yFwiqliBa+WytZuVrDrM:qy90cyKZqLt+16Xuew/i0egrXM

Score

10^/10

healer adware discovery dropper evasion persistence stealer trojan

Malware Config

Signatures

Detects Healer an antivirus disabler dropper 17 IoCs

resource	yara_rule
behavioral1/memory/4268-8-0x00000000024E0000-0x00000000024FA000-memory.dmp	healer
behavioral1/memory/4268-11-0x0000000002760000-0x0000000002778000-memory.dmp	healer
behavioral1/memory/4268-13-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-39-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-38-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-31-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-29-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-27-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-25-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-23-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-21-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-19-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-17-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-12-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-36-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-33-0x0000000002760000-0x0000000002773000-memory.dmp	healer
behavioral1/memory/4268-16-0x0000000002760000-0x0000000002773000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	265967028.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	265967028.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	265967028.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	265967028.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	265967028.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	193523570.exe

Modifies Shared Task Scheduler registry keys 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler	reanimator.exe

Executes dropped EXE 2 IoCs

pid	Process
4268	193523570.exe
1452	265967028.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	265967028.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	193523570.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	193523570.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	reanimator.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
10	drive.google.com
22	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3708	1452	WerFault.exe	81

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	193523570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	265967028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unhackme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reanimator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wu.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 15 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Search	reanimator.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Explorer Bars	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Extensions	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Search	reanimator.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Extensions	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Plugins\Extension	reanimator.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Styles	reanimator.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Toolbar	reanimator.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\Main	reanimator.exe
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000\Software\Microsoft\Internet Explorer\SearchUrl	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reanimator.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	reanimator.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\UnhackMe Pro 16_40.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4268	193523570.exe
4268	193523570.exe
1452	265967028.exe
1452	265967028.exe
4500	msedge.exe
4500	msedge.exe
2468	msedge.exe
2468	msedge.exe
732	identity_helper.exe
732	identity_helper.exe
868	msedge.exe
868	msedge.exe
784	msedge.exe
784	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4836	Unhackme.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	193523570.exe
Token: SeDebugPrivilege	1452	265967028.exe
Token: SeBackupPrivilege	4836	Unhackme.exe
Token: SeDebugPrivilege	4688	reanimator.exe
Token: SeDebugPrivilege	4688	reanimator.exe
Token: SeBackupPrivilege	4688	reanimator.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe
2468	msedge.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
4836	Unhackme.exe
4836	Unhackme.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
5040	wu.exe
5040	wu.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe
4688	reanimator.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4268	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	79
PID 8 wrote to memory of 4268	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	79
PID 8 wrote to memory of 4268	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	79
PID 8 wrote to memory of 1452	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	81
PID 8 wrote to memory of 1452	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	81
PID 8 wrote to memory of 1452	8	0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe	81
PID 2468 wrote to memory of 1680	2468	msedge.exe	88
PID 2468 wrote to memory of 1680	2468	msedge.exe	88
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 3656	2468	msedge.exe	89
PID 2468 wrote to memory of 4500	2468	msedge.exe	90
PID 2468 wrote to memory of 4500	2468	msedge.exe	90
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91
PID 2468 wrote to memory of 4256	2468	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe
"C:\Users\Admin\AppData\Local\Temp\0acf6dc30535cf1ec098cda2a9d8e0687dd0a2852af3e685aac0e99182677259N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\193523570.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\193523570.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\265967028.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\265967028.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1452 -s 972
    3⤵
    - Program crash
    PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1452 -ip 1452
1⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf9763cb8,0x7ffaf9763cc8,0x7ffaf9763cd8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,1379581655352336541,12313090298060551227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5072

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3964

C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\Unhackme.exe
"C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\Unhackme.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4836
- C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\reanimator.exe
  "C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\reanimator.exe" /wiz /full /imode
  2⤵
  - Modifies Shared Task Scheduler registry keys
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4688
- - C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\wu.exe
    "C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\wu.exe" http://greatis.com/dbs.ini /r /i
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4c1a24fa898d2a98b540b20272c8e47b

SHA1
3218bff9ce95b52842fa1b8bd00be073177141ef

SHA256
bbcc378fcbf64580e7a48b4e7ca9be57fa0a1f2e747f488325685bdb18d73a95

SHA512
e61f196e7f1c9a5fe249abe9b11eea770fb2f4babc61f60b12c71f43e6fe9354cf14869daf46abc2c2655bce180252acd43c10562a2dcd31fa7d90d33253820e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1d2c7fd2ca29bb77a5da2d1847fbb92

