Malware Analysis Report

2024-12-07 18:57

Sample ID 241120-x9lhxs1fle
Target CrystalSiegeDemo.exe
SHA256 832b4637b4dff74b76d3b5c85c5f45aaf8fa057431ca6710a787ac8f9d87d43c
Tags
hexon credential_access discovery spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

832b4637b4dff74b76d3b5c85c5f45aaf8fa057431ca6710a787ac8f9d87d43c

Threat Level: Known bad

The file CrystalSiegeDemo.exe was found to be: Known bad.

Malicious Activity Summary

hexon credential_access discovery spyware stealer

Hexon family

Hexon stealer

Uses browser remote debugging

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Checks computer location settings

Checks installed software on the system

Enumerates processes with tasklist

Drops file in Windows directory

Browser Information Discovery

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies registry class

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-20 19:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-20 19:33

Reported

2024-11-20 19:47

Platform

win10ltsc2021-20241023-en

Max time kernel

601s

Max time network

601s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe"

Signatures

Hexon family

hexon

Hexon stealer

stealer hexon

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-584106483-899802418-1877852863-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\hexon_6f6b13d197b67725.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-584106483-899802418-1877852863-1000\{76C2F27B-7F1A-4C22-91DF-A8942021914D} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4020 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 1844 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 1844 wrote to memory of 460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1844 wrote to memory of 460 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 1680 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 4020 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 720 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 720 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 720 wrote to memory of 4768 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4020 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3596 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 3596 wrote to memory of 3216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4020 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4408 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4408 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4020 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4020 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 1724 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1724 wrote to memory of 2468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4020 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4020 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 2292 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 2292 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 1772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 1772 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 2368 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 2368 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 3444 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 3444 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 776 wrote to memory of 4300 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2080 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ffe2c6ecc40,0x7ffe2c6ecc4c,0x7ffe2c6ecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1980,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1944 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1564,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1992 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2092,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1752 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2908 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2912,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2920 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4080,i,14118086285317106063,618134807003543857,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4028 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe292b46f8,0x7ffe292b4708,0x7ffe292b4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2124 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2320 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2796 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2100,11502254081216936800,2093628133502674373,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs""

C:\Windows\system32\wscript.exe

wscript "C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""

C:\Windows\system32\cscript.exe

cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"

C:\Users\Admin\AppData\Local\Temp\hexon_6f6b13d197b67725.exe

"C:\Users\Admin\AppData\Local\Temp\hexon_6f6b13d197b67725.exe" gayarwez discord

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"

C:\Windows\System32\reg.exe

C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png" "

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA5E.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC437D8228CF08422588F537E66BE7A9D5.TMP"

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png"

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1908,i,67054989044691770,2461890687055012515,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png" "

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png"

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 hexon.fun udp
US 172.67.169.156:443 hexon.fun tcp
US 8.8.8.8:53 156.169.67.172.in-addr.arpa udp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 10.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 8.8.8.8:53 store1.gofile.io udp
FR 45.112.123.227:443 store1.gofile.io tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 8.8.8.8:53 227.123.112.45.in-addr.arpa udp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 hexon.fun udp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp

Files

C:\Users\Admin\AppData\Local\Temp\726e1fab-f593-4e67-968d-8f9cb63e1769.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\ca8a16be-7779-4b42-8569-07891bf073a9.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

MD5 54f74ae5130a6d81643b2dd622b4db74
SHA1 4875ec963d09b7e4753120da1a9be811c0fbc8ff
SHA256 6ab41e85b3eb6d4aca83bfa0578cf9c296d33bccef9e800fa74cf5e5ccb95dfd
SHA512 684e935e22f11ce0d0a6961e589f30f1ef1b06b493e07f26ce9fb8f827f1c5183b3484aa239a59da00b46aba75e858c5b4d39223ed41c94940982606a821c92e

\??\pipe\crashpad_776_MIGGSWKATWOVMUCY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c29339188732b78d10f11d3fb23063cb
SHA1 2db38f26fbc92417888251d9e31be37c9380136f
SHA256 0a61fa9e17b9ae7812cdeda5e890b22b14e53fa14a90db334f721252a9c874c2
SHA512 77f1f5f78e73f4fc01151e7e2a553dc4ed9bf35dd3a9565501f698be373640f153c6d7fc83450b9d2f29aeaa72387dd627d56f287a46635c2da07c60bc3d6e2c

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 ccff51f965f8f4176e4ad112c34c86a7
SHA1 eab249ca0f58ed7a8afbca30bdae123136463cd8
SHA256 3eb00cf1bd645d308d0385a95a30737679be58dcc5433bc66216aac762d9da33
SHA512 8c68f146152045c2a78c9e52198b8180b261edf61a8c28364728eafb1cba1df0fa29906e5ede69b3c1e0b67cfcbeb7fde65b8d2edbc397c9a4b99ecfe8dea2dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 86aa28ffd286b08415aa197216684874
SHA1 d99924976c73e3220108817ad6bc1d8b1795ca2d
SHA256 a6dc4bc6ade3039e57b538f2620b91602199f1908b23c4a2beb3fd3aa721579d
SHA512 a51fbd1af778d32f2f95a9a863a59f42a7eb804dbb8ce85459297959eea21fbfe9625d74c3f91ad65016031d4b3e26eeb748c1c59e09ac68778fc670d408d0fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 b8e92e92e62472a6af771e724b641b63
SHA1 7267ae2a65440545a4d9a0bd2d0baa611c805c43
SHA256 292ea00db2cede1e7e3cfd3a53275bfed567e444ac1aa25b128b46de7a010ce9
SHA512 d90263f447de5ba775c93792ccf2eeb30cdf2202f59a62b4a679a82eafeeca930c7146537a92781a346ed22ba42eba6601057098769ba08f34c7574d1fbbe4fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Temp\ba7d47908c39830f.vbs

MD5 535dde9f3f6c105eac64540edf455ba6
SHA1 b116d7008477a4a1131963ee31f692e0b94f336e
SHA256 38e0d29ff9484ae7c7864787ca3b2da31a2c1e23aa3b35fef32863f91d000602
SHA512 4be2ff040eefb5232f5b37e7b7f42bf09c1f92f6aafc8216d51a4675a3e5c4fba5d29beef13a7ee1f8bdcbfba9d794e78ca4ca569a68009b910943c6d347bdf7

C:\Users\Admin\AppData\Local\Temp\open.vbs

MD5 bfeda00dd9e9d4984b836f42afe87aed
SHA1 e62d79211de446ae828e79ef4d3e26609b569da8
SHA256 31b071baff46a6727c66f6c16e739f98a47c66f7133b72b951c232cf2fe41df5
SHA512 8c09764d4266ab09c61f9544c4e493968b0d39b52d1d596f9babb4ebbfa032aa121313625bf15739c8f4e305ff4691967a6e8eb352aee0bde3ec6f0ec9482111

C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC437D8228CF08422588F537E66BE7A9D5.TMP

MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

C:\Users\Admin\AppData\Local\Temp\RESFA5E.tmp

MD5 62d1d4739700b5f592c4015aa29bc2e1
SHA1 7e5fbed849d617be1c5afd9cdde4da79b2134ff1
SHA256 d6036a07b1c3757cea9cb79818e9d56bb71386e22c742248ab9329d4ba0963eb
SHA512 b969c19c02903a5679de1b9695e5894aeb8c26685468cd5d668065b14352dc8ad75fabb6b457758451e832d2569e2643786da5a4edf4320f058cdd7683c729c8

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

MD5 cc16fb8aca4b5bc856bc91616aa98eec
SHA1 dcc1502fa6aee3c9799d5529f373ddff7cf94a55
SHA256 ac2a0a398ee1407aa5213a4560d4b5c447993faacfa3a5ff9a21f020726c9aad
SHA512 359baeb6c1ac55f5ec0e68ff727166326ad80106062ed01d5aed5036080b8f35b446c9b6fca27fef8dd9e606dc5487442e8c8e597f6afc9860bab79a87ce3fc3

memory/4352-280-0x0000000000980000-0x000000000098A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20241020-4572-jyfm7o.mvdnk.png

MD5 378167ff16bdcb4987922b2784966a09
SHA1 92f86b6b8de11c372a5f1e98643a1a25ae2270f1
SHA256 5ce7fc6c0b37746e41911f6f4e9546f5a9d8604fd9a8f727c3e73b6f72a5f9dc
SHA512 fb53cfcb019587e9195e09b45e4508f3ed4536a5aa3a69056b9a680b461ccda62732ce3f0530370f5c2bcb497b0a69a87ca922fb8ae0e7880f6ef5b24a402444

memory/1544-288-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-287-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-286-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-293-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-294-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-298-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-297-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-296-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-295-0x00000255B7360000-0x00000255B7361000-memory.dmp

memory/1544-292-0x00000255B7360000-0x00000255B7361000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\screenCapture_1.3.2.exe.log

MD5 367da10772c194b1cd8c945c3f47b33b
SHA1 6c35d9731e6360bc94b18eed136880bed4e6c5e2
SHA256 8f2bdac06e17b49fa3947017fcb1d13851d8e4fa9fb31c809d2325741586021b
SHA512 b1c7cca7668451aa4d558dc6c9b7d8e265211b53fd4f2b497286e600ba2e87852d332d6a581bbb2cc4ad08312459809ce7533f38d4ce10fa0efb816f154d99e9

C:\Users\Admin\AppData\Local\Temp\20241020-4572-7kzbaj.qhg6h.png

MD5 c7a6e2ac6510ebf722660908f9214e7e
SHA1 43a098ba5f2a23801077c10e87503e3c87532d33
SHA256 42abdf8aa3bbabf560f94261adb3f2dae1d076b44007c3c20fc31681a0406dc4
SHA512 602bb28c42db0f9c92db2eee49e272e4abba7ae21a4fbd816952e92577bfb2238a73ea2333c11088cc259a940414fff37601e04b89109d87e10dca1ecb39d791

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-20 19:33

Reported

2024-11-20 19:50

Platform

win11-20241007-en

Max time kernel

601s

Max time network

586s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe"

