crimsonrat | 90b37e700b2fbbf88391345f632c94759503a0ed672b92606feffdc21318ad85

Resubmissions

11/03/2025, 01:41

250311-b4hzyswlx2 10

Analysis

max time kernel
1050s
max time network
827s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20250218-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250218-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/03/2025, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VMX Spoofer.exe
Size

29.9MB
MD5

a1826565a642ea8a947af0bdc9e52fc4
SHA1

f645b91db259dbc3ed0188b43ba0a0eeb708fe45
SHA256

90b37e700b2fbbf88391345f632c94759503a0ed672b92606feffdc21318ad85
SHA512

bdc56afc7c2af7822718d13b6a085edf2e80fb836d997851ea7eb85b0cbe8f8135a88bbf6857ce60c2f27dd90ae93476599250e64cc55719524cb09a8f234b46
SSDEEP

786432:low/lmW8HfX3Oql8dPX4EpsfP/FcMnen:blmW0P3jlmPjpsXqM2

Score

10^/10

crimsonrat danabot adware aspackv2 banker defense_evasion discovery persistence privilege_escalation rat stealer trojan upx

Malware Config

Extracted

Family

danabot

51.178.195.151

51.222.39.81

149.255.35.125

38.68.50.179

51.77.7.204

rsa_pubkey.plain

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fagot.a.exe

CrimsonRAT main payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000027fb2-3866.dat	family_crimsonrat

CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
rat crimsonrat
Crimsonrat family
crimsonrat
Danabot
Danabot is a modular banking Trojan that has been linked with other malware.
trojan banker danabot
Danabot family
danabot

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit32.exe"	Fagot.a.exe

Modifies firewall policy service 3 TTPs 24 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	Fagot.a.exe

Modifies security service 2 TTPs 12 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters\PortKeywords	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\CONTROLSET001\SERVICES\MPSSVC\PARAMETERS\ACSERVICE	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	Fagot.a.exe

Blocklisted process makes network request 10 IoCs

flow	pid	Process
190	6188	rundll32.exe
191	6188	rundll32.exe
192	6188	rundll32.exe
194	6188	rundll32.exe
203	6188	rundll32.exe
205	6188	rundll32.exe
207	6188	rundll32.exe
211	6188	rundll32.exe
212	6188	rundll32.exe
214	6188	rundll32.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 26 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A604D2C-E968-429B-8327-62B5CE52126D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6BAF60B-6E91-453F-BFF9-D3789CFEFCDD}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{23A20C3C-2ADD-4A80-AFB4-C146F8847D79}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE4BC71D-A88B-4943-BB3D-AF9C0E7D4387}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7C028AF8-F614-47B3-82DA-BA94E41B1089}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{25FFAAD0-F4A3-4164-95FF-4461E9F35D51}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6EADE66-0000-0000-484E-7E8A45000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{990CB269-A600-38D0-B7D1-FBD392495F13}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	Fagot.a.exe

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	Fagot.a.exe

Downloads MZ/PE file 15 IoCs

flow	pid	Process
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe
147	4064	chrome.exe

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInfected_newest.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	SpySheriff.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	Fagot.a.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstallerRC.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInstaller.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mistdrv.sys	MistInfected_newest.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 48 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	Fagot.a.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2221	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AABA-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.12	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCTLUsage	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A42-8E59-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{6078065b-8f22-4b13-bd9b-5b762776f386}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2222	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{D41E4F1D-A407-11D1-8BC9-00C04FA30A41}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.12.2.2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.26	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2010	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.15	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.11	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.25	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{DE351A43-8E59-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{06C9E010-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{DE351A43-8E59-11D0-8C47-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{64B9D180-8DA2-11CF-8736-00AA00A485EB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{00AAC56B-CD44-11D0-8CC2-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.27	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{189A3842-3041-11D1-85E1-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{1A610570-38CE-11D4-A2A3-00104BD35090}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2223	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.11	Fagot.a.exe

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a000000027f9f-3658.dat	aspack_v212_v242
behavioral1/files/0x0009000000027fa1-3684.dat	aspack_v212_v242

Boot or Logon Autostart Execution: Print Processors 1 TTPs 2 IoCs

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

persistence

Print Processors

T1547.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\winprint	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors	Fagot.a.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\Control Panel\International\Geo\Nation	CrimsonRAT.exe

Executes dropped EXE 33 IoCs

pid	Process
3824	BlueScreen.exe
7052	BlueScreen.exe
6264	WinNuke.98.exe
6468	BlueScreen.exe
2328	DesktopBoom.exe
1672	Avoid.exe
3008	WinNuke.98.exe
5952	Launcher.exe
2776	DanaBot.exe
6248	DanaBot.exe
3024	CrimsonRAT.exe
568	dlrarhsiva.exe
4808	BlueScreen.exe
3316	Avoid.exe
4300	Avoid.exe
1784	Avoid.exe
6832	Launcher.exe
2444	Launcher.exe
5376	Launcher.exe
6800	Launcher.exe
2880	YouAreAnIdiot.exe
1016	MistInstallerRC.exe
4860	MistInstaller.exe
7036	MistInstaller.exe
6684	MistInfected_newest.exe
5656	MistInfected_newest.exe
5612	MistInfected_newest.exe
6864	MistInfected_newest.exe
3856	SpySheriff.exe
1092	SpySheriff.exe
5604	Fagot.a.exe
5464	Fagot.a.exe
6300	Launcher.exe

Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	Fagot.a.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe
2868	VMX Spoofer.exe

Modifies system executable filetype association 2 TTPs 54 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	Fagot.a.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost32 = "C:\\Windows\\system32\\dllhost32.exe"	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Fagot.a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Indicator Removal: Clear Persistence 1 TTPs 48 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\selfcert.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenote.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msqry32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoadfsb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sdxhelper.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msohtmed.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\orgchart.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onenotem.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoxmled.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosync.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msoasb.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\graph.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powerpnt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msosrec.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excel.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setlang.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\clview.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	Fagot.a.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	Fagot.a.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
146	raw.githubusercontent.com
147	raw.githubusercontent.com

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	Fagot.a.exe

Modifies WinLogon 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\DefaultUserName = "COCK_SUCKING_FAGGOT"	Fagot.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AltDefaultUserName = "COCK_SUCKING_FAGGOT"	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{FB2CA36D-0B40-4307-821B-A13B252DE56C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{cdeafc3d-948d-49dd-ab12-e578ba4af7aa}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{8A28E2C5-8D06-49A4-A08C-632DAA493E17}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{7933F41E-56F8-41d6-A31C-4148A711EE93}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{426031c0-0b47-4852-b0ca-ac3d37bfcb39}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{fbf687e6-f063-4d9f-9f4f-fd9a26acdd5f}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{e437bc1c-aa7d-11d2-a382-00c04f991e27}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{3610eda5-77ef-11d2-8dc5-00c04fa31a66}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions	Fagot.a.exe