SHA1
840de2cf36c22ba10ac96f90890b6a12a56526c6

SHA256
58d0f80310f4a84f687c5ce0adaa982eb42fe4480510399fa2ae975d40bb8bc5

SHA512
ede1fafea2404f16948fe0b5ea5161ccee3ee6e40c55ff98c337eac981a6776b9c73dc030a5c59e4347aec91259f497539206e71949c33adcecbf2c846709e14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
00f2266596951586035abb85d1e73862

SHA1
b9b393684a75c3a205fc638cf9e49641a0e5c800

SHA256
4f4e37cc1eeea64418a6ecfd1c401ecfb3d85bf8b23d72389bfc89b3fbc9d170

SHA512
bc03751a605f584c2225b7517e9c93acefd728d462e60d75f0c27dec31b110f44bc4b37881f62ffdd4ac66d45c9ac2b1bb61f247d3a04cc4194657b6025e3905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
3f6bcb2955c791c183122699ff21cf62

SHA1
582f792cdebf05ffadcc2aeda19e7e0130b397e9

SHA256
8086a00de606b5700f1b2496d6a83a4abadf27f22238c1230d9545df834f4086

SHA512
f09a9b3add3503f25d723248bb6dc8f688058ce68c848cc02b7034e8a2a957b944c98885a66e4477f1577027c0fcb5b4033356101615408031b1a40e33a390eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9f6905a42b001f2a79607852227f5656

SHA1
3a086c54055f5717f9b17fefef2663ab72e52d76

SHA256
60871b76aaa435dcfb0f09ac20b21c053bd3bf173243141ce950e5dca6ca57d9

SHA512
f457bd72e44b851c50923e9349847022a00e71d2ddd928ed93f63f9d0cd5c919174be61dd22004488a2dfe4c4d9b71889d1dffbe77998b605b89d3b338b530bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d428392b9e1464dbc07ecb06b98960ca

SHA1
e486e0ab0e613632df46dd57e3a3672ab0e2d919

SHA256
56066bbf12454419ddbce0d3a1e499288b922e88529abc8abff7a3cc85d6700d

SHA512
1ebdc6352e02433a97f4bdbd93780ddf9bf15954536dd0e07ee539dc344935d700fca3c5dd3e42b74be28e730fb579a5ab36dacbbf6c37935f58cee528b5b6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dca1014e12b4299e2d268393f409f263

SHA1
90bc1f79e16333c705b463b6ef3a61fe2d999b1d

SHA256
c080ac026e4ee84781b8f9b46cced23251fd010389422222015971e50399bb04

SHA512
9bf9f687e6ab0d5f4d78bd78f4187c0b6bed9f967ad187ac79f5b61d88b9f0135dbbbd80ac17445579f3e96a2b4b659f7f8d9c5b58a1df726eec3edf67fd6fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51afa0b6b8c5e4dcf4eb5db17ec32236

SHA1
82f18ff8a34ff2588bb8720795295356cc45f051

SHA256
ea6cbe35225be2236ee21b84b80043af4262c4467f235f1e579483a5c56f3063

SHA512
04a38f73f5e5bcdf643a0b89208a80cfbcb3ff293d7d0f018a8da269c6c528e1916959197daf0af1a5a6a1eb8881955996ae31ce78badff15e2e3cca7f7ead15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
35a563e4a29b7a1bd87c82d5667f3871

SHA1
4f1335f9e509e8c395c8ef39d9d548dc5f856bc2

SHA256
624f2fdb84d1693d4ffd039f51bcca52bf95dd5f756587958329217a64b3e20f

SHA512
e64a5a142538294b25549117326d847bf886864c2ec9568a832122499aeeef47db58b618d8db7ccd34a54eeb153c82afef0c98ed82a16661c69b677b22a50fd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5d2647.TMP

Filesize
1KB

MD5
7e33ff5817ffc908debf19ccdc3c2170

SHA1
bdf8d281abb8deac04fffb543192e48e03d48d6d

SHA256
5f1ffbd4834df6d487000d6ff55c154cd165c3c25b8fc3ae6bc8f8ee67fb6afa

SHA512
42132b5eb0767913b2eb338d5fb080e5a33de2f5d105b7075dd79936ecdfac37c1c0facb81ee2d5100832ce5541d850c62ef76edbc7c45a31480e005f0a3c5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c85e5d31eda3612b16b504fe7b986172