Signatures

Hexon family

hexon

Hexon stealer

stealer hexon

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Reads user/profile data of web browsers

spyware stealer

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3870231897-2573482396-1083937135-1000\{280C3CC2-55E2-4D64-8DCB-937BCEF1042E} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2932 wrote to memory of 5360 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 5360 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 5360 wrote to memory of 5908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5360 wrote to memory of 5908 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 5632 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 5632 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe
PID 2932 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 4028 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4028 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4028 wrote to memory of 2380 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2932 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 4796 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4796 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4796 wrote to memory of 2216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 2932 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 1520 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 1520 wrote to memory of 1560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1520 wrote to memory of 1560 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2932 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2932 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4068 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4068 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2932 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 2932 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 4276 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 4276 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 988 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 1328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 1328 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 4804 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 4804 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 1544 wrote to memory of 2936 N/A C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1828,i,14174224797291090694,2950330569913280093,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2000 --field-trial-handle=1828,i,14174224797291090694,2950330569913280093,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb246ccc40,0x7ffb246ccc4c,0x7ffb246ccc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1944,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1796,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1752 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2020,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2220 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2868,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2880 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2884,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2900 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3992,i,4925537920658189347,11945146540947912663,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3956 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb213b3cb8,0x7ffb213b3cc8,0x7ffb213b3cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --no-sandbox --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1860 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2032 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2348 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1844,4839515729875910611,1879031351620292009,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4488 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\dc5e9e191a4523e7.vbs""

C:\Windows\system32\wscript.exe

wscript "C:\Users\Admin\AppData\Local\Temp\dc5e9e191a4523e7.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""

C:\Windows\system32\cscript.exe

cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"

C:\Users\Admin\AppData\Local\Temp\hexon_d5227351395ba785.exe

"C:\Users\Admin\AppData\Local\Temp\hexon_d5227351395ba785.exe" gayarwez discord

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"

C:\Windows\System32\reg.exe

C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-2260-a2xwx7.2ru55.png" "

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1930.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC20768888A52F4E01B1C45DEDAF4E7593.TMP"

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-2260-a2xwx7.2ru55.png"

C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1828,i,14174224797291090694,2950330569913280093,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hexon.fun udp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:443 dns.google tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
FR 45.112.123.126:443 api.gofile.io tcp
FR 45.112.123.227:443 store1.gofile.io tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp

Files

C:\Users\Admin\AppData\Local\Temp\784afb98-e23a-4b22-b99c-ded2c6043a36.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\a1b4d9b4-a50f-4f1d-9d85-66edeb5dcd96.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

\??\pipe\crashpad_1544_VANFNNJYNASRGLYF

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 c03d23a8155753f5a936bd7195e475bc
SHA1 cdf47f410a3ec000e84be83a3216b54331679d63
SHA256 6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca
SHA512 6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 3d68c7edc2a288ee58e6629398bb9f7c
SHA1 6c1909dea9321c55cae38b8f16bd9d67822e2e51
SHA256 dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b
SHA512 0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1a9974594b628b7ecefd77b45062f35a
SHA1 4f07d80574872c5a76de8ef45e368656b7fc6da4
SHA256 dd7fb7d5db8ee937380e29325c88efc06a78c9454ccd56324a5a7d5f7a16635b
SHA512 100d610a33ca6915b194f163e0f4b8397070480f8ac658e771b9d8ae30945166421d83e929ed1cd5e67ddba84b4f90cc0f5ef6b8c4903d9a4fdf43c0f1b76c10

C:\Users\Admin\AppData\Local\Temp\passwords_0.db

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\dc5e9e191a4523e7.vbs

MD5 728733013de86d0f283e8e692c014b23
SHA1 7dda99d8c319ae7503168c015f3002bcf39bf138
SHA256 46f1eb4d544ef526270a43af588279ff80df31b71a4d887bcd181ae8022c536e
SHA512 6cf3c70c74277637bf7e77726e9bb6fcc7768db5b5f8d0affcbfdcbd040a9febc4ab44be75cfe081c4f7dc571ff310de4091cc2c4ea5e34041552e24a9df7d89

C:\Users\Admin\AppData\Local\Temp\open.vbs

MD5 9c06a67b84c41dc3eb24a723faf1bcb0
SHA1 f09931552d416fb00447fc6bdb9fe68777280bd8
SHA256 01af54dc309f701a9b4b9565db044d9feeff9b565e8e4c983b7851f5f232301d
SHA512 5203745911a63d5dd50e8db58fe11e5f26ace4d4394e0cd28ba501fe19dd128af1a56f56a4dcc03a71ba21ef933248e8dc7466a34d8723a6d875e1db20847c95

C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC20768888A52F4E01B1C45DEDAF4E7593.TMP

MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

C:\Users\Admin\AppData\Local\Temp\RES1930.tmp

MD5 8dbb631a5a88cfb301604cf18626f817
SHA1 dc7f2123dbb6d5b565602631981e4e45549e5913
SHA256 5f51751ba42349b906764906442915df85c9cea6e6650a3f67e6de61bedef55c
SHA512 0126d1a149c0a18c4616c597f9840a439a71f0e02786b24f276590bd00f8a387991900361b7143888fbb8043dcc984c0ac91aefa0e168879aa033cd9cbaeab08

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

MD5 c4c861886d1da20afd1faeff492b2ead
SHA1 ea24395813b5cebf46bdf2e3374bb9c12f8f838d
SHA256 28c54cc36845e4208e86e045a9cce8292d3682eeb417043723f93491662a1ac5
SHA512 3ae16b205dec63dde0194d618e1ea0117cb130c783eb916cfe68f849e7cc09e9e216f2e0eeda256e9f9c1b6db8b0d674cbc18417a3b9eb226351c4788f91d501

memory/2508-186-0x0000000000240000-0x000000000024A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20241020-2260-a2xwx7.2ru55.png

MD5 568a2dbbfd8c7ab8f6111d0b29e8e05e
SHA1 0d9a7a7a33d8fcb97d6f7f9a9c867013a82a0cf2
SHA256 88a30c25ae23875f86d553ad36f2fab8559109804bf205d9afcdc480ae6c2c12
SHA512 6fcb9fe44ebcef7f7326892e2cc0e89d637487c709e800232108780b0202c259c020cbeb6de122ecfe2d7e1067b0318622108c154e8a8393560c86471ca4e7b0

memory/2024-192-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-193-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-194-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-198-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-200-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-204-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-203-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-202-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-201-0x0000020E81990000-0x0000020E81991000-memory.dmp

memory/2024-199-0x0000020E81990000-0x0000020E81991000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-20 19:33

Reported

2024-11-20 19:45

Platform

win10ltsc2021-20241023-en

Max time kernel

600s

Max time network

604s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe"

Signatures

Hexon family

hexon

Hexon stealer

stealer hexon

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-87863914-780023816-688321450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\hexon_7fadfc7b9d3fb383.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_7fadfc7b9d3fb383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_7fadfc7b9d3fb383.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-87863914-780023816-688321450-1000\{00898157-E795-4A27-882A-ED2DEC0A2571} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4368 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 4368 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 4472 wrote to memory of 3380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4472 wrote to memory of 3380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4472 wrote to memory of 3380 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4472 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4472 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4472 wrote to memory of 4320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 4680 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 1112 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 1112 wrote to memory of 4420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 1112 wrote to memory of 4420 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 4680 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 3724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4312 wrote to memory of 3724 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4680 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4384 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4384 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4680 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 3092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4580 wrote to memory of 3092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4680 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4680 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 876 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 876 wrote to memory of 2732 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4680 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 4680 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq CrystalSiege.exe" | %SYSTEMROOT%\System32\find.exe "CrystalSiege.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq CrystalSiege.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "CrystalSiege.exe"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 --field-trial-handle=1940,i,7367239564584852548,13001924374905362024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2120 --field-trial-handle=1940,i,7367239564584852548,13001924374905362024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffe940ecc40,0x7ffe940ecc4c,0x7ffe940ecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1972,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1960 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1860,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1784 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2120,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2284 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2892,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2908 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2912,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2924 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3968,i,12320195612664302190,3793257118257300707,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3884 /prefetch:1

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 --field-trial-handle=2080,i,5416385635646187016,6977390459169713282,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2312 --field-trial-handle=2080,i,5416385635646187016,6977390459169713282,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe940ecc40,0x7ffe940ecc4c,0x7ffe940ecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2000,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1992 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1328,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2004 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2092,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2288 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2936 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2896,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2940 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,3401355399093589979,18079116868161363494,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3112 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 --field-trial-handle=2296,i,11313255605254107448,7615650853449937075,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2448 --field-trial-handle=2296,i,11313255605254107448,7615650853449937075,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im chrome.exe"

C:\Windows\system32\taskkill.exe

taskkill /f /im chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe940ecc40,0x7ffe940ecc4c,0x7ffe940ecc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2012,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2008 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1908,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2016 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2072,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2292 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2896,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2916 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2920,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2944 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4004,i,6937996987486512601,15849429615408086672,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe978f46f8,0x7ffe978f4708,0x7ffe978f4718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --no-sandbox --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2120 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2180 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2564 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=2040,17062874228678839060,38404684715121993,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\90c28a5dc2675540.vbs""

C:\Windows\system32\wscript.exe

wscript "C:\Users\Admin\AppData\Local\Temp\90c28a5dc2675540.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""

C:\Windows\system32\cscript.exe

cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"

C:\Users\Admin\AppData\Local\Temp\hexon_7fadfc7b9d3fb383.exe

"C:\Users\Admin\AppData\Local\Temp\hexon_7fadfc7b9d3fb383.exe" gayarwez discord

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"

C:\Windows\System32\reg.exe

C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-820-12tg0iw.v9o7.png" "

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9FC5.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCEF2A3C49834DBA87E0245CE2D2F86C.TMP"

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-820-12tg0iw.v9o7.png"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1940,i,7367239564584852548,13001924374905362024,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=2080,i,5416385635646187016,6977390459169713282,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 --field-trial-handle=2296,i,11313255605254107448,7615650853449937075,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 checkappexec.microsoft.com udp
GB 51.140.242.104:443 checkappexec.microsoft.com tcp
US 8.8.8.8:53 104.242.140.51.in-addr.arpa udp
US 8.8.8.8:53 203.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 hexon.fun udp
US 104.21.27.182:443 hexon.fun tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 182.27.21.104.in-addr.arpa udp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 8.8.8.8:53 www.google.com udp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 35.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 228.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 10.213.58.216.in-addr.arpa udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
GB 172.217.16.228:443 www.google.com udp
US 104.21.27.182:443 hexon.fun tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:443 dns.google tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 nav.smartscreen.microsoft.com udp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
GB 13.87.96.169:443 nav.smartscreen.microsoft.com tcp
US 8.8.8.8:53 data-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
GB 172.165.61.93:443 data-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 169.96.87.13.in-addr.arpa udp
US 8.8.8.8:53 93.61.165.172.in-addr.arpa udp
US 8.8.8.8:53 api.gofile.io udp
FR 45.112.123.126:443 api.gofile.io tcp
US 104.21.27.182:443 hexon.fun tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 8.8.8.8:53 126.123.112.45.in-addr.arpa udp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 104.21.27.182:443 hexon.fun tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\ffmpeg.dll