Drops file in System32 directory 24 IoCs

description	ioc	Process
File created	C:\windows\SysWOW64\ctfmon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\logon.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\services.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\userinit32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\regedit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\shutdown.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntkrnlpa.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\systray.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wowexec.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\wuauclt.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\ntoskrnl.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\bootok.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\dumprep.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\imapi.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\recover.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\win.exe	Fagot.a.exe
File created	C:\WINDOWS\SysWOW64\userinit.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\autochk.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\alg.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\MDM.exe	Fagot.a.exe
File created	C:\Windows\SysWOW64\dllhost32.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\progman.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chkntfs.exe	Fagot.a.exe
File created	C:\windows\SysWOW64\chcp.exe	Fagot.a.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000028349-1156.dat	upx
behavioral1/memory/2868-1160-0x00007FF879AC0000-0x00007FF87A124000-memory.dmp	upx
behavioral1/files/0x0007000000027f13-1166.dat	upx
behavioral1/files/0x0007000000028307-1169.dat	upx
behavioral1/memory/2868-1170-0x00007FF88E1B0000-0x00007FF88E1BF000-memory.dmp	upx
behavioral1/memory/2868-1168-0x00007FF889200000-0x00007FF889227000-memory.dmp	upx
behavioral1/files/0x0007000000027f11-1172.dat	upx
behavioral1/files/0x0007000000027f17-1173.dat	upx
behavioral1/memory/2868-1175-0x00007FF8891E0000-0x00007FF8891F9000-memory.dmp	upx
behavioral1/files/0x00070000000282dd-1216.dat	upx
behavioral1/files/0x00070000000282db-1214.dat	upx
behavioral1/files/0x0007000000027f22-1213.dat	upx
behavioral1/files/0x0007000000027f21-1212.dat	upx
behavioral1/files/0x0007000000027f1b-1211.dat	upx
behavioral1/files/0x0007000000027f1a-1210.dat	upx
behavioral1/files/0x0007000000027f19-1209.dat	upx
behavioral1/files/0x0007000000027f18-1208.dat	upx
behavioral1/files/0x0007000000027f16-1207.dat	upx
behavioral1/files/0x0007000000027f15-1206.dat	upx
behavioral1/files/0x0007000000027f14-1205.dat	upx
behavioral1/files/0x0007000000027f12-1204.dat	upx
behavioral1/files/0x0007000000027f10-1203.dat	upx
behavioral1/files/0x000700000002837a-1202.dat	upx
behavioral1/files/0x0007000000028370-1200.dat	upx
behavioral1/files/0x000700000002836f-1199.dat	upx
behavioral1/files/0x0007000000028364-1198.dat	upx
behavioral1/files/0x0007000000028363-1197.dat	upx
behavioral1/files/0x000700000002834d-1196.dat	upx
behavioral1/files/0x0007000000027f0d-1195.dat	upx
behavioral1/files/0x0007000000027f0c-1194.dat	upx
behavioral1/files/0x0007000000027f0b-1193.dat	upx
behavioral1/files/0x0007000000027f0a-1192.dat	upx
behavioral1/files/0x000700000002831e-1191.dat	upx
behavioral1/files/0x0007000000028317-1190.dat	upx
behavioral1/files/0x0007000000028311-1189.dat	upx
behavioral1/files/0x0007000000028310-1188.dat	upx
behavioral1/files/0x000700000002830f-1187.dat	upx
behavioral1/files/0x000700000002830e-1186.dat	upx
behavioral1/files/0x000700000002830d-1185.dat	upx
behavioral1/files/0x000700000002830c-1184.dat	upx
behavioral1/files/0x000700000002830b-1183.dat	upx
behavioral1/files/0x000700000002830a-1182.dat	upx
behavioral1/files/0x0007000000028309-1181.dat	upx
behavioral1/files/0x0007000000028308-1180.dat	upx
behavioral1/files/0x0007000000028306-1179.dat	upx
behavioral1/files/0x0007000000028303-1178.dat	upx
behavioral1/memory/2868-1176-0x00007FF888F70000-0x00007FF888F9B000-memory.dmp	upx
behavioral1/memory/2868-1218-0x00007FF888F50000-0x00007FF888F64000-memory.dmp	upx
behavioral1/memory/2868-1220-0x00007FF879580000-0x00007FF879AB3000-memory.dmp	upx
behavioral1/memory/2868-1224-0x00007FF889D70000-0x00007FF889D7D000-memory.dmp	upx
behavioral1/memory/2868-1229-0x00007FF888A70000-0x00007FF888B3E000-memory.dmp	upx
behavioral1/memory/2868-1228-0x00007FF879AC0000-0x00007FF87A124000-memory.dmp	upx
behavioral1/memory/2868-1227-0x00007FF888EF0000-0x00007FF888F23000-memory.dmp	upx
behavioral1/memory/2868-1223-0x00007FF888F30000-0x00007FF888F49000-memory.dmp	upx
behavioral1/memory/2868-1232-0x00007FF888EE0000-0x00007FF888EED000-memory.dmp	upx
behavioral1/memory/2868-1231-0x00007FF889200000-0x00007FF889227000-memory.dmp	upx
behavioral1/files/0x00070000000282f2-1233.dat	upx
behavioral1/memory/2868-1234-0x00007FF888C60000-0x00007FF888C6B000-memory.dmp	upx
behavioral1/memory/2868-1236-0x00007FF888980000-0x00007FF888A33000-memory.dmp	upx
behavioral1/memory/2868-1235-0x00007FF888A40000-0x00007FF888A68000-memory.dmp	upx
behavioral1/memory/2868-1238-0x00007FF888970000-0x00007FF88897F000-memory.dmp	upx
behavioral1/memory/2868-1237-0x00007FF888F50000-0x00007FF888F64000-memory.dmp	upx
behavioral1/memory/2868-1243-0x00007FF888940000-0x00007FF88894B000-memory.dmp	upx
behavioral1/memory/2868-1250-0x00007FF880510000-0x00007FF88051E000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\NOTEPAD.EXE	Fagot.a.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Fagot.a.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1452	2776	WerFault.exe	170
2524	6248	WerFault.exe	178
6424	2880	WerFault.exe	213