SHA1
9bc4252ddfbe57467bff8a77badd341674983e47

SHA256
2b65da95937481f99b08dce240acc4e94e571a7fb5715ddf15240d3efc079be1

SHA512
da4c5af995f69ab6c357e8c1b48116b7e65927ff7b5a93d2dbb2f27c26496b0bb627d2f54938f2a60a740290e6910eb0a2449e2fd8925a4bc27bfa6c3b5ed7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ff7430b698799395ddeb43bcd2b402df

SHA1
e8a9d63ac6688b25efd4f07a9f0bb8be6409298a

SHA256
b34fce9c672357c0fcfc439d3ea00f0074e0764702c41c4ee782a540274ca335

SHA512
1216944e08a39a87eecf797493b079885fe8a7fe94227f2e6c8fb9bc5a1fc6c6473194499850c886b1bcc11a610fc061349d94a4a6bdd484276b8493c66c3719

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\193523570.exe

Filesize
176KB

MD5
2b71f4b18ac8214a2bff547b6ce2f64f

SHA1
b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

SHA256
f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

SHA512
33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\265967028.exe

Filesize
258KB

MD5
9d56475d62d9f34e3d2364c2b64b3351

SHA1
c7842abd3ec8f395ba3a852c1c029f8e00da21d0

SHA256
4bd19946b44e1f844d83a453a474f2228a32749364ccf46d0df4651343e98d81

SHA512
1fc365079f407c5cfe75387bcb50fd0693c23c22c4d3d730b78c62ca0831d7ee37fb9cbf619d2afffdebcf21978d47f365e5078d59f27cc454157220c4a743a7

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
7KB

MD5
308d58eb4a4896fc6c24bad5075f6cf0

SHA1
1416b561949e1f5ef8bcf267afb9bf7a70783e61

SHA256
3a881faff308b176421c4feb8cb0de82fed66dc3ed0a10aa7175863989e932db

SHA512
10c3a6d693e598f44a60cf5d551fd246d89bd3a8f63c0f22286d9e038e0cb0d3dcae3aa703e3d13f3e5ced837ff4cd824d5b32c9ec1454e51de8c4a94893b724

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
8KB

MD5
8790be7ce29dcedbe5b5b822d12260e5

SHA1
a6a11964d39fd3b45748ea7f459ccb3657253580

SHA256
9f9dc0cc4b976a546f016d5118640aa5cbdaa8b0c9cedcc765005d64b512dbfa

SHA512
d039239b083db3509978ff0846c6675c3c43eadcb1a3447f747d667527138abf779460f7c96e1696380703b5ec26015a71480ef2a755310129cdaa75a81a9b4c

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
8KB

MD5
8c02acfe2770a5fc3f5718dcbe1d8a70

SHA1
0f1f3fdd4c330ef0372ebd7b280f47a2c496e51d

SHA256
2e54f5cf86903cf7889212c2b7131cb52aa3a990b29e1b712522a87960336624

SHA512
40a15071a981d04164886e7c8c4ee9da686c85105f8ce383937dc6e60cdb1daf8a179a268b37ccc27cee9f0da778a71aebbbfb56cc439f172058d702d1227e6c

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
10KB

MD5
aa5aa9ae43cf64805d5dfb991c103590

SHA1
54d02992c20478f2eab0d8fb0605fa62580b0b20

SHA256
841cf3a8caf66b706c7be8c01905e008dc98944513fbe9dc748fd74ad67f1de9

SHA512
f86aafdc8d0982c48518651af7409220aac8e7b9b1f2b07b9f8f750ebc01ab82189440427e17ae1e2416087d923c1d7e56319653f0dccbb04a8a4a41ae303322

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
386B

MD5
dbfd8255f1fe0129878b3a87c26484c5

SHA1
594f1a36d7cdef1431d4cd1b58601955b851ff19

SHA256
7b2d3425482ce9d3b326619fa17df0e637688336faf4e4cb2ec2063b7b63f400

SHA512
04183de822415686115bfd6a1994b983b6c6eb73b87d2f68a3657c852fcd521bb56d9a52380ae766075a711dabf4af6df6a52017f1d94910ab205434b8932d57