MD5 a007299c49fa50aeff594655859780ae
SHA1 d202f1f617023763a0e9418878e8ecac96be9fd4
SHA256 b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
SHA512 444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\libEGL.dll

MD5 ca5bb0794b7700601e9438283d458665
SHA1 7fcf090b19820b9450937be800575c526448b581
SHA256 4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
SHA512 36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\libGLESv2.dll

MD5 05b585464f18fe0e3bddb20527697d66
SHA1 8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA256 0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512 f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\LICENSES.chromium.html

MD5 8303b3a19888f41062a614cd95b2e2d2
SHA1 a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256 9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512 281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\snapshot_blob.bin

MD5 4ebd06bdf6cf8dacf6597586fd1704b5
SHA1 e6819ef37f99f91468f4b94370a4ab467a075a6d
SHA256 148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b
SHA512 17ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\v8_context_snapshot.bin

MD5 146e284750735ef4798527dc1cd0e741
SHA1 6408985b7d05c768a62bcb912234f14e1898ffdb
SHA256 3820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80
SHA512 46824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\resources.pak

MD5 31c7d4b11ad95dfe539dd098e0fab736
SHA1 5418682d939ce8485ecc9125b872c14ffec662c2
SHA256 a251019eb08f1e695e935d224544bda37c5ae092ba68a89fa1fe3bd19bde4f5c
SHA512 f868a4afa4e0d5c561873d2a728e267f98da2df3fb90966e5736d496b6a24e71769a02b0346b27b7dcce11cbe07248e309f50a89977dc8e5bbc06d6cc31bf738

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\vk_swiftshader.dll

MD5 750cbdfb01943e28e08708183ec208b5
SHA1 1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256 a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512 dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\vulkan-1.dll

MD5 6c70aab071c4febc5921e0d39811937a
SHA1 20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256 2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512 7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\resources\app.asar

MD5 e712ea245bd5be34527270b24957ad12
SHA1 85368b0a429a2f25ffda594e61411f622d44ea47
SHA256 d5d227d97c883370aeb9c3caf34f5ba274d40c69f108ee214197ef89b4faba9a
SHA512 ba31bae58527bc3f2f1983957d1bbafa4aa9211b537fe8a6b4791d051e6da36867c9e12bae75b05aea037922f961a6c10718b1ff4c173439fb36f88f2c3a2dd2

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nssE57F.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\ef771c80-b2ea-4b36-9433-4bfd643c1c08.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\c5d5da7c-3c9f-46e4-b845-3b58604c8bda.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

\??\pipe\crashpad_1660_APKWESIEHWYWKVMI

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version

MD5 ef48733031b712ca7027624fff3ab208
SHA1 da4f3812e6afc4b90d2185f4709dfbb6b47714fa
SHA256 c9ce8dbbe51a4131073db3d6ceef1e11eaca6308ad88a86125f221102d2cee99
SHA512 ce3a5a429e3796977a8019f47806b8c0671b597ead642fcbfbe3144e2b8112d35a9f2250896b7f215d237d0d19c5966caf3fe674165a6d50e14cb2b88c892029

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations

MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 0234a81d26910d3ef4936a7a52955221
SHA1 cddc803af646e61447892b9a52fbe6cdd57ff702
SHA256 8e11617289ba6cddf6006f08ae9a64349c1bff2e36b22ba604f9dcddecb40946
SHA512 0c5d15e2a27dbf04d14af7266c98dd67176a5a7017335158badfa126a386708c01df00bc9882d2442aa1132ec23df52677da20adec301b76cddd8de495914a09

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3

MD5 487216716176064d283f587f1d85f179
SHA1 bd5d9688b1d40bc5b413eb0dcf9836b1416b913c
SHA256 0443a531a7297e15e3295908194871418cfd335df3ffc40a58789d46aa9cd5f2
SHA512 936ba4700306b7bbba7f9162a2f430d6ed1e862cf640591e1e5300ee82af23c71e34deebdcd71649eea4cf51ffbef93efafa6651a412a1db57c5336d1e035d1b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG

MD5 6f439d9b4712131eaed35691e18249aa
SHA1 ba74c1d68031b6ac295bb4fc3a04ea058a0bc2b4
SHA256 e817bbd724cb78fc36d8ed39ec569ab5f6ee569709d78c673c1357c51c1fae5f
SHA512 377ba7ec3dfd1c6279bc314170ba3aa2ea312819041e7dae26b48521b06a3dc41fb472baea5f5a397c084b3c2030d05907fd6748a431a56fb76380a6f5851b47

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1

MD5 27955b4d5a90521c60c1c4b2f5d51c2f
SHA1 8d116ed56f588d31fd5b53092d866b9f90c58df8
SHA256 db1037a0757a18aad36ee1071e18094f64f130e67099e8d4fc4a6d50810d7984
SHA512 58733c65e0e9fbd78c5b009d201f12338fe11fc46bef5cd8c38bc46c2bc74eeed51e5d3d08d37c61cdd26d1c7571131dffe0fb9b86d2a9d1235ad36247c7e06d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0

MD5 f971faddb979bb2be44c46d1d42fdc30
SHA1 b8f69516c9465dd29ff0d7b8892dbadb2b1ed738
SHA256 6ecf3fe1eedf4f47de6140a263b0c7a573e64767ce4a46c7e628ed437bcff286
SHA512 9317d863a0fcd9d44270231450207655c076e5c1a7c59204d9bd4e7aa8971a12dbe3a32eeb330e5069d17171cf0325077677bf2daaf607af4d469f004d3121d5

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG

MD5 80831125751b118a0f78ed36484de83c
SHA1 cefe0f41d2bedf87d819c99155ce077efc2e9d1d
SHA256 5e55bbf2234f697d5c667fe77b23823b60ea3b2530a1e1c062f23377f270ca8f
SHA512 9a559714a4246ef6c56a2689265b95b62d9c56229e2b988e41bb563fe96358e92e3553de1888fd458eb8d52c3ac5e19cd25136e0454804cc88f8bafbfb13f40a

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG

MD5 0f85bfd4286e02a0f2c7b0fa2ab9ba3e
SHA1 b92599a1ae806415db1373a4a6bd5e5e36bd50e9
SHA256 8d03a233d14c61a7a8186252a9b25772c954099feb3556a6993f6cf50fd22933
SHA512 868463966ebd1288fafce62c98a2cb250c8bc1f8f4ae5923758e37f19e15d772b920839cd7ceafdac0c708d300b411758c7ad21820c00ce6d894b878c3dceb4b

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG

MD5 7509a94bbd6c27dd07320672f21e1a2e
SHA1 368e8c9542b99757880823f60fbd308b1ec0b881
SHA256 a301063d00ee307bcfcbacdb3c436347e000ca069dc168d72e94247c1649de4d
SHA512 4fc36c28f5c46033ebaff0f106e8e59e3f7578432e58fdccec3bb9169b41e215d8d2fc606590da8e6ad4ac5ba3dc9a61d008eee65eaed538b928df0f7792be29

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG

MD5 ac3a9ce4915937c9cd29fc4af46bb255
SHA1 e1ea73624978e8e97546d093a0b3dbd82ff7d48e
SHA256 a0465bf4993a8ba76948c3a3c83977e66432b19fd99d84a6381ec1474f81d7ce
SHA512 bbcbe94fd3701ece95b79f16d05d3e5dd2c6fed4ef0f9adc96d4b21069b830b337f3ff2b81de219b4b2b37072b4dc67e0495a83860e3ac5f8378d0fbd850480d

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

MD5 4e7982b86b3d7d916b7722aa3b3f0669
SHA1 ce4e874903cb71d9012cc7654ca7a6ba5e4f7efd
SHA256 cbee1100a2c9add47776b7e416b58a809f6feb9fe458bef8185b0c176b5db340
SHA512 c4dda8b36e90a327061dab901730f47fc23cca129b02a157f1ed0c566a1d6dddf272a4e74d3acbf14eb3a7fac0820387a584db9e19ca299724ed7f3030f891bb

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

MD5 2aaed06e46a8db68699a48c479ee7c4b
SHA1 23cb13ea850659ab827e74f7411a1e040c8d9a1c
SHA256 cdcbada420d86156f0421c2f89e27f7c74c34f47d116b7564c5a0f1a9d6fe9ac
SHA512 3db951ac4f12d40168dde9c32ba3e11491a97351f25d89e3946358ee92fbc5ec3f18ed13e9a736902c3a3defafdf17821cf1ef31726b8a317b0df6036ec06422

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

MD5 571462f3490957f7cbca09cf2fcc8402
SHA1 8652661ac0ae03a6dc30f12f632ba612c3916380
SHA256 872a97b9d36e0b7ba13addd6d811512a28e10c952559bbb5fc2aa906390d7a49
SHA512 0a39f025b7a89d6075aeb79913a49e6ff82a9397c9e0d0cfc842e35ac964b30a0166e8f9735e8bc49ed34aa9f96de39cd70cd430dd3775ca1421f7a92d3e6ca6

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal

MD5 f00ee59c1ab78309d8b78734d0752776
SHA1 e44de755fc07416ffaaf93f641667977b0a89760
SHA256 1457769dafccef71a9ee76ac3f5450f0ba3e0f9c288b56ea5b7498803d8aa2fd
SHA512 0411143fe6971f112319eb2dddc7366118364dc9505d4b9c3544b68dd2dc4cca1e0d6eff9da992040492dff11c54b0342453475d034dc67ada0b982b4b3c3fd3

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG

MD5 017bade3acf17967bb5b5beacc816189
SHA1 2d9825fe052012c2bc578767e4633aa5d70ad334
SHA256 d8dfbb7d9e9b1f57056f5aae98ce276c194ef6e4fdc56bd93c0caf329f9f2774
SHA512 e5f709585b692ca94dbfff445fd7884ee583e253a0068fe5189418431290f8e43220f1e70569b4aaa8e23437743fcb8c7b54b822caa6781cdbc1c8e9fd3bb4ae

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG

MD5 adf3925654f47ebdd583c76cf8be4fec
SHA1 af42a3a4ef7e659cf221c162689f907d7f52815d
SHA256 1a759c920df62da1812ca3d1dfc1483ac7310217c8af4c282189acd2240b3037
SHA512 45ad83b57ecafadef13d1bb7021e8593fc4be86a6dbb876b848126cbc3663a89eb2a58e69294d7256edca10494bd0fd654c497490d9155254308e0b03d4ac832