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInstallerRC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MistInfected_newest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BlueScreen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DanaBot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Device Parameters	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	Fagot.a.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Fagot.a.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000	Fagot.a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	Fagot.a.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	Fagot.a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	Fagot.a.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	Fagot.a.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\DragDrop\{9da1d2cb-796d-4bec-bbaa-0aa9ccd80e15}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BCC-3C52-11D0-9200-848C1D000000}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{812AE312-8B8E-11CF-93C8-00AA00C08FDF}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{80F49562-6A9A-11d2-875F-00A0C93C09B3}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Capabilities\Roaming\TabRoaming	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4A5869CF-929D-4040-AE03-FCAFC5B9CD42}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3604EC19-E009-4DCB-ABC5-BB95BF92FD8B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1141B704-053E-11D0-9DF0-00C04FD7BF41}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00021401-0000-0000-C000-000000000046}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6f.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{57F02779-3D88-4958-8AD3-83C12D86ADC7}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{438DA5E0-F171-11D0-984E-0000F80270F8}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\5F3EF8894394826345EB838C8C72F3A40B521893	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6p.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Capabilities\Roaming\FullScreenAllowSites	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D940285-9F11-11CE-83FD-02608C3EC08A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{80CB7887-20DE-11D2-8D5C-00C04FC29D45}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6E227109-F799-11CF-9227-00AA00A1EB95}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{EEE78591-FE22-11D0-8BEF-0060081841DE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B9D029D3-CDE3-11CF-855E-00A0C908FAF9}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\392495FF02597715601FD2C4AE18D00261A01C62	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm6z.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\AUTOAPPEND	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E1A26BBF-26C0-401D-B82B-5C4CC67457E0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{27A3D328-D206-4106-8D33-1AA39B13394B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\DE9132D488A64BA12FC5570359923764E37A50A6	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm5y.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2dec4925-1312-4d7f-a6f5-89272d848dcf}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Feed Discovery	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm7i.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\RunDLl32Policy\cnmsm72.dll	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{4E7BD74F-2B8D-469E-8CB2-BC60BB9AAE22}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6f9f3481-84dd-4b14-b09c-6b4288eccde8}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Transitions	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\CARETBROWSING	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BA162249-F2C5-4851-8ADC-FC58CB424243}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7057e952-bd1b-11d1-8919-00c04fc2c836}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6F750201-1362-4815-A476-88533DE61D0C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0C378864-D5C4-4D9C-854C-432E3BEC9CCB}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FF371BF4-213D-11D0-95F3-00C04FD9B15B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{AD5FBDB8-C518-47F7-B4F1-F1F58D21A716}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{81361149-FAF9-11D3-B0D3-00C04F612FF1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{37de7045-5056-456f-8409-c871e0f8b0e0}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35cec8a3-2be6-11d2-8773-92e220524153}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{CC7E636D-39AA-49B6-B511-65413DA137A1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FB7FE605-A832-11D1-88A8-0000E8D220A6}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4CECCEB1-8359-11D0-A34E-00AA00BDCDFD}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8136114D-FAF9-11D3-B0D3-00C04F612FF1}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{73BCFD0F-0DAA-4B21-B709-2A8D9D9C692A}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6980ACA5-CFB6-11D0-BF8B-0000F81E8509}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{49638B91-48AB-48B7-A47A-7D0E75A08EDE}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{22FD7C0A-850C-4A53-9821-0B0915C96139}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{17E3A1C3-EA8A-4970-AF29-7F54610B1D4C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{fb9e068b-c612-4fa8-bdb9-d728a716a420}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{C08DF07A-3E49-4E25-9AB0-D3882835F153}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Compatibility\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}	Fagot.a.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-556327730-4249790997-552795783-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "www.blacksnake.com"	Fagot.a.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133861309591356466"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020820-0000-0000-C000-000000000046}\DataFormats\GetSet\3	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.SlideShow.12	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BDCE735-A077-406B-B526-F1465DD4D35C}\InProcServer32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.OpenDocumentText.12\Protocol\StdFileEditing\Verb	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MOV\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKV\shell\Enqueue	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.wvx\shell\AddToPlaylistVLC	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogx	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7FAC3690-46D1-49CD-8793-5690439DDC8B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EFC9437E-3A57-487C-8471-9151D2FC1832}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9D55726D-813E-50FB-9498-87AA872DD6CA}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9570E3C8-3B3D-3029-B960-AA478C2A65A2}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LayoutFolder\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ans	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4B2E957D-0393-11D1-B1AB-00AA00BA3258}\1.0\0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{708860E0-F641-4611-8895-7D867DD3675B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{56B47D6C-2795-39D8-8B21-CDCC7BE7ECBD}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\odtfile\shell\print	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\group_wab_auto_file\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{55CF8FA7-7035-4B80-80CE-51AEB5DE7CFC}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17F0819E-243F-4A96-9AFF-F6BF54E0468D}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.eip	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AdHocReportingExcelClientLib.BusinessBarActiveX\CurVer	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4F55F4-8F87-4D47-80BB-5808164BB3F8}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\VersionIndependentProgID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EBC7FDE1-6899-11CE-80C0-00AA00611080}\11.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dothtml	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54B61A02-4823-42EC-9648-A9AE80CDA270}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{104B85DF-0B7D-353A-AE6F-52BBD5FB1F9B}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\FaxCover.Document\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mpga\shell\Open	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Template.8\shell\Print	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.raw	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30590097-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\VLC.mod\shell\PlayWithVLC\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Search.AppContentFilter	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSOLAP	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\PDXFileType	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{52027082-0B74-4648-9564-828CC6CB656C}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{51973C59-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Template.8\shell\ViewProtected\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SharePoint.DragUploadCtl.1	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\CLSID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.SLK\shell	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\OpenWithList\IExplore.exe	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{61D986EC-1EAC-46B6-90FF-402A008F15D1}\ProxyStubClsid32	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.mhtml\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\themefile\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Office.Query\CurVer	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\odcdatabasefile\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSHelp.hxk.2.5\DefaultIcon	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\CLSID	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.rar\shell\open\command	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30510760-98B6-11CF-BB82-00AA00BDCE0B}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\NumMethods	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA7BAE70-FB3B-11CD-A903-00AA00510EA3}\Insertable	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{7EB9A8BD-3300-3492-A540-5F3AAF2F55C6}\15.0.0.0	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{FEB50740-7BEF-11CE-9BD9-0000E202599C}	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\calculator\shell\open\command	Fagot.a.exe