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
3KB

MD5
5ace0a1bab9826d6229959a8c30024aa

SHA1
79142e232f838f1e5a188b7efb0becdfceee243a

SHA256
47baf1d48deb3b34cdcf21109b7473c9ac74feea2dc7763243e1f6e7f42bd368

SHA512
52fc21b9a7c22cda53db141e50893a47ceca3257bd3c4a0f2e39dee3332ffb0ef8eae0bf5b70920ea64c5a4109fe4a2cf3a6172d7360b77416dee342cd81d3ff

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\lastscan.ini

Filesize
5KB

MD5
413e4c96b6af4645331f6ed96c626bae

SHA1
e36f6f0c8b5c896e41206622110f80ed430a421d

SHA256
0c6bdc53753e78bd84b00e71bb4fa6158f78aec2bfe044a08d466b93b7519fdf

SHA512
e1c2c6e124ca6c91f90d77729ceebd7d07d04c95f9f5ade21975ce36aa3f6c546d324e79d28ec78bce5788b70d0d6c0e4aabd52a7d25eacb186f26bdd9c0f32a

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\rr2log.txt

Filesize
2KB

MD5
8b920c368cdb8b6efafe20b55cd282c1

SHA1
bf59ff096f445a398a532d11bb41aa0e31f9afa8

SHA256
db26dcce80e0ff41935f168e39e7a777a24a44616c953187922fa1c0efe404df

SHA512
74bccc403405fc592d0353d71fa4049be0dbb2754cc631693b07a456de299d29fa5acc43094a72cd53a45acba9d675619ddd65c77b370b3fd47524f7d776b63b

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\rr2log.txt

Filesize
3KB

MD5
9ef376d33285a33de4110ebc3ad9d1aa

SHA1
d830e01c836c0bf016ff3df5d08c21fa4b75ec6f

SHA256
0dc9e0226cb3333b034b4a0b177b5eaa9f8c1791f1d337a009fc1b067ce08cab

SHA512
74ed69c9df07f8ceff1aad01fc9002db21c6637598c2491637ccd2eb09ef82372bd362cd0c773bf2844e3735d1e4f368feff65c269a2c36db33a9317f06fb3e6

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\rr2log.txt

Filesize
1KB

MD5
78396ac11a2db8f990a1c3563fd0510b

SHA1
093ee9820f5de007be0f1cd7a41e4a48ca6704fc

SHA256
942869edc2c3aefa5a2289294fac31ce651aebfaf03aa96fe510e9512c881155

SHA512
d9b3de1834ae526d1dbfb26b89927d5bf7d79bf3b3c06637ebcf0486962f578e8999be2ffd645dada7386c8777f32d3c5808d0b8eb848f547d2e65f6acf36ecb

Download Submit
C:\Users\Admin\AppData\Local\UnHackMe\rr2log.txt

Filesize
1KB

MD5
57708a021d025ce5785955c56a41bc9f

SHA1
3d704e03ce9d9b4d6f95345edca5602954f59ac8

SHA256
bed8553692e6a8fa6051b07f7ac4b885d8dc497832d61038aea0cbcb706895b8

SHA512
65edd9ed52c00205560a720cf1b7ecb4aa8faba866af380c9a8c29b6344da22a325652fa8cc6ff6f9fc593e459ae6d891b2493d4d70d17e2268366994b013ff5

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\dbs.ini

Filesize
628B

MD5
31f8d71717ee3727538f23db6e88c2a9

SHA1
8b4b444d1239d3d9198f1dd0a2bc38a91d492d31

SHA256
d3eb72a8487b19957ada80e98d8437c0ae31818e10e86892ceb1221938b0ce09

SHA512
a679a5f1c0e0c0dc56d1dbf5b20a04f396d7193f11b693a9419d4ee50461bfcd83103ea0f567fed64d9c8940d86716353b401379635da37764b8c764ad31ce97

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\dbs.zip

Filesize
2.5MB

MD5
7e88c29fcb14863d97f77239deeee63a

SHA1
81d30aa9a9f690840052235722877589ea2fd230

SHA256
d6644b13cd6fc2fb283beb48cf10aef2159aa5a91a6b49c66676c2753999e497

SHA512
e8bbe35f4826d2dba0c88db978174a424ab642ed01260d96bd55cd74d761135bfd90a4a4dbb772aac1301a3514b14b91d9701935f090c5d1281b333604489e6e