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG

MD5 cd038c032e21d1f3f488bc6cbb1ed676
SHA1 4b91285dc95f96e252a1e15db568482f9c33c832
SHA256 41a65a64a642b4e0588a41c13a7ce300d7c296a0df80feb5e2770f4c4f72867c
SHA512 80666124e9c792dc335e42fdc5db35fd28a4d6a0f8ddd794aee8064bbad43b48744c37ba3d900290f9bba11b63998c238997b2fa8640113bad496d8f765ecdc1

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3c5e904c-9507-4ef9-8b83-17a2a5247ed6.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Roaming\unrealgame\Local State

MD5 92eedc0b8941d86c3bf26a93dcfe70e5
SHA1 69de7e912ed2a97b4a4a3e586e3747c76e15bea3
SHA256 297dbc605fa75e31d33a0c5051702e49d336632cfabe330f6930391d6c49631d
SHA512 8dcfeae081b0c85c7d1962869a4034178667697ad12d6c0e79760ff8136b2984cbdd50323cd3c1a49d12a1ca50f287edb619ad94cc18e33e631921cbe34f3a83

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 f6126b3cef466f7479c4f176528a9348
SHA1 87855913d0bfe2c4559dd3acb243d05c6d7e4908
SHA256 588138bf57e937e1dec203a5073c3edb1e921c066779e893342e79e3d160e0b4
SHA512 ef622b26c8cee1f767def355b2d7bffb2b28e7a653c09b7e2d33f6468a453fff39fd120cacbffd79ce35722592af0f3fb7d5054e2dca06310e44dc460533f3d8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 6dda6e078b56bc17505e368f3e845302
SHA1 45fbd981fbbd4f961bf72f0ac76308fc18306cba
SHA256 591bf3493eb620a3851c0cd65bff79758a09c61e9a22ea113fa0480404a38b15
SHA512 9e460013fd043cee9bdbcdaf96ac2f7e21a08e88ddb754dddbd8378ee2288d50271e66b42092d84a12e726469465185be11a6fafab6ed4236a244524bd60f502

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

MD5 90cc75707c7f427e9bbc8e0553500b46
SHA1 9034bdd7e7259406811ec8b5b7ce77317b6a2b7e
SHA256 f5d76f8630779de1fe82f8802d6d144861e3487171e4b32e3f8fffd2a57725fb
SHA512 7ad692bce11aee08bf65bb7c578b89a4a3024211ee1deaf671c925d65cc016943f2caad3d57b365e16d1764c78c36cae35c3c45cef0928dd611a565b0313e511

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 701a1b8e543138806d5b2a97f999f25d
SHA1 b6c1f92527e9bf6ab3a719a334e4bc6fcc7be792
SHA256 d13987e294ccbfbb4e21bbb1e6deded574c649291db28984ab6a42bebdeaf705
SHA512 5b9a5b130698c6780081dadfe63aef708f5139845eea5fd56f261d7eec532772abfc09c9b9a7949c054604dca27243608120811ce23b6e89e62820bb027463e6

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/1304-950-0x0000000000D80000-0x0000000000D8A000-memory.dmp

memory/6100-957-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-967-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-966-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-964-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-963-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-962-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-965-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-961-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-956-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

memory/6100-955-0x000001DC0E2A0000-0x000001DC0E2A1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-20 19:33

Reported

2024-11-20 19:45

Platform

win11-20241007-en

Max time kernel

600s

Max time network

591s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe"

Signatures

Hexon family

hexon

Hexon stealer

stealer hexon

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_d6ab00e8b15e2cd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_d6ab00e8b15e2cd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_1469756558075877.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\hexon_1469756558075877.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A
File opened for modification C:\Windows\SystemTemp C:\Program Files\Google\Chrome\Application\chrome.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{6D9F2F51-2B34-45DA-8B2C-3637E12D5BF9} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-556537508-2730415644-482548075-1000\{3FBFE9F9-ACEB-44BD-9C24-8AC7BB981FE1} C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files\Google\Chrome\Application\chrome.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3884 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 3884 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 3884 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe C:\Windows\SysWOW64\cmd.exe
PID 700 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 700 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 700 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 700 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 700 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 700 wrote to memory of 2876 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 3612 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3612 wrote to memory of 5032 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 5032 wrote to memory of 240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 5032 wrote to memory of 240 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 1820 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe
PID 3612 wrote to memory of 128 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3612 wrote to memory of 128 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 128 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 128 wrote to memory of 4648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3612 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3612 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 4280 wrote to memory of 972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 4280 wrote to memory of 972 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\where.exe
PID 3612 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3612 wrote to memory of 2144 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2144 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2144 wrote to memory of 2580 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3612 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 3612 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2256 wrote to memory of 4856 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 3612 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe
PID 3612 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe C:\Program Files\Google\Chrome\Application\chrome.exe

Processes

C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe

"C:\Users\Admin\AppData\Local\Temp\CrystalSiegeDemo.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq CrystalSiege.exe" | %SYSTEMROOT%\System32\find.exe "CrystalSiege.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq CrystalSiege.exe"

C:\Windows\SysWOW64\find.exe

C:\Windows\System32\find.exe "CrystalSiege.exe"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1868,i,5946776622733871374,15389068420211401811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=2076 --field-trial-handle=1868,i,5946776622733871374,15389068420211401811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa0d77cc40,0x7ffa0d77cc4c,0x7ffa0d77cc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1732,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1728 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1820,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1936 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2012,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2220 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2888,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2908 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3088 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4000,i,16770435828790370638,13380972999109019299,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4032 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa20b63cb8,0x7ffa20b63cc8,0x7ffa20b63cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --no-sandbox --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1860 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2168 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2332 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4416 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1848,8569535710453041856,9163119492264766088,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\b8c7bc3f4719be77.vbs""

C:\Windows\system32\wscript.exe

wscript "C:\Users\Admin\AppData\Local\Temp\b8c7bc3f4719be77.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""

C:\Windows\system32\cscript.exe

cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"

C:\Users\Admin\AppData\Local\Temp\hexon_d6ab00e8b15e2cd2.exe

"C:\Users\Admin\AppData\Local\Temp\hexon_d6ab00e8b15e2cd2.exe" gayarwez discord

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"

C:\Windows\System32\reg.exe

C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-796-1hgzkcw.smdz.png" "

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22F4.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC48F36D8DBED44C3CAB8F1F2DA217F34.TMP"

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-796-1hgzkcw.smdz.png"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1872,i,1344318662001344379,8948303442285381751,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --mojo-platform-channel-handle=1924 --field-trial-handle=1872,i,1344318662001344379,8948303442285381751,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . cookies.sqlite"

C:\Windows\system32\where.exe

where /r . cookies.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f3acc40,0x7ffa0f3acc4c,0x7ffa0f3acc58

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1908,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1796,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1984 /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=2024,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2372 /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2884,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2900 /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2904,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3084 /prefetch:1

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3136,i,3384843096971914849,7520273464137899660,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3932 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --disable-gpu --no-sandbox --window-position=-32000,-32000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa0a813cb8,0x7ffa0a813cc8,0x7ffa0a813cd8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --no-sandbox --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1884 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=2028 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2492 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9223 --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,12808319944864567358,16084234074353117834,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=4824 /prefetch:8

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "where /r . *.sqlite"

C:\Windows\system32\where.exe

where /r . *.sqlite

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM EpicGamesLauncher.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM EpicGamesLauncher.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM javaw.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"

C:\Windows\system32\taskkill.exe

taskkill /IM Steam.exe /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "tasklist"

C:\Windows\system32\tasklist.exe

tasklist

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM chrome.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /T /IM msedge.exe"

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM msedge.exe

C:\Windows\system32\taskkill.exe

taskkill /F /T /IM chrome.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "wscript "C:\Users\Admin\AppData\Local\Temp\7b6c05982b0f6977.vbs""

C:\Windows\system32\wscript.exe

wscript "C:\Users\Admin\AppData\Local\Temp\7b6c05982b0f6977.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs""

C:\Windows\system32\cscript.exe

cscript //B "C:\Users\Admin\AppData\Local\Temp\open.vbs"

C:\Users\Admin\AppData\Local\Temp\hexon_1469756558075877.exe

"C:\Users\Admin\AppData\Local\Temp\hexon_1469756558075877.exe" gayarwez discord

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid"

C:\Windows\System32\reg.exe

C:\Windows\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" "C:\Users\Admin\AppData\Local\Temp\20241020-3404-66h3el.8fka5.png" "

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

screenCapture_1.3.2.exe "C:\Users\Admin\AppData\Local\Temp\20241020-3404-66h3el.8fka5.png"

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=956 --field-trial-handle=1868,i,5946776622733871374,15389068420211401811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe

"C:\Users\Admin\AppData\Local\Programs\unrealgame\CrystalSiege.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\unrealgame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1872,i,1344318662001344379,8948303442285381751,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 hexon.fun udp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 8.8.8.8:53 156.169.67.172.in-addr.arpa udp
GB 172.217.16.228:443 www.google.com tcp
GB 172.217.16.228:443 www.google.com udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
US 8.8.4.4:443 dns.google tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
FR 45.112.123.126:443 api.gofile.io tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
GB 172.217.16.228:443 www.google.com tcp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 dns.google udp
US 8.8.4.4:443 dns.google tcp
GB 172.217.16.228:443 www.google.com udp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 127.0.0.1:9223 tcp
N/A 224.0.0.251:5353 udp
FR 45.112.123.126:443 api.gofile.io tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp
US 172.67.169.156:443 hexon.fun tcp

Files

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\nsExec.dll

MD5 ec0504e6b8a11d5aad43b296beeb84b2
SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

C:\Users\Admin\AppData\Local\Programs\unrealgame\chrome_100_percent.pak

MD5 acd0fa0a90b43cd1c87a55a991b4fac3
SHA1 17b84e8d24da12501105b87452f86bfa5f9b1b3c
SHA256 ccbca246b9a93fa8d4f01a01345e7537511c590e4a8efd5777b1596d10923b4b
SHA512 3e4c4f31c6c7950d5b886f6a8768077331a8f880d70b905cf7f35f74be204c63200ff4a88fa236abccc72ec0fc102c14f50dd277a30f814f35adfe5a7ae3b774

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\chrome_200_percent.pak

MD5 4610337e3332b7e65b73a6ea738b47df
SHA1 8d824c9cf0a84ab902e8069a4de9bf6c1a9aaf3b
SHA256 c91abf556e55c29d1ea9f560bb17cc3489cb67a5d0c7a22b58485f5f2fbcf25c
SHA512 039b50284d28dcd447e0a486a099fa99914d29b543093cccda77bbefdd61f7b7f05bb84b2708ae128c5f2d0c0ab19046d08796d1b5a1cff395a0689ab25ccb51