Modifies system certificate store 2 TTPs 60 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7E04DE896A3E666D00E687D33FFAD93BE83D349E	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\51501FBFCE69189D609CFAF140C576755DCC1FDF	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\B68D8F953E551914324E557E6164D68B9926650C	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates\F8DB7E1C16F1FFD4AAAD4AAD8DFF0F2445184AEB	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates\D73F0C22273FA4C717A3A735F7E992F31190F010	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates\11194FAB14616ED8259FB94DCD17CE99DAB04CDD	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\31F9FC8BA3805986B721EA7295C65B3A44534274	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates\2BD63D28D7BCD0E251195AEB519243C13142EBC3	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\92B46C76E13054E104F230517E6E504D43AB10B5	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates\CE97FCF4ABACBFC662AF418EA1D4862F951D3D5D	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates\9E78FB9F9527D859700D303DFA589B3073951DCB	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates\8A334AA8052DD244A647306A76B8178FA215F344	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates\2C85006A1A028BCC349DF23C474724C055FDE8B6	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedDevices	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\WindowsServerUpdateServices	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06F1AA330B927B753A40E68CDF22E34BCBEF3352	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs\27748148BBE67A43CDBFEC6C3784862CE134E6EA	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\FlightRoot\Certificates\6CA22E5501CC80885FF281DD8B3338E89398EE18	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot\Certificates\A4B37F4F6DE956922273D5CB8E7E0AAFB7033B90	Fagot.a.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
5308	chrome.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe
5464	Fagot.a.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2328	DesktopBoom.exe
5952	Launcher.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
2732	Process not Found
5356	Process not Found
4412	Process not Found
5176	Process not Found
2768	Process not Found
1168	Process not Found
4440	Process not Found
5688	Process not Found
4836	Process not Found
4416	Process not Found
6328	Process not Found
6408	Process not Found
6416	Process not Found
780	Process not Found
5360	Process not Found
796	Process not Found
5708	Process not Found
1680	Process not Found
5816	Process not Found
5044	Process not Found
4264	Process not Found
5852	Process not Found
2664	Process not Found
5824	Process not Found
5848	Process not Found
5732	Process not Found
4460	Process not Found
996	Process not Found
4036	Process not Found
2128	Process not Found
5776	Process not Found
5820	Process not Found
5804	Process not Found
2944	Process not Found
5324	Process not Found
5412	Process not Found
4544	Process not Found
5900	Process not Found
5692	Process not Found
4712	Process not Found
5272	Process not Found
5932	Process not Found
2780	Process not Found
3772	Process not Found
6560	Process not Found
4820	Process not Found
4672	Process not Found
5028	Process not Found
4532	Process not Found
3256	Process not Found
3704	Process not Found
384	Process not Found
3280	Process not Found
4492	Process not Found
1840	Process not Found
4828	Process not Found
2964	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2868	VMX Spoofer.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe
Token: SeCreatePagefilePrivilege	3036	chrome.exe
Token: SeShutdownPrivilege	3036	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3036	chrome.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe
3260	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3036	chrome.exe
5952	Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2868	2880	VMX Spoofer.exe	84
PID 2880 wrote to memory of 2868	2880	VMX Spoofer.exe	84
PID 3036 wrote to memory of 2612	3036	chrome.exe	91
PID 3036 wrote to memory of 2612	3036	chrome.exe	91
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 2996	3036	chrome.exe	92
PID 3036 wrote to memory of 4064	3036	chrome.exe	93
PID 3036 wrote to memory of 4064	3036	chrome.exe	93
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94
PID 3036 wrote to memory of 3836	3036	chrome.exe	94

System policy modification 1 TTPs 13 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard\ExceptionFormats	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\UIPI\Clipboard	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Fagot.a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	Fagot.a.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VMX Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\VMX Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\VMX Spoofer.exe
  "C:\Users\Admin\AppData\Local\Temp\VMX Spoofer.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff877bbcc40,0x7ff877bbcc4c,0x7ff877bbcc58
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2184,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3128 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3664,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4404,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4028 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4464,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4920,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4992,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4880,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5136,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:6652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5128,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5340,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5252 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4428,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5156,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:6480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5868,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5856,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:6112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5864,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4548 /prefetch:8
  2⤵
  PID:4140
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3824
- C:\Users\Admin\Downloads\BlueScreen.exe
  "C:\Users\Admin\Downloads\BlueScreen.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5912,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5688,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3104,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6024,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5996,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:6604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6012,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3348,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:6732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3228,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:6784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3352,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:7000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6064,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3344 /prefetch:8
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6084,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3260 /prefetch:8
  2⤵
  PID:6996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3216,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3160 /prefetch:8
  2⤵
  PID:7016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6432,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:6668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5184,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5064,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3280,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6292,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6204,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3240,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3328 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4456,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:6776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6384,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:6868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6412,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:6928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3340,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5904,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3144,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:6656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6224,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:5460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6460,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6316,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:6324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6076,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6220,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6568,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:6680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5396,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6556,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6032,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6392,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=1512,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6320,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6060,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3396,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5328,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6092 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6236,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=3532,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6072,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3324,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1100 /prefetch:8
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4560,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5384,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4036 /prefetch:8
  2⤵
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6408,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6424,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:6428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3688,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6348,i,18027213175863583871,2988531068783851140,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:4340

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5436

C:\Users\Admin\Downloads\WinNuke.98.exe
"C:\Users\Admin\Downloads\WinNuke.98.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6264

C:\Users\Admin\Downloads\BlueScreen.exe
"C:\Users\Admin\Downloads\BlueScreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6468

C:\Users\Admin\Downloads\DesktopBoom.exe
"C:\Users\Admin\Downloads\DesktopBoom.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:3260

C:\Users\Admin\Downloads\Viruses\Avoid.exe
"C:\Users\Admin\Downloads\Viruses\Avoid.exe" C:\Users\Admin\Downloads\Viruses\BlueScreen.exe C:\Users\Admin\Downloads\Viruses\CrimsonRAT.exe C:\Users\Admin\Downloads\Viruses\DanaBot.exe C:\Users\Admin\Downloads\Viruses\DesktopBoom.exe C:\Users\Admin\Downloads\Viruses\Launcher.exe C:\Users\Admin\Downloads\Viruses\MadMan.exe C:\Users\Admin\Downloads\Viruses\WinNuke.98.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672

C:\Users\Admin\Downloads\Viruses\WinNuke.98.exe
"C:\Users\Admin\Downloads\Viruses\WinNuke.98.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008

C:\Users\Admin\Downloads\Viruses\Launcher.exe
"C:\Users\Admin\Downloads\Viruses\Launcher.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5952
- C:\Users\Admin\Downloads\Viruses\Launcher.exe
  C:\Users\Admin\Downloads\Viruses\Launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6832
- C:\Users\Admin\Downloads\Viruses\Launcher.exe
  C:\Users\Admin\Downloads\Viruses\Launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2444
- C:\Users\Admin\Downloads\Viruses\Launcher.exe
  C:\Users\Admin\Downloads\Viruses\Launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5376
- C:\Users\Admin\Downloads\Viruses\Launcher.exe
  C:\Users\Admin\Downloads\Viruses\Launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6800
- C:\Users\Admin\Downloads\Viruses\Launcher.exe
  C:\Users\Admin\Downloads\Viruses\Launcher.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6300

C:\Users\Admin\Downloads\Viruses\DanaBot.exe
"C:\Users\Admin\Downloads\Viruses\DanaBot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe -s C:\Users\Admin\DOWNLO~1\Viruses\DanaBot.dll f1 C:\Users\Admin\DOWNLO~1\Viruses\DanaBot.exe@2776
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2708
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\DOWNLO~1\Viruses\DanaBot.dll,f0
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:6188
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 468
  2⤵
  - Program crash
  PID:1452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2776 -ip 2776
1⤵
PID:4388

C:\Users\Admin\Downloads\Viruses\DanaBot.exe
"C:\Users\Admin\Downloads\Viruses\DanaBot.exe" C:\Users\Admin\Downloads\Viruses\DanaBot.dll
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6248 -s 152
  2⤵
  - Program crash
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6248 -ip 6248
1⤵
PID:1952

C:\Users\Admin\Downloads\Viruses\CrimsonRAT.exe
"C:\Users\Admin\Downloads\Viruses\CrimsonRAT.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3024
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:568