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\dbsnew.db

Filesize
5.6MB

MD5
37c6ac02cf8b64cbe2a4758abfad411d

SHA1
d2d3b00e895401f230ef2f6c06015780df887418

SHA256
e595ddcbc7c2e5fd7ec5b713052e424d6e5ac66c8fe6bece405eda046a00e895

SHA512
7666f155a6f04e01fa92ec4012115ba6adf0e72e310e6999da2f0e8c4972ca2bdc593789aaf3029fd67293b62044a0a58620aa719c512e1cb79322f717799553

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\unhackme.log

Filesize
1KB

MD5
c2eb476e62a1435137953967f6d9268c

SHA1
2475968159269c6585075f508ea0793734f963d1

SHA256
f5b06ba7db93782254a7ca2ce23c58948a048682bcb85a3294c39b19deead0aa

SHA512
e06f56fdc5fc12a863396c25879e035f560982ee16608f6579f5f787b206c996b9991f207863094732f677b2b379484cf55fc111ec18fcb6cff22d11b2057bc4

Download Submit
C:\Users\Admin\Downloads\UnhackMe Pro 16_40\UnhackMe Pro 16_40\unhackme.log

Filesize
2KB

MD5
82ba030c6071470b180d49ef272c6ad3

SHA1
b4985fce0fe1ce206f86f18a0f05f74eebba4df3

SHA256
5419574e5d152bdabab8a5ce92a4a6a9ba21ad30ed1a80506d2f1322be49e74d

SHA512
0753b8ad1eddcee691af33891f05a3ad41d3d51a34e998dc3dca94339d946cb2cda1aa5155143e08c635696e43ea87c3fed9cfaed87b920b5038c80a4d4f8afa

Download Submit
memory/1452-50-0x0000000002E10000-0x0000000002E3D000-memory.dmp

Filesize
180KB

Download
memory/1452-87-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1452-85-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/1452-83-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1452-82-0x0000000002E10000-0x0000000002E3D000-memory.dmp

Filesize
180KB

Download
memory/1452-81-0x0000000002E50000-0x0000000002F50000-memory.dmp

Filesize
1024KB

Download
memory/1452-80-0x0000000000400000-0x0000000002B9B000-memory.dmp

Filesize
39.6MB

Download
memory/1452-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1452-49-0x0000000002E50000-0x0000000002F50000-memory.dmp

Filesize
1024KB

Download
memory/4268-12-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-29-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-42-0x0000000073B90000-0x0000000074341000-memory.dmp

Filesize
7.7MB

Download
memory/4268-41-0x0000000073B9E000-0x0000000073B9F000-memory.dmp

Filesize
4KB

Download
memory/4268-16-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-33-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-36-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-17-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-44-0x0000000073B90000-0x0000000074341000-memory.dmp

Filesize
7.7MB

Download
memory/4268-19-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-21-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-7-0x0000000073B9E000-0x0000000073B9F000-memory.dmp

Filesize
4KB

Download
memory/4268-11-0x0000000002760000-0x0000000002778000-memory.dmp

Filesize
96KB

Download
memory/4268-13-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-23-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-8-0x00000000024E0000-0x00000000024FA000-memory.dmp

Filesize
104KB

Download
memory/4268-25-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-9-0x0000000073B90000-0x0000000074341000-memory.dmp

Filesize
7.7MB

Download
memory/4268-27-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-10-0x0000000004BD0000-0x0000000005176000-memory.dmp

Filesize
5.6MB

Download
memory/4268-31-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-38-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4268-40-0x0000000073B90000-0x0000000074341000-memory.dmp

Filesize
7.7MB

Download
memory/4268-39-0x0000000002760000-0x0000000002773000-memory.dmp

Filesize
76KB

Download
memory/4688-471-0x00000000051E0000-0x000000000521D000-memory.dmp

Filesize
244KB

Download
memory/4688-470-0x0000000000400000-0x0000000001358000-memory.dmp

Filesize
15.3MB

Download
memory/4836-430-0x0000000000400000-0x0000000000E53000-memory.dmp

Filesize
10.3MB

Download
memory/4836-507-0x0000000000400000-0x0000000000E53000-memory.dmp

Filesize
10.3MB

Download
memory/4836-465-0x0000000000400000-0x0000000000E53000-memory.dmp

Filesize
10.3MB

Download
memory/5040-528-0x0000000000400000-0x000000000088F000-memory.dmp

Filesize
4.6MB

Download