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\libEGL.dll

MD5 ca5bb0794b7700601e9438283d458665
SHA1 7fcf090b19820b9450937be800575c526448b581
SHA256 4a8be3b4d9fe790efdce38cff8f312a2f8276908d6703e0c6c37818e217cf1e3
SHA512 36ebab858fe7e014837548575389e7df2e86676888e4a9039c736d0f2e6463102e68989b794d949ddb16d9bcce43ce55737fcf2a4b09b1667bf968a9540e9f32

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\icudtl.dat

MD5 2134e5dbc46fb1c46eac0fe1af710ec3
SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\ffmpeg.dll

MD5 a007299c49fa50aeff594655859780ae
SHA1 d202f1f617023763a0e9418878e8ecac96be9fd4
SHA256 b78f0036621ad1d5833289f2ad509963ef78f1a89a3c7df0f1370fd2d35a2804
SHA512 444c4baa1e1d941bd04f78184cec519c6eb53a83fbc3aa3ea30522bffc9ecde73ebe7b910c1a37c345429298ada3c0ffcb3e3849e21b2009487b5cd1a02cb2a9

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\d3dcompiler_47.dll

MD5 2191e768cc2e19009dad20dc999135a3
SHA1 f49a46ba0e954e657aaed1c9019a53d194272b6a
SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
SHA512 5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\libGLESv2.dll

MD5 05b585464f18fe0e3bddb20527697d66
SHA1 8bcec2f0b409afa9ff054e25f3ce85eb9bd50010
SHA256 0bb7c6c08b569c1d2de90a40e6c142591e160a7c6cb15d21807f3404a48c4287
SHA512 f680ab9c3070f443c7359bb3f0c2032f5c58c88c7823e4592e8212ce8815ea5f463c86df113f5320944c62d3cb4e8d45b9b4dcaadccc1ac9bf203ae4bb52083c

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\LICENSES.chromium.html

MD5 8303b3a19888f41062a614cd95b2e2d2
SHA1 a112ee5559c27b01e3114cf10050531cab3d98a6
SHA256 9c088caac76cf5be69e0397d76fe9397017585cffdba327692ff1b3a6c00d68f
SHA512 281b2ecc99502a050ee69e31256dec135e8cb877d1a6ba9f1c975fcfb11c062980ee6061d2368b62f91e392953ae6235dd726a9d98e6efc1302f7ed713099179

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\resources.pak

MD5 31c7d4b11ad95dfe539dd098e0fab736
SHA1 5418682d939ce8485ecc9125b872c14ffec662c2
SHA256 a251019eb08f1e695e935d224544bda37c5ae092ba68a89fa1fe3bd19bde4f5c
SHA512 f868a4afa4e0d5c561873d2a728e267f98da2df3fb90966e5736d496b6a24e71769a02b0346b27b7dcce11cbe07248e309f50a89977dc8e5bbc06d6cc31bf738

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\vk_swiftshader.dll

MD5 750cbdfb01943e28e08708183ec208b5
SHA1 1bee0cd3d0970834b2a47daf384354f243fd1ee0
SHA256 a6d295dcc3afcb55aa79eac5f896bceb15ccb2b798db3bb076ceeea78073791a
SHA512 dbfdf76f40558ce2f23ca315b8719e283f0f22f46e733f37c2ae237fdafd23cf7962f36547ba1bb2d5b219de11546c3dc06859fac498a7da97df41018c0d80c4

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\vulkan-1.dll

MD5 6c70aab071c4febc5921e0d39811937a
SHA1 20d87b3a5333ea3f6d0d7b0333f2c30a281937aa
SHA256 2233fef6788711089fc5c1a008bfff6559cf2fc3e8363cd8a50196e90d1d9825
SHA512 7f786c44376b59be7d7c51d3c40ecb80f30645551b582d042b641ea0a6464daf367ddf7eafaf00a1558e1f11570d99a699d33d224b01048d09f8f00ea501c4bf

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\v8_context_snapshot.bin

MD5 146e284750735ef4798527dc1cd0e741
SHA1 6408985b7d05c768a62bcb912234f14e1898ffdb
SHA256 3820e8fa1077d02606fea8e1b3a9ca4bf7f4a71d0569d9a8ea9ee7a009d0ce80
SHA512 46824df5d20e02fb72c3efd07bee6d832b1ab78c0163688fa84edb831cbfbef2dde12ba9da01f9dd49c4008bd3862a95699a2f6d55b8d4b3165976d3851c7278

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\snapshot_blob.bin

MD5 4ebd06bdf6cf8dacf6597586fd1704b5
SHA1 e6819ef37f99f91468f4b94370a4ab467a075a6d
SHA256 148e4b85983f0d27adecd9c6431b66379ac5538688f320e89d74ff6d48bb740b
SHA512 17ed5abe702748b4626b3ee6de4d0916738f095c913c2700eee06b65a2bbcaf72afc1f87af7ce0fcce8bd15fe6881508255d397a346c45a82c7791b9b9833ddf

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\af.pak

MD5 7e51349edc7e6aed122bfa00970fab80
SHA1 eb6df68501ecce2090e1af5837b5f15ac3a775eb
SHA256 f528e698b164283872f76df2233a47d7d41e1aba980ce39f6b078e577fd14c97
SHA512 69da19053eb95eef7ab2a2d3f52ca765777bdf976e5862e8cebbaa1d1ce84a7743f50695a3e82a296b2f610475abb256844b6b9eb7a23a60b4a9fc4eae40346d

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\am.pak

MD5 c6ef9c40b48a069b70ed3335b52a9a9c
SHA1 d4a5fb05c4b493ecbb6fc80689b955c30c5cbbb4
SHA256 73a1034be12abda7401eb601819657cd7addf011bfd9ce39f115a442bccba995
SHA512 33c18b698040cd77162eb05658eca82a08994455865b70d1c08819dfac68f6db6b27d7e818260caa25310ff71cf128239a52c948fde098e75d1a319f478a9854

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\bn.pak

MD5 8feb4092426a0c2c167c0674114b014d
SHA1 6fc9a1076723bfaf5301d8816543a05a82ad654d
SHA256 fb0656a687555801edfb9442b9f3e7f2b009be1126f901cf4da82d67ac4ad954
SHA512 3de40bdd18e9e7d3f2eceebf7c089e2250ce4d40412a18d718facba8f045e68b996978ef8b4d047b21d3424094056d16b5abb81bd0507f446b805d6b889522a7

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ca.pak

MD5 01acd6f7a4ea85d8e63099ce1262fbad
SHA1 f654870d442938385b99444c2cacd4d6b60d2a0d
SHA256 b48d1bad676f2e718cbe548302127e0b3567913a2835522d6dd90279a6d2a56a
SHA512 2bd13eca1a85c219e24a9deb5b767faa5dc7e6b3005d4eb772e3794233ed49cb94c4492538d18acc98658c01d941e35c6f213c18ac5480da151c7545eedeb4ab

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\da.pak

MD5 bb5252dc6f0f3c01ce3638138bf946c8
SHA1 bfb584b67c8ca51d94bff40809410553d54da1cf
SHA256 c93f39d0ab9a2fab26977aa729261633225879ba6dc5ea8d0ca89814b2df9fa9
SHA512 e411fd3cc5285a6059c3fd80c3421253a4ce06b2d0cd1cd1efc25e88191a58fed176452d852922137268be2824e1e162cd4d4a6f8c695a50517a783d15b1c6e7

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\de.pak

MD5 ed329b35d10e81f55d611fe8748876f8
SHA1 0d998732bb4c4d1faad5a5bc0a21d6c5672418d3
SHA256 6facd562add58c4684ef4a40de9b63581fea71c5b83049ed8a2c2a2c929c45ce
SHA512 bd713ff78e375fec3a04ab0c9476c0379f87efc6d18359c2a4d297303d78381081120c371848c8675f1f16dd4ab7284d81e5bfc9ae11ab33e12f96c12d89e764

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\cs.pak

MD5 a934431d469d19a274243f88bb5ac6fb
SHA1 146845edc7442bf8641bc8b6c1a7e2c021fb01eb
SHA256 51c36a5acdad5930d8d4f1285315e66b2578f27534d37cd40f0625ee99852c51
SHA512 562f07151e5392cbffb6b643c097a08045e9550e56712975d453a2ebaee0745fbfba99d69867eec560d1d58b58dff4f6035811b9d4f0b1b87547efa98f94d55d

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\bg.pak

MD5 945de8a62865092b8100e93ea3e9828d
SHA1 18d4c83510455ce12a6ac85f9f33af46b0557e2e
SHA256 f0e39893a39ce6133c1b993f1792207830b8670a6eb3185b7e5826d50fea7ba2
SHA512 5f61160ff64b9490a1ad5517d8c1bb81af77d349541fed5045e7f6e5053b7d79b7e8f114630bfbe4d5af30258f70a6569462bfa39ccb765f8ca191f82ee04f3f

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ar.pak

MD5 56f6dc44cc50fc98314d0f88fcc2a962
SHA1 b1740b05c66622b900e19e9f71e0ff1f3488a98e
SHA256 7018884d3c60a9c9d727b21545c7dbbcc7b57fa93a16fa97deca0d35891e3465
SHA512 594e38739af7351a6117b0659b15f4358bd363d42ffc19e9f5035b57e05e879170bbafe51aece62c13f2ae17c84efb2aed2fc19d2eb9dcb95ebd34211d61674e

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\el.pak

MD5 6922aaa87431699787c1489e89af17b9
SHA1 6fb7771c9271ca2eeebe025a171bfa62db3527f7
SHA256 800545f9134914649da91b90e7df65d8208014c3e12f2be551dfd6722bf84719
SHA512 367ef8467631e17e0a71d682f5792a499e8578b6c22af93d9a919d9e78709ec2501df9599624f013b43f4c3e9fb825182193116dbead01874995d322b7a6e4d6

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\en-GB.pak

MD5 0db7f3a3ba228aa7f2457db1aa58d002
SHA1 bbf3469caadfa3d2469dd7e0809352ef21a7476d
SHA256 cf5aca381c888de8aa6bbd1dcd609e389833cb5af3f4e8af5281ffd70cd65d98
SHA512 9c46c8d12579bd8c0be230bbcdb31bdb537d2fea38000cf700547ca59e3139c18cc7cb3e74053475605132404c4c4591f651d2dad2ce7f413ccffd6acf7139e8