C:\Users\Admin\Downloads\Viruses\BlueScreen.exe
"C:\Users\Admin\Downloads\Viruses\BlueScreen.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4808

C:\Users\Admin\Downloads\Viruses\Avoid.exe
"C:\Users\Admin\Downloads\Viruses\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3316

C:\Users\Admin\Downloads\Viruses\Avoid.exe
"C:\Users\Admin\Downloads\Viruses\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4300

C:\Users\Admin\Downloads\Viruses\Avoid.exe
"C:\Users\Admin\Downloads\Viruses\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1784

C:\Users\Admin\Downloads\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1196
  2⤵
  - Program crash
  PID:6424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2880 -ip 2880
1⤵
PID:6888

C:\Users\Admin\Downloads\MistInstallerRC.exe
"C:\Users\Admin\Downloads\MistInstallerRC.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1016

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4860

C:\Users\Admin\Downloads\MistInstaller.exe
"C:\Users\Admin\Downloads\MistInstaller.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:7036

C:\Users\Admin\Downloads\MistInfected_newest.exe
"C:\Users\Admin\Downloads\MistInfected_newest.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6684
- C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe
  "C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5656

C:\Users\Admin\Downloads\MistInfected_newest.exe
"C:\Users\Admin\Downloads\MistInfected_newest.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5612
- C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe
  "C:\Users\Admin\AppData\Local\Temp\MistInfected_newest.exe"
  2⤵
  - Executes dropped EXE
  PID:6864

C:\Users\Admin\Downloads\SpySheriff.exe
"C:\Users\Admin\Downloads\SpySheriff.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3856
- C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe
  "C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1092

C:\Users\Admin\Downloads\Fagot.a.exe
"C:\Users\Admin\Downloads\Fagot.a.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5604
- C:\Users\Admin\AppData\Local\Temp\Fagot.a.exe
  "C:\Users\Admin\AppData\Local\Temp\Fagot.a.exe"
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies WinLogon for persistence
  - Modifies firewall policy service
  - Modifies security service
  - Boot or Logon Autostart Execution: Active Setup
  - Boot or Logon Autostart Execution: Port Monitors
  - Event Triggered Execution: Image File Execution Options Injection
  - Manipulates Digital Signatures
  - Boot or Logon Autostart Execution: Print Processors
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Indicator Removal: Clear Persistence
  - Installs/modifies Browser Helper Object
  - Maps connected drives based on registry
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - System policy modification
  PID:5464

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe 00000140 00000084
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Port Monitors

T1547.010

Print Processors

T1547.012

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Safe Mode Boot

T1562.009

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Hdlharas\dlrarhsiva.exe

Filesize
9.1MB

MD5
64261d5f3b07671f15b7f10f2f78da3f

SHA1
d4f978177394024bb4d0e5b6b972a5f72f830181

SHA256
87f51b4632c5fbc351a59a234dfefef506d807f2c173aac23162b85d0d73c2ad

SHA512
3a9ff39e6bc7585b0b03f7327652e4c3b766563e8b183c25b6497e30956945add5684f1579862117e44c6bac2802601fc7c4d2a0daa1824f16c4da1fd6c9c91a

Download Submit
C:\ProgramData\Hdlharas\mdkhm.zip

Filesize
56KB

MD5
b635f6f767e485c7e17833411d567712

SHA1
5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

SHA256
6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

SHA512
551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
f961101bfa6f4bb812a9b76feefa0664

SHA1
1c6423111a7bffe2c9c9fc25d46407c1ea3ff294

SHA256
f278cd78a100ad1ce080ebec2510198c8839ed71638ca79e2be30e5eb81c2451

SHA512
13ea9efda3b187a1d361ff4ca9afcf52c5812a3bf651c2b7931dbaf6519ec0e17660837ad224c40abf14aac3fced0380012cdefd2f3e6af5f838ae21dd5a4e43

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008

Filesize
215KB

MD5
786c4894e2393c2a6df8fe0fd6aeee3f

SHA1
2242cd681f699ef3d642ed9ed1f202dbf6b0c1b0

SHA256
258ce3bda497a9ddf8e00e70ab2b08608c3f3211aecc90348179eea95be084a4

SHA512
73751c1624a8a7e8141c387159a700f637e4fed6f5974d7402fc4faf4dd72c0779eae74049746098ad2c05765fa97329c51e9cc5f422c02abaaa92035aa991db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e458d2ef255a3d0013a71107d9f3b017

SHA1
207b3962e3de6560fabcdafbf094fd79f8e91018

SHA256
845d1557fde778341ca76a904c99be36eaa8c58fae58084bdfccad8f251bd9ad

SHA512
ac9f02d1c87f5c50d38068df9e9bdfd093f55ae80dd3324e385618421231255cfdaa029b5fce31052d38acdc93e267f76205b36252c35ffa0532ccec31bf8952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.89.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
5KB

MD5
3e32bda823b594f90cc7f9e7a7019dea

SHA1
b72c314a3b2fda6700f6866031fa85448833e556

SHA256
b8829929cc941dcdc1aae79e8a4ab0414e431269d401ca4659d04238d96de76d

SHA512
a718b8e8cf743a842eece234a07f55e7bc4162d016fa6bcd302201eb542d6490cd1356a2a84530e5dec5c40f4f853dda45994f4e55e74108ad7ead0111b00585

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
eec0efe5c6b5c26a3b8af936def82cca

SHA1
ad1930c0d67afd7a475c144e19598fecc2e64792

SHA256
70e0c8691e17a35d48b75a7d416cfcf77afd2acec860a946fcaaf1623b6fa975

SHA512
7d2e9c7e82d2d2c2d83e500fabeae5940959a54df38588ab0a54fd607c275a6e237eaef7fb25734c44120f7d33886c616923b9cb37e1f7b3b6b38e719b239dfb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
043eee2fda7f2f29adceaf9ef565936e

SHA1
0af2c9c623814e75ad9a568b42a0aee62e9adb78

SHA256
5ae134f56713a427917b33e44b251acc11a63c804f3070fa2d86bdd50659f88e

SHA512
2435bea13019142d035ad21e9e4bd3e206d65b327c2f4d1763a5a86d25e65db8f92d0cc198ddce5f10a28cd04fd95b4ad445dc1759e35a64e407456c47615bee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6f63be1f114489688adf5455be7d350d

SHA1
e7417102b0ea4fdb36b6ed1cd8ec94dc25afd032

SHA256
2b824389eb6c3f07aec94b622aabe4af0f69376e9efa8318b8c68e1c1cb9c77a

SHA512
cd27dfae38e6aaaf68d1536efc3da497791170744fc7bd0b308655a143e04d7a6798f17a41a42a7504bfef38ad33b6f95d21dc3d75f2b79cfef7e014292bef4a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
621a83824922f8274377c3d2e00dc162

SHA1
28f565c5e0260a4c07d24f1d6d378ca645b0a14d

SHA256
b08b9ea215f9258ae2d2d1b8b762d4bfb6ff2c94454b686f1055fe8bda5c78c0

SHA512
c50fd4878fe6a4b38f3252166ca2b6402b7ac3e4eb2077be6e993acb64665b70cb1563be577e4bacd5e394bc7fb836e8202a17d3fa7b274698a3f58e0ebee251

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
540da808ee396d2312496ce8c30f0aa1

SHA1
1ab975779c44b0eb1fe3a4719c44f2663ce1caf0

SHA256
3e503e280ae842b527ed0f11775599b1875e3c820e558f613440002100fc6060

SHA512
d63e5db1aabe273a4a9e31280e41ab5c586ef5b51cd598ec6593cc1e312d54f880e18213cfe1269057113f6862d7165f96acb45d4038cd21973e552c01143102

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
67f846e230c6a6cac8a0d00ad44309e4

SHA1
cf23201f3b247a4ae23b05cde72892226574af0f

SHA256
9a47967fc9994fb42f0084a7c8e5b29e422980895fde74f4a235f382519e84d3

SHA512
56c5b444b577c44815bff1dfd07c3b1e0b010a60b2870d4da6d5795679854987b8eb712ba96e0f1bf7fabfe06a235850cec664465191b175f8a0c259ae61ca61

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
24f7e8f239908de7b1a12df0409cc4d6

SHA1
ac444b12a3d18d95489f42946b73f24ede62d40f

SHA256
d81d0686eacc26bc4d85ce065a830e154a4c9b2c261402164c7e5125d442de1c

SHA512
f99c0efd4d980ac39f77cb5542124fa538c390ae853796e7649be79ebdc6f0be4cd61a2dbd0f2012e8710308f2845d05b365e8e2bf2254258c17a90ee0e9ca5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
483c9280a9688d213caa12442cd10284

SHA1
29d8e8546d6544a05a499f57ccf60693e591fb38

SHA256
f33d4d3aae0397d0c65bba5154372882db60fb8ebabc948bb5508cda06b8e1d2

SHA512
51f5274c873bdbd0cede8ce64b17c8e8a7fea652fb57e7c58eecb8896ecd6e556ec5c33bbe10a64dacb432be60fdf95a0bb3d8df99bcb84107dbbc0c241075e8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b1ba265e1c38ad98595bfd4a7a9dc7be

SHA1
e89a053e670a4dec5348bc8993942693ded0a7b6

SHA256
2851c1b387f0a8f76128370db1dfb15f810564fa61899f6b8ffca3b26f7330a6

SHA512
ff0c36cb767618094a0174e6dbacb7c276188ebeb19584b6b730f004e97a9bb95f7cb006a0f88540376c8b579d5dedba7aa7104ff18b5411f4b6d1acb7bb2565

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b43306eeb75d905557240bdda9bcfca6

SHA1
3acf5b1ae91f945d94dc31e094a01e5721974c7a

SHA256
d8e9b5806803d4c25ad06de4769747128bd135aac532254159f181f099e567aa

SHA512
2e58c404e4e9c8dbfd169b6793636c9114b3bd83fb4d2ff21e8a6a0834cca462d8884254ccf1ae98e79ccef5a8dead788c7b60ac72df827ab8fa8b4dfa7d342a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
96c89d3c30f2e3525b91ad0958c82d10

SHA1
0da7055fd8a0e7f145b6a7171fa80170f0ff05ae

SHA256
f6218cdedb4fe096970306dfa80c26e84f8c238cd1baf45fc85560a463ad2bd3

SHA512
9af10c6a14fe5729aebe71f4efbee820c3b0834405d97f876510dabbf3960fab1c681ff8d8da6e4bd91f9afb2e2920fab6fba1ee32eb8557b63883238a387a7d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
609974722032f88bdfda0580a6b78423

SHA1
41c2b44aca741282e8d8b514d6b7535739a137ee

SHA256
e1cabcf394172f21d213bdd1bac350975f1592998fb8706a198fbcb638e468c9

SHA512
d8566d2d36e41587231712c87a2f30f698e265dbe545775db103a9cbbd1b23be0b60738af4a793702bbfcd89c8b08ad8ca9567a023cc0f22fa382152476f9343

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
248e0a4a3690a4b346214e6c7c5d4878

SHA1
fcd28cd06c03fe19b3a3cf2330b97cd032d79aaa

SHA256
d251340cad1c31afa15c9454c79ebfbc0713b085a6f2a155d67302a738380bb3

SHA512
1d145f0449db4c94a21396622fba5dca3c0cd6e13eac77882753aa1388eca4db8243607d159732f7b64981d335241df2422f1b90850c92ee9d79403885bb22ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9a185a226926298d3e5e7be797f4d1ec

SHA1
d9344b9cb4454c04fd2d7c29c14dd40b9a82bfbb

SHA256
e821928a030048efe43b0f5eed39a0a6722536f9519762b394600711a349f978

SHA512
4ba46edb833658acdae34c1416322feb64b82b849e7f2171e822fa4a1638e8b2d581070c87b6a3df55f7909356d0dd14b01886c05ca19e45d1896218fab2c8c4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c4c309bc126282fd75489ac3d3b99438

SHA1
c11d03f586c3fae33f5a0436bba86a8d0135f868

SHA256
78901ab306e8691fe1316355679351879ceef0e15bb4b087c46f3a59dd45510c

SHA512
bbe28a375a090e4dc66bba14c9c210bbe1109d28496c5514442afbdec1c613a5e4a81b11d72c6214ef9eff06b1b2f3934ba71b0748b234fffeb33f3844b70c9f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
46a7acd3c31667276ce64685bc79769b

SHA1
0648cd3cae5bdbcc9bab8b4636f3103e6dabcae9

SHA256
e37f27c160dc2469c8b9ce5b16b104eb8bfe9bf3cc4de7bb26d23f383435a97d

SHA512
8603c58f37f45cbb5d3024197b56ac47723f2f582aff9b5ff56a7335680ee1d3f962151c56698397bc24067854fd19f8e38eadc8338f65293cf46e61102f0042

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
befbfc43316150b8ae362979398d18b0

SHA1
64f293ac5e275e0cc3ac381adeb4fbb590672849

SHA256
1cc3b7bf442a3b9151d8df39176b2b0c26a59654856f82c4c03935733bba2737

SHA512
03d9960c18bca5c28152a6c8e8fa15823344b7e5514cc57db9ca9e589db92f128a120657566e0944fafe38a880734d328ee7df5180b2fac62c31307371ff904f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
04950f102b78b19dbe66f71ba6b88ddd

SHA1
dc2a01c25ecf1c55947235abb1d987b64e2fe73c

SHA256
bd5f942c0ef74d06ae2054f7e610b826e05243f7c17562a3d7f9427f9734c057

SHA512
fb66ed5f12b9f20bd33eb9bbb845c3056fcc4d8a70acfeb58fffb81d35b7b3119dcaadf483375083e76962e0f40cc1cfb4e810e50dcaf7d54bf9b925ab0d35e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
272e6cbe14180054a667fd2637b716fb