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\es-419.pak

MD5 5321c1e88c5c6fa20bdbc16043c6d0f6
SHA1 07b35ed8f22edc77e543f28d36c5e4789e7723f4
SHA256 f7caa691599c852afb6c2d7b8921e6165418cc4b20d4211a92f69c877da54592
SHA512 121b3547a8af9e7360774c1bd6850755b849e3f2e2e10287c612cf88fb096eb4cf4ee56b428ba67aeb185f0cb08d34d4fa987c4b0797436eea53f64358d2b989

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\en-US.pak

MD5 5e3813e616a101e4a169b05f40879a62
SHA1 615e4d94f69625dda81dfaec7f14e9ee320a2884
SHA256 4d207c5c202c19c4daca3fddb2ae4f747f943a8faf86a947eef580e2f2aee687
SHA512 764a271a9cfb674cce41ee7aed0ad75f640ce869efd3c865d1b2d046c9638f4e8d9863a386eba098f5dcedd20ea98bad8bca158b68eb4bdd606d683f31227594

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\es.pak

MD5 e9fa4cada447b507878a568f82266353
SHA1 4a38f9d11e12376e4d13e1ee8c4e0d082d545701
SHA256 186c596d8555f8db77b3495b7ad6b7af616185ca6c74e5dfb6c39f368e3a12a4
SHA512 1e8f97ff3daad3d70c992f332d007f3ddb16206e2ff4cffd3f2c5099da92a7ad6fb122b48796f5758fe334d9fbf0bbae5c552414debbb60fe5854aaa922e206e

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\fa.pak

MD5 dcd3b982a52cdf8510a54830f270e391
SHA1 3e0802460950512b98cd124ff9f1f53827e3437e
SHA256 e70dfa2d5f61afe202778a3faf5ed92b8d162c62525db79d4ec82003d8773fa3
SHA512 3d5b7fa1a685fa623ec7183c393e50007912872e22ca37fdc094badaefddeac018cc043640814a4df21bb429741dd295aa8719686461afa362e130b8e1441a12

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\et.pak

MD5 a94e1775f91ea8622f82ae5ab5ba6765
SHA1 ff17accdd83ac7fcc630e9141e9114da7de16fdb
SHA256 1606b94aef97047863481928624214b7e0ec2f1e34ec48a117965b928e009163
SHA512 a2575d2bd50494310e8ef9c77d6c1749420dfbe17a91d724984df025c47601976af7d971ecae988c99723d53f240e1a6b3b7650a17f3b845e3daeefaaf9fe9b9

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\sw.pak

MD5 ee8da42ffe40fbb916c56390e2cd99e8
SHA1 6d824f56afe6b3605a881d2c26e69a46e6675347
SHA256 192e248c7ac4644f8712cf5032da1c6063d70662216ccf084205f902253aa827
SHA512 7befe72b073000bc35a31323d666fd51d105a188d59c4a85d76ee72b6c8c83a39a1beb935c1079def8e3ffa8c4bf6044cf4f3bef0f1c850c789b57e1144ff714

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\sv.pak

MD5 bbe0785c5f9591e8a1e7c4830fe949d6
SHA1 da4f3286079d50e1c04e923529e03e7d334c7fff
SHA256 0ad84f6f95fd7505862278a7c1c92d00a7e7dd4a765569e9c3086f55c1d7059d
SHA512 38bab6f3a6c9395d3b57e63168045ad2e8188b2f04751a15253e7226ec3043c9678a77be1eb27a3b2e751934a024f3ffc89fffd9f1e229e19638be318b53e961

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\sr.pak

MD5 cf160983a86b51ec42845f4e60ac9123
SHA1 4d3bd86a7ef1eaadb8bec0b79ecc6c05b4273a48
SHA256 ef07512fb337005bb66696c69722a0d65bfb749b9d2f763f5b2ff2885cb247a4
SHA512 b909fc3614c3250856d2c502cbfed5eb6e398140b801669bf92427e7e8a5939b14052b9abf2c94749f1aea61946ff66be4978c68064196458733bcff0a963ffa

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\sl.pak

MD5 4d9d56ef0b176e7f7aa14270e964ec77
SHA1 515aac37e4f25ca50bd52ea73889b70b1e79863d
SHA256 6ba684a8f06f7eb175955b15d30c7162d92c7e7c48864dfb853238263e1be8c7
SHA512 740adbb7d8b039f98e187f45a1a87d0354136fb48b75262e508f720bfcbeb2746f04d31a57dccd50e37ddb5a1b7c0ad79a01cac6ba5fb98a9af272ad99fcb169

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\sk.pak

MD5 793c442420f27d54410cdb8d8ecce5ff
SHA1 8995e9e29dbaaa737777e9c9449b67ca4c5b4066
SHA256 5a9d6b77ca43c8ed344416d854c2d945d8613e6c7936445d6fe35e410c7190bb
SHA512 291e3d2300c973966d85e15a1b270ba05c83696271a7c7d4063b91097a942590c9797a4d22dfbe154564b779dac92fd12db0d5b63f5f0406f818b956b126e7e9

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\vi.pak

MD5 9274866d7c6314f43dd63ed293293e25
SHA1 4af0e6ec1bcb99588810a9fb69c1dc2bbad892fc
SHA256 dcbdc6d9e11dd10fc1364c10be5438ce2697f61ec5f32997c43b87238087c4e3
SHA512 3c8c9e9960a49469af83cae31790a03e41846163c14d3dae45fd92a1a412c82075bdef3317baca02399eb53de0f9164c0a9a17b7cd63e0fa61c3e4617393c42e

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\zh-TW.pak

MD5 8f67a9f38ad36d7d4a6b48e63852208d
SHA1 f087c85c51bdbdef5998cfc3790835da95da982a
SHA256 92f26e692dc1309558f90278425a7e83e56974b6af84dbd8cc90324785ee71ca
SHA512 623034bbdfdf5d331de78b630f403aeb9cef27b1827e0d29ec66ad69310f56c7db96c6775df0e749f8112a4a8e75754bcf987903d415fc7ae360e3c39e6e18e0

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\resources\app.asar

MD5 e712ea245bd5be34527270b24957ad12
SHA1 85368b0a429a2f25ffda594e61411f622d44ea47
SHA256 d5d227d97c883370aeb9c3caf34f5ba274d40c69f108ee214197ef89b4faba9a
SHA512 ba31bae58527bc3f2f1983957d1bbafa4aa9211b537fe8a6b4791d051e6da36867c9e12bae75b05aea037922f961a6c10718b1ff4c173439fb36f88f2c3a2dd2

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\zh-CN.pak

MD5 9d4f54eb5a12cf4c2f34f5f538dff90b
SHA1 c31b892ce78c733bde0571b6236170103cc9fe7a
SHA256 58b934a09858f037f1966a495e73d44416180afcdebfaefcee1f5e3377de63f7
SHA512 46bf6099c50f7959a6f0800ec679b61a78efabe87985cad8dc0d7d0006470a9c61e659bde0258da6cf7ed6104749a157f5ad133f324479c3460a19fc14e31c37

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ur.pak

MD5 d7ec7d551dee1e1ef11be3e2820052f9
SHA1 d7f2d35841883103c2773fc093a9a706b2fe5d36
SHA256 05e45371159075048db688564b6bc707e0891303c40f490c3db428b0edd36102
SHA512 92e2d32fc106812e08163a26f202a5d0e7eb7028a871f3bc6cbc05ee6c7ce287032179322b19e396308968515bf214534a38d93afc259a780ad7ba8432fab56a

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\uk.pak

MD5 e4c4e3700469704b936460ca1a90fcc0
SHA1 e809990fc07a1d39fe623046382699e648e343c0
SHA256 29af2abc75a35bb9e3f9bc6e2904228ba651ea4e0ce8e9c7a2d7e272374b9ebb
SHA512 68e33f471c5bf2d4ed9cb00ace3e094ef102a5f1566a6e2c8a3007ef7fbd8a24c36eb36b08745f3608e70940444e9fc7a36fabe1a9945d1f00b4f3f28c7bdaf6

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\tr.pak

MD5 9f24f44cac0997e1d0a6a419520f3bfe
SHA1 edb61859cbb5d77c666aac98379d4155188f4ff5
SHA256 3aff7dcbfb1a244cc29b290376b52cfb3e1f844c98facafea17b4a45ce064b8a
SHA512 65fbe2d7fea37db59b805d031f6ae85d628a51b254e76e8c2b4ef4b5153527b7e2412ed6a0961d174b8a5581b521b0436160fe5ed252f78303bcfde815733d81

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\th.pak

MD5 293ad7c20c22d744e4db0fb001ec45bb
SHA1 486c9e0732306a45aceb633da2b3ded281197620
SHA256 d67d68f24d3347e244a7e8c3b63d47f18fcf37258256f48dad785cf98bb560fa
SHA512 ac2b2dd82095925b3229958e89dcf5283bdce0273734a0c338f5a1aa8b014644806ca517f0fc2003669910e58fedf9c2ca7a009fa3f53d58c07bc5e9191f2e2f

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\te.pak

MD5 02415ded02cc7ac25e8f8d0e83365061
SHA1 5a25bf63ec97dbeb37e64ab3825cbbce6326a5cf
SHA256 97024f0cfac78e0c738e771beea1e35f5a8eb2b132b3043b59ce4ecd6c153523
SHA512 54e658c6d432b29b031be278e5b4396ac14b0f85e1f772a0a76c0431d4cbe2370ff2898077837688e2fb9700db1eab7a19e4e350a280a2ffad8176d861d93e45

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ta.pak

MD5 a8beab6896018a6d37f9b2e5bdd7a78c
SHA1 64310684247219a14ac3ac3b4c8ebaa602c5f03a
SHA256 c68b708ba61b3eeab5ae81d9d85d6e9f92e416ecfae92e8de9965608732384df
SHA512 73b0a31235bf4b7c5ad673f08717f3b4f03bcdf2a91440ee7228aa78c2d15dd2aed32498e23ded78ec35bc731dbe16b6a1c236a170f2a84123a464857686c7b5

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ru.pak

MD5 fc0e2fc09aa9089c5db75bab7a0754a7
SHA1 f3d1e3e1600ae188e801a81b6d233db9903b82df
SHA256 188b6405cb6c5b7c0b35050278a119c3ce41fb90883b9adb39fec15da0a05550
SHA512 377e685d1d171d0a7158b56f356ca33d4493d07efa58d3c384e272e1b6829933552c69aff95215ae7d1a0f99616a20790708f5187ea10cfe46baa2bb522fc18f