SHA1
23f946934d2adb109d2c1b4cdc624838c7ba7026

SHA256
44b0801285d07218b31887086465480b7012b2a6384474ffbc6ad7fba8eb2858

SHA512
7fcf50ef48b3853ddcf5c70d0760fd7588d6ea993cb86e3222468461bcb96d6e60dae66593cefe51a3616aad1d36f9a715a4d75c233dc6566eda3ffc81abdad6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
d8d5df8035e2f1d85dba42a94335f489

SHA1
fa99cd9d107581c8c7f326a1c4f0b377a49bcc9e

SHA256
95ad4537652fc8565ee09eee7bdd5d14171bf71ccf74e31543c2a7c5c27d9023

SHA512
dcc543bc6b0be72682b44b814ce18517da6d145a14887894ba9434d2d427c5cd5b37765bcd615aaa213d515553007be77fc3d7b5326d577bfaaf42c4febd2373

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b7fda4b5cc49c7ee775a7e4a566e95a7

SHA1
e55191b96cb034840874eb2e98cd2ac6c27a2ed4

SHA256
7bab590162009b5d2e2dfb9ec7356ed381c5f54e3f916a18a215a1c17719e66a

SHA512
856143892148b42831d38c62d74e285b6a4ac90cf461e33c6d0168e33128f230b3d7981810bfd174d7516598aedc9abe6a8dda00b5dc19892c2a643c88e97efe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
2d6068ec660ce6f3924892453c1da5f3

SHA1
2e949e2ab2c9dea8d8d2356df7219cf34cd8cada

SHA256
5bb75d9d1d3eb13979ec091ba045987b686aeaf60b826e49d5b1e0cb9160ca0d

SHA512
550ecfd2ebc5faf53573b6afce5456e49eca2bbc5a81bdea955c40af32144e17945be934bd289dc2f8cd747f282ad70961776d9801e5fa89d8ec484e53b68ccf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
10ba5a6e94e816b82aa09c3d5793f019

SHA1
240c5c0f614773932c5731b0917eb438235e7690

SHA256
f1454965ac4275a66eb3905a389bc9c845df9a72ee4c9222cdc48d40b8683c0f

SHA512
0a4d85add641694b14577cbce7f6f3e46c25d85be0f4c7dc092b97347e208c02a1e6c54af5d16366bb318624d37657792cb1341b36f4782ef45cddd848164dca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
78b2b83efa65881847c97d63523938de

SHA1
25f0fbe35d8b2b7fbdabd67af963dc5088e2bb92

SHA256
03a64c06c60d1f0c579433b6e815a9ded6d42d8f2122a9a458ca72e0d4b2a5d5

SHA512
24d783c2aa6045daf454172289b38da9b4a659dc39b4ff13dc4f9cb9e61e9a1dea09f7ec2a67e7ad75a3636ef91c94c21b4c5cf242080997a86bd8cfede7fc1a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
6680f6948ee2d48c915a277186bc9108

SHA1
13ec5a78dddbf358b45d7ecc2e4123c0f9dffe4f

SHA256
645015297e51c66b7974a7cfcc9c439e9f787e7c4b6931f3cb0dd7691669289d

SHA512
7df052995cec2becf343ef95b8b66ba60c98b26a7a09e225430b76c1c534479c902e3e934b4d459dcf54a5c0382ea704482e2e367c100749eeb91623c7c3709b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b4fac132fa652210ab0c3874710e216f

SHA1
2374595859e3e77700cc4870612e723c7c88add4

SHA256
efdd9c86bc8a8c4e9d4cd334045f1101b6a225b625183caa27b3607a0530cd93

SHA512
0e651d822cd016d24b35f6b6f11beb83eb2854d422221361256664dd6b14270a92f669bfc82794694ee4f6fd452d02a76dff1a36d8a06150f5a0365b02762c53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
473225cbe815d4de381d0fcd52739036

SHA1
5025be1cd0efcc2eb903f62207bd7f3dd5f77d31

SHA256
0ca4477d8041b590734c0a8e6126f019a45cc22454f2457dbe8c74bb12436f8d

SHA512
77aef248cb19fc30420fe5cdb71ca16ecae28e5d35ac56414aa6b2c0472febd5f30dab4b2627fea8e186b9223b31091b341d82cd326c86f851ead9cc1c1d2304

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
647c50d2feca032fca3b5492853ccaed

SHA1
8e66e404b724ca6b105408c009b9effdd009abbe

SHA256
7058c22ab4badd82e7aea1193fef8ad5bedd51b881076d56441cf538156a8b0b

SHA512
dfee50a6ccac103a02e982539691636e4698f5b3d35405cbdf2fe7b9a676f35bbb49eafb5186a7ac8f69384e72d8a94fdf8edf82ec5a08a260c780cf0e4700a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
bcd3f46b7a000067e69ba474f60bfa35

SHA1
1d9ec551c58d9cd288dd722e7b4ce7b4bb59e576

SHA256
dd7862d0c803c72a8c071b07de3f52c6fe3ba5b768432d0597090134e377e351

SHA512
1c72dfbdd1f8df68358c82a4c9e4ff37475b4d112ed6e8552f1dc1dc3f4e4508894a8abb3e76084eec50b70befee2e240ba68f3a81a1d0d8897bed1325c59c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
48ca0b097c7f2b0e52202c5221e5c339

SHA1
0d1ccc6d48fe9c5063fa77cccba76e0260b561d1

SHA256
57fe8991e855b3525ba6f10508b03693a89f6218c17352d320d7b0e98e4b1782

SHA512
d4457d1e1aeaa560d7f2aff7c94391eb0db55b5c52fa429dffa7dfa6b9565ca56b2f8916482a87a0fc5fe914a04f9eeee106f713364ae75b03a9468471e26b6f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
2a0a330304c3bdbf531dc157bae134b4

SHA1
750e877890b98ddc1fda8fb7aeec375eee54d61c

SHA256
cfd96fec5fdbb92501eb2ff70d68dc382581086e8319e77e33322bfcb410bafa

SHA512
3d49facd96c8b250026e4fbfc5d103ad04ee7f1523ebfff2dc0aa3604baa3b67338f454d6e3b1721b880dcb016a5b84946febc33ee51bce05589f4040a283e5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
49177f9a199088cae9c41faeec55b788

SHA1
b542b71e06582ea7593cf0458277c09f10925643

SHA256
9bab3036a6528dbbd089d3fc334b8430800ce86b4a0df1c4989c080b8f975e00

SHA512
65c20f9c57c54018c9c04f022fef9af7f818674b4c25afb94f3f80b359af8daf4ecaaabdde8d184f219a47354758e99af9dfcd81f687d251cc40f40a849438b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
66d1ba20ad4ce2bb8e3b6f13cbce2dcb