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ro.pak

MD5 19cfc7c8f1a2e4a2de1f9f64475469bc
SHA1 bf6c4f373c19b03e116d2593c64e1ceca47d79dc
SHA256 3e725f7a791aed1fbed57f075ca11ce389a5bd425ccce3c00537dad27e5a8dd6
SHA512 ff5254e3a3676b8f5e74cba6661ae43d5739c7363c66cb17f74dce158dc36cee103885f055846dd320b932f2e7fbdc831bcee6293d423ff9b842b68644f633bd

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\pt-PT.pak

MD5 acffa29064f40a014bc7fe13e5ff58a9
SHA1 5a0890c94084075446264469818753f699a3d154
SHA256 423e7ccb22d32276320ed72f07186188e095c577db5bce7309c8bd589a2a8858
SHA512 d4572c81fdd3b7b69d77544f68b23ae0b546158033be503dbaab736d3ca1188b18916688234fae9ea29fa430258b2d2b95a93d0e8b74919a62040b84902d3b6e

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\pt-BR.pak

MD5 a23c805ee4d3d67c811b50826ca25a51
SHA1 c14fa8b9c7073fe88e188cfa4b34883faccc2c09
SHA256 62be4fb0bd3b8be563516bfea3f0848924bb7afb0c563d02c1508608a4487e3b
SHA512 c478bd2234eef73aa08085d29b916ad1471576ff213f972c9616757172d0cdec6e5d6797a1f2635ac17a0bac34964a298e4ab4336479456ce10330128cd68a53

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\pl.pak

MD5 61c093fac4021062e1838a32d79399c2
SHA1 84a47537ef58d2507cf7697ea7e1e27b1f812ee8
SHA256 58067ec06973f5dd7afebbe57bffce3a3ed9f8e5093af8fcefdb6a65b2b68b22
SHA512 475d9d4f27cbc23efd9acf75024f993bcf7a8279e658ccbd84c8ac810e1c828de4dac4141298865faf1bb8858a7a88a12d1a21c467e8c656533e364ceff7e5dc

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\nl.pak

MD5 bc41967b2ff493e7f151c7721245739d
SHA1 7606133ddbb58492dbbf02c03a975fb48da1e26f
SHA256 3dbe5569f53d1314dcb1bc99540cf6a0fea45b6d67576fd0d14c688107892f32
SHA512 9e395a3b5bbf64de3e474c56c4fb39879f107a9db246632cf6bb4b06160e05a82c0161d6496edb2bc29febb4a8f67ca7ea904167b860fd6da96636a6711cb593

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\nb.pak

MD5 7576c2fa9199a4121bc4a50ff6c439c3
SHA1 55e3e2e651353e7566ed4dbe082ffc834363752b
SHA256 2a3dfc6b41fa50fabed387cb8f05debbc530fa191366b30c9cb9eaae50686bd5
SHA512 86c44e43609e6eb61273f23d2242aa3d4a0bfa0ea653a86c8b663fa833283cc85a4356f4df653e85080f7437b81ae6201a3ecf898a63780b5ca67faa26d669fe

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ms.pak

MD5 9b3e2f3c49897228d51a324ab625eb45
SHA1 8f3daec46e9a99c3b33e3d0e56c03402ccc52b9d
SHA256 61a3daae72558662851b49175c402e9fe6fd1b279e7b9028e49506d9444855c5
SHA512 409681829a861cd4e53069d54c80315e0c8b97e5db4cd74985d06238be434a0f0c387392e3f80916164898af247d17e8747c6538f08c0ef1c5e92a7d1b14f539

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\mr.pak

MD5 25f2b9842e2c4c026e0fc4bc191a6915
SHA1 7de7f82badb2183f1f294b63ca506322f4f2aafa
SHA256 771eb119a20fcc5e742a932a9a8c360a65c90a5fe26ab7633419966ba3e7db60
SHA512 ac6d2eeb439351eee0cf1784b941f6dd2f4c8c496455479ca76919bf7767cca48a04ba25fccde74751baa7c90b907b347396235a3ce70f15c1b8e5388e5c6107

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ml.pak

MD5 3b1305ecca60fb5a7b3224a70398ead9
SHA1 04e28fce93fc57360e9830e2f482028ffc58a0a2
SHA256 c10942f5333f0d710de4d3def7aa410c4576ffe476b3ea84aac736bfb9c40d67
SHA512 68fdd944a153c16d18e73dd2aa75593f6ac13b8e87dbfb5bfccdd982a4f885bd9903c3ed1af781581cd3c5d42dd2ff21cc780f54fd71ab04a3237d08ed5a1554

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\lv.pak

MD5 e4f7d9e385cb525e762ece1aa243e818
SHA1 689d784379bac189742b74cd8700c687feeeded1
SHA256 523d141e59095da71a41c14aec8fe9ee667ae4b868e0477a46dd18a80b2007ef
SHA512 e4796134048cd12056d746f6b8f76d9ea743c61fee5993167f607959f11fd3b496429c3e61ed5464551fd1931de4878ab06f23a3788ee34bb56f53db25bcb6df

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\lt.pak

MD5 96602a3f3b59faa997a4d337889fa02b
SHA1 94593a270b0d84c006e0959bc136b6c4987dfd3f
SHA256 51db5311de9dff41fb4eadda8ba7d5e492912f72c3754adaf8e3de23aba46f8a
SHA512 dd45240494d09ad9a41be9d4056ed274e78a50dc85e6bff9438e707a84f65b77ebe522531370da99e50a6887d6063c29e9728b49df2b2b3c61362d774797fac2

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ko.pak

MD5 b83bc27c5bc2bb4d0ff7934db87e12ad
SHA1 050f004e82f46053b6566300c9a7b1a6a6e84209
SHA256 ab3060e7d16de4d1536ff6dd4f82939a73388201ad7e2be15f3afee6a5aae0ef
SHA512 b56b211587fe93a254198ca617cdecd8dc01e4561151a53173721665111c4d2440535f5f6b8a5a69a31840ea60124f4afd2c693d1fc4683fa2cf237c8ede5f0a

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\kn.pak

MD5 a603f3d899ccdcd9af20dcd8f87d0ed8
SHA1 f476355d6ea5c05b35ad74c08e2edfe5ff2881ad
SHA256 3c11a589aab0c5d9e5c18e6a95dce7e613089d3598b8fe54e656a8d97e22a6fd
SHA512 f6b008080cae44d680faaab02911f62e21d042c55fc5af87e719e9bc4102b282e58e67f19f37f60fe8ba99f5b8cfd4e70a61af9918a9ee8e3d8ae72555d31c15

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\ja.pak

MD5 f47efaa76f5200a6c0c23c33684d7bad
SHA1 9b24f6491a1171d3dfeae329e1f45ab3e3d9cf22
SHA256 5b99d6a11d7b653681b2a2bb616cc1814451ad35c370d178b2ef6650465d4f2a
SHA512 67d130a66f03a4d1a0a30576b19fe44fa707cba764c6dcd355cbe891a2bcc0b25823ba2106e9271e06ada674f66824a5323b77d4984900516d2a8802af87960e

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\it.pak

MD5 7c981a25be0e02fba150e17d9669a536
SHA1 3af10feb7cdc7bc091b80173301b1a3d4ef941d4
SHA256 ee2d2643ad7a8f97b7a6c070910866436cae0267a6691a3d8a88ed0948d8af49
SHA512 445eecfa83e7635bc3442937bdf3b9c4a38ef3fbb7f07ca90a1d4222e1a29639f3fdce12b20e798888823f2d612e5972492b3786d37b256aec5c1c96cdb96b28

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\id.pak

MD5 bd9636e9c7dc7be4c7f53fb0b886be04
SHA1 55421d0e8efcbef8c3b72e00a623fb65d33c953e
SHA256 5761ee7da9ca163e86e2023829d377a48af6f59c27f07e820731192051343f40
SHA512 7c7e88ffd2b748e93122585b95850ded580e1136db39386ced9f4db0090e71394a1f9ceb937262c95969132c26bf6ce1684fbb97b6469ed10414171a2e8cc3a4

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\hu.pak

MD5 b338dcb0e672fb7b2910ce2f561a8e38
SHA1 cf18c82ec89f52753f7258cdb01203fbc49bed99
SHA256 bcdf39aa7004984cb6c13aac655b2e43efeb387ce7d61964b063d6cf37773f7a
SHA512 f95f6a8e36d99680fb3cdb439f09439782bcc325923ec54bdc4aeb8ec85cf31a3a2216e40e2b06c73a2f5e7439d8178d8becac72781a6d79808067e8ccf3cac6

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\hr.pak

MD5 105472bc766a30bb71f13d86081de68d
SHA1 d014103ad930889239efd92ecfdfcc669312af6c
SHA256 a3a853a049735c7d474191dff19550a15503ecd20bafe44938eb12ea60e50b7c
SHA512 ee7479d459eff8ec59206c2269df4e9fc1ca143e9b94a908eb8a5a1e16180bcc88f0b24d73c387f5853ea0418e737641f23146676232c1a3ac794611f7880f11

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\hi.pak

MD5 b7e4892b2030e4f916364856b6cc470a
SHA1 b08ad51e98e3b6949f61f0b9251f7281818cd23e
SHA256 093119a99f008ab15d0e5b34cd16ec6b4313554e6c3cffe44502bfce51470e3e
SHA512 ca453025d73228592a4bfe747a3ea08b86327f733032a64ced0fc0c9e2e00b02450f133e691b94be13a3e69e22b43bca512e5f77b0e490320f0bf8e65571bb46

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\he.pak

MD5 93d9261f91bcd80d7f33f87bad35dda4
SHA1 a498434fd2339c5d6465a28d8babb80607db1b65
SHA256 31661709ab05e2c392a7faeed5e863b718f6a5713d0d4bbdab28bc5fb6565458
SHA512 f213ff20e45f260174caa21eae5a58e73777cd94e4d929326deefbef01759d0200b2a14f427be1bb270dfcd2c6fb2fce789e60f668ac89ecf1849d7575302725

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\gu.pak

MD5 7b5f52f72d3a93f76337d5cf3168ebd1
SHA1 00d444b5a7f73f566e98abadf867e6bb27433091
SHA256 798ea5d88a57d1d78fa518bf35c5098cbeb1453d2cb02ef98cd26cf85d927707
SHA512 10c6f4faab8ccb930228c1d9302472d0752be19af068ec5917249675b40f22ab24c3e29ec3264062826113b966c401046cff70d91e7e05d8aadcc0b4e07fec9b

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\fr.pak

MD5 0445700799de14382201f2b8b840c639
SHA1 b2d2a03a981e6ff5b45bb29a594739b836f5518d
SHA256 9a57603f33cc1be68973bdd2022b00d9d547727d2d4dc15e91cc05ebc7730965
SHA512 423f941ec35126a2015c5bb3bf963c8b4c71be5edfb6fc9765764409a562e028c91c952da9be8f250b25c82e8facec5cada6a4ae1495479d6b6342a0af9dda5f

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\fil.pak

MD5 3165351c55e3408eaa7b661fa9dc8924
SHA1 181bee2a96d2f43d740b865f7e39a1ba06e2ca2b
SHA256 2630a9d5912c8ef023154c6a6fb5c56faf610e1e960af66abef533af19b90caa
SHA512 3b1944ea3cfcbe98d4ce390ea3a8ff1f6730eb8054e282869308efe91a9ddcd118290568c1fc83bd80e8951c4e70a451e984c27b400f2bde8053ea25b9620655

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\7z-out\locales\fi.pak

MD5 5518b51d4af7f1b9d686cbea28b69e71
SHA1 df7f70846f059826c792a831e32247b2294c8e52
SHA256 8ff1b08727c884d6b7b6c8b0a0b176706109ae7fe06323895e35325742fe5bd1
SHA512 b573050585c5e89a65fc45000f48a0f6aabccd2937f33a0b3fcbd8a8c817beaa2158f62a83c2cae6fcfb655f4a4f9a0c2f6505b41a90bc9d8ede74141ebc3266

C:\Users\Admin\AppData\Local\Temp\nsf9FAC.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

C:\Users\Admin\AppData\Local\Temp\5fb6f0ac-c741-4d91-85f6-8693cb90c5fb.tmp.node

MD5 04bfbfec8db966420fe4c7b85ebb506a
SHA1 939bb742a354a92e1dcd3661a62d69e48030a335
SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
SHA512 4ea97a9a120ed5bee8638e0a69561c2159fc3769062d7102167b0e92b4f1a5c002a761bd104282425f6cee8d0e39dbe7e12ad4e4a38570c3f90f31b65072dd65

C:\Users\Admin\AppData\Local\Temp\1d5e2d4c-ba9d-418b-a9bf-06d426b6a993.tmp.node

MD5 56192831a7f808874207ba593f464415
SHA1 e0c18c72a62692d856da1f8988b0bc9c8088d2aa
SHA256 6aa8763714aa5199a4065259af792292c2a7d6a2c381aa27007255421e5c9d8c
SHA512 c82aa1ef569c232b4b4f98a3789f2390e5f7bf5cc7e73d199fe23a3f636817edfdc2fb49ce7f69169c028a9dd5ab9f63e8f64964bb22424fc08db71e85054a33

\??\pipe\crashpad_1164_LMDDBVGUTYORSMVY

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 a28bb0d36049e72d00393056dce10a26
SHA1 c753387b64cc15c0efc80084da393acdb4fc01d0
SHA256 684d797e28b7fd86af84bfb217d190e4f5e03d92092d988a6091b2c7bbbd67c1
SHA512 20940fee33aa2194c36a3db92d4fd314ce7eacc2aa745abec62aa031c2a53ba4ff89f2568626e7bd2536090175f8d045c3bb52c5faa5ecc8da8410ab5fc519f7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 554d6d27186fa7d6762d95dde7a17584
SHA1 93ea7b20b8fae384cf0be0d65e4295097112fdca
SHA256 2fa6145571e1f1ece9850a1ac94661213d3e0d82f1cef7ac1286ff6b2c2017cb
SHA512 57d9008ccabc315bd0e829b19fe91e24bab6ef20bcfab651b937b0f38eec840b58d0aed092a3bbedd2d6a95d5c150372a1e51087572de55672172adc1fc468a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 99924a7ec53680ad7470d643b0307053
SHA1 60e4951f033e852162cb6ce346d43a94bc343c03
SHA256 fefbac0d0066685b586dd2ad95bd315a7effbab0b888a2cf2a5a8f28af3a6081
SHA512 068d76a2b7c18d552ae87687a1fce39dd6575fd05d6fa7df90df898557b899eb0aef6914ac6d8281a99849ed9f3c491af709cf135ce6bb837039e8f25fe57070

C:\Users\Admin\AppData\Local\Temp\passwords_0.db

MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

C:\Users\Admin\AppData\Local\Temp\b8c7bc3f4719be77.vbs

MD5 647e411f508505a04f2a3870636d3e57
SHA1 15c2901cbcc626562ce8c07c6d18aa67917df98d
SHA256 a7a94389047c0e5c3e44ed710d050e8d3dcb77911a8fd06310daeb2cb3b7dcc2
SHA512 b31195daf3e60f737dbb638ed7ff9f08b27d370deaf62e20fb749cb6634229bf3af9a3bf366cb4d9bf8a91d76fd9aff8dd0eeaf474adc3dd272e30a7440aa262

C:\Users\Admin\AppData\Local\Temp\open.vbs

MD5 4acc8df16e6a13bb6212bc0ea00a9ea9
SHA1 ad6003c57ed6e56e4d8e69246a164eb5305a281a
SHA256 8f0ca15583e28e50fa2905bba70fa7cc94a8c8e7cb37d5ae55991cbd74b84e7b
SHA512 f921c8168f0ee5ba40883eeb8fdd52e8af70692f92f8981a1f4025bd0feaafb6a43db9333dc770f2cf547563b30e32fbcd6146ff7a34f03edefc2c6a730f3809

C:\Users\Admin\AppData\Local\Temp\pkg\f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c\sqlite3\build\Release\node_sqlite3.node

MD5 66a65322c9d362a23cf3d3f7735d5430
SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat

MD5 da0f40d84d72ae3e9324ad9a040a2e58
SHA1 4ca7f6f90fb67dce8470b67010aa19aa0fd6253f
SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
SHA512 30b7d4921f39c2601d94a3e3bb0e3be79b4b7b505e52523d2562f2e2f32154d555a593df87a71cddb61b98403265f42e0d6705950b37a155dc1d64113c719fd9

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest

MD5 8951565428aa6644f1505edb592ab38f
SHA1 9c4bee78e7338f4f8b2c8b6c0e187f43cfe88bf2
SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
SHA512 7577bad37b67bf13a0d7f9b8b7d6c077ecdfb81a5bee94e06dc99e84cb20db2d568f74d1bb2cef906470b4f6859e00214beacca7d82e2b99126d27820bf3b8f5

\??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSC48F36D8DBED44C3CAB8F1F2DA217F34.TMP

MD5 a6f2d21624678f54a2abed46e9f3ab17
SHA1 a2a6f07684c79719007d434cbd1cd2164565734a
SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
SHA512 0b286df41c3887eecff5c38cbd6818078313b555ef001151b41ac11b80466b2f4f39da518ab9c51eeff35295cb39d52824de13e026c35270917d7274f764c676

C:\Users\Admin\AppData\Local\Temp\RES22F4.tmp

MD5 78b6c7b2f917844acc239b4cf70f9c14
SHA1 7deb91548b3dea14770909ecf034c82d4bfe8edd
SHA256 412997d571958b4231e0fb8535994ecc8137e3cf1a5df34ebdb416262aec861a
SHA512 a5e07c23f4dd9fdde74b1dea9ed9598bca47c4fc2687a7da6cb7b85859640339a3f0d470e836726bbad8ec046c0752a10d9f5b1e5856d0f97374de733f47e76d

C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe

MD5 f67dde0929efc69753cd5efb408a8219
SHA1 2696f705c50ba9c0dedb60f2f8890a12e87a6e2b
SHA256 b0bc78374b1f1c752fc8ad9221d3bf85228f179822bfb3e9b3f2e21cf7909544
SHA512 a293753bb9d910d3f088caf072945361633d4aea28570a3ca620fce87cf101a7a2ff36d19e2314f00a5561ef1d5294ec6c79357eee02a87e81fc9294979934e8

memory/2212-934-0x00000000009A0000-0x00000000009AA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20241020-796-1hgzkcw.smdz.png

MD5 c7007c6483f129c84ff6044a0fa3d5dc
SHA1 da0bd205e3948c57bec81f658e46842d0e449ce6
SHA256 297a2d7fc1013eec2de46e32eeb653c40c733d1d7eda81f209d8bf2515ff7bb5
SHA512 7e36c6cb5993b372f43f3b995bb8b59011cde89fec84bbf8bf5d11ed2b636b4e8aca14685e83979d9fed4c6d49330cb2f1d3a6633642b83387545260e654f3d7

C:\Users\Admin\AppData\Roaming\unrealgame\Local State

MD5 becd67b901775d01be125131b008d23e
SHA1 0130cbe4f1e692f5633bcfe8249a1d7b2976e485
SHA256 57b2c6e7086cfb3af082a6cac0f3c338ca3add81e517b9c77f99eb421c1b5222
SHA512 e36a2cc8b7fb15dba5e6a6373f48dd9386d1e765d13506b9f0104e769214afb247a21e0ce656017c720aa06774b594d33082fbefeda873382cefcf84e1fa4414

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

MD5 76025b9fb7201faad57e95ac873e37eb
SHA1 25c01eb7d9a63723eac365d764e96e45e953a5c1
SHA256 03bb8cf70d96e562ff19d80ef9a01f8255aaa1a6ffa2005dbc004bb718e05269
SHA512 6f5c8680823f3fc01c4668585518a1a535959ec456bca88f81eebe0484dc6cf6bbc40044db4ac7d18798529a20feca039bd986f243db817f27df220a7917a28f

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5167e226-3955-48e6-b767-10677ac81319.tmp

MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 1c732fc5573e3ec0af3984371ef30b12
SHA1 b046bf8f2602692f2a61162085438baddf068867
SHA256 3fec522394effc39963cb55309b3e22f6a170128360d80511baa35fe385ca514
SHA512 768a03d34376ca805358e3f18c82556afb00a7a35294a5ec40552d30b6fb04c88ec6cc627bc3f9da438c749db3c63bdcef2f4cfcd8f7092ff4ce30a9d2a8121d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

C:\Users\Admin\AppData\Local\Temp\chrome_default_cookies.txt

MD5 e432edb50fff6a3668e2a4939b02011c
SHA1 8699d208ccb8c9bffabb4f3ec895d62ef44fab78
SHA256 3af9a419b80f02b0e4582c2c2b6e38b00a42b37b832f0e220009370d0473fcb5
SHA512 b7543ae2f248c383883c9742762e9c68469ce5fbc39df51587b7e4d6136a1f132861b4fd1ad33d6b35dbef0a9d5e7564abab194d3586d23fc4bab248e5a825d0

memory/1756-1069-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1071-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1070-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1075-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1078-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1081-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1080-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1079-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1077-0x000001750E490000-0x000001750E491000-memory.dmp

memory/1756-1076-0x000001750E490000-0x000001750E491000-memory.dmp