SHA1
0cb0f50e220a5f33b46afb1f8a91b7d0da9fa543

SHA256
051250b5b679f7128ac62262e33288bfdf13d7eb525c80e71879dc01d36d5af1

SHA512
45859267eb6362597fe3152d76f8334d7260401ee5cafd410a6032c09e10495af6723c41438e5259635b7f3b8d77f9b8fa7441c415656aaedf9ae00c761185cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0cf3c65eb8eba07d77801b83c9b064ce

SHA1
0298469a8525c17a17216b6290dcda25202c66b0

SHA256
df85f926c692116f4c7ed9fbbd2c9c8e3c0653c5d23693bc99de553a5be85888

SHA512
9a9d47630a729cbff1a869f46cdc292a985b83829432bcf64c44dad8d6a5a49efbb811da8444f36f36616bac0838c6961f423772f414c2ba8deb2cc9d58e8086

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a00493693da5f7a7281f6957d8e9f596

SHA1
92472c0d4ee0a12d9ea4dba324c6f208cdce1c92

SHA256
5602a0cd6149e45403d445f67cff9888db722b98004c6a64e8b82efd36b87e6f

SHA512
75bbec7f8b6e179a40718bab8f1ff523b7c9e8faa2a4c14d3ec009dbe7b93a888820fa28bf898cd2ca0934d4c6510a364f0b8a181044804cc30af008f375a84b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
485463c8c4a143175956647bcf18da5e

SHA1
b535cabf6824b9935834cae955ecb98d722f0d1a

SHA256
331fcd81c3227b07ae68cf860946f321591ebd68dae616134f6b78d90f1c8c95

SHA512
44bb831f8ace5030345709eef86e806335f49ccb9173568da479fc2b40fb7542341dea4942ea81cb409c2a27558fbf8d766e64965521827a159514f09cd090f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9ccc306820036192616f383818c8eef2

SHA1
e1fea8dcb13ad7ca8b244217ce2c7e7b4027b545

SHA256
e23409b1a42c73e6fa5e7b3c3085b38003540246eb7eda424285c8970f8edb5b

SHA512
93395c6ed1169d3a21852bb9e43c5f3ab5951d23a41e24532fd4c4c874e164ece1442a430e3f94455ed2702e40652e10f8f713c1b04b0ebd042cf7e08b18da35

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ab735cd1dd1b3d4722c00df4b20d9843

SHA1
baf4dc03b1afa8b90d0bc678df4de9250db98a9d

SHA256
ea82160e6795aa9ec4e606989d9527eb1ede896b070de40bab7fea418f4430be

SHA512
80632afd771b2f6102cc1acd3dedfee15bebd76d2f8bfe2ae11fe914fe287817999cfadb90baa02653204930036e2338cd9722224ddaa909ed9304be98c7b265

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8ceba52a225e965f06e56e8f79aee0d2

SHA1
89ad73393f304134cdb07a8f5d50591719235c56

SHA256
21707701d73d7871031d3c901e2d65e3eee8244957b4bdea8b12da294edf54d9

SHA512
9f7fcbc3694237f013f08580714a9bb453a95ebaaa142a0bbdaf2d3a9bf28bc31124cd65165aaf89882c634499c6ae7ed782ad461474492e9057b976ded77006

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d80df6fe6bc626a5689299622ea99150

SHA1
77d2adfe9d522e0180feffa753aacc3b23de32a5

SHA256
eb229ad7dcc2f9b4b935671b6a431f8698e157c1f68ec1030481cc89566005ba

SHA512
816cdb3ffdb341cfa60ee919af606fada3c4cdcdc0d34d87294e28d7d51520f36934a5de414095870425729c1c2c6498cc43425fe0ec7f6aa5588f7580dfd5fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b3344a556b33f6c4fb528794fba6b126

SHA1
519c29f0fccbfdbc2f5e1a9245e8db47d2f34510

SHA256
fd9c3726568cc8bccc7f76459c34cd5fb5c7a24da4496d6af464e7bb40a3f56a

SHA512
eeafafb04e31685e65b3c5e63b60ce13e183717c65188333eb18ede93b94d4ba7fb4c0814794e61d5319e321d1bd1b99db16a02ebc2276df47c28d1ca9426009

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7b7b1f02a3f942ca0379ab6337682e63

SHA1
a62cd37627c1671a323d1f47d7a6e444a0f9b3d6

SHA256
74bc6e8ddda327625a54ab078675e709aef423d3f68f24eec0da0f2851847c3b

SHA512
e34d493473c6a68f41cbd45c217e92a226d769dc7ce90b03de669e44f2f3da93e7cdff5a81cac35d4c53b8f8d8b3a063ddd44d14afde48cb298617cf089ac9f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
0181398e20e4392ef908c192a0bb15f3

SHA1
f62ddd380f49636de0e80abbc365d88825910f32

SHA256
e628037216fd51eab44c0341c36029b6c672337b20b6f6be2e447d8df96a1a20

SHA512
be32060cad04b7ee13a2c5e6c4e6a3882a091c2f3574c34b9f137c3901400f15a92acd2c8b8f336b1e7f38293e1eba62e7012bcf44d6b45cd1bd851a619d0c2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5764d7023627610b3c42c2923c0f2ad0

SHA1
e5f5e98977ad890a947d8e758dcbcdaeb1c28509

SHA256
a157463cfeab72dede35a6d2c4070d0c37555cf0cda743b501f4ecc16b18ef91

SHA512
ca358817fe76a1337218a495415e4eafbf57957a04faa0d5f6927645a9e0e7d128f2d6c3f6b77f6de4eba4f7ea95d8bd39f12b1ffba335587317d703325f1755

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
39d515accfd6895032ec3c5679d69d5d

SHA1
5c85acb2a8d49d1f9c97fc8cc197ec461fa52dba

SHA256
3f6f562d3ddae7987bce5a48f633acb4a3008a382f88b699afe6be60cb23e334

SHA512
413491695f6db4c938b4c93f8f68392b24cc4aa22b86a5584a84334966310023a8e329bd8b9b76e452f3194fe5b861e114003d3e0f3546ebe8844fcf5238b237

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8e417202dc6cce60dfcdbcdfd89f8b1b

SHA1
5b425a46b9fc211ae3320bd98a5e2fb17138ab24

SHA256
24e028b568dd0a6650f98c61b3c38f25b9d2501f93d494951b4ff500ce34fa41

SHA512
f3e3baa572f8b51ac968e2ddffc09010f516285210d64f40ae5911dffa87a6ce07c722e59a67b08aae0d18da2eb5222eb5c6521da0b9ea2362b164794f76ca07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4b3f67280c377e16fd11c9975ea701e7

SHA1
0fe1473dd36e56fac4c24f0cab93b58e725c4758

SHA256
43f7195b3b335dcc6f2d92ad00d726fd8fb8df960560c43ba981470736fc3763

SHA512
21f6e0dd047afbb20b6d7175d7347bd193441e17e02c27f9861add9491316b5222cfce4a038bd0abeacdcf6058887c13b98d062cc69c97aa79ef094a1fa821dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
7c09e23b04cb18ee87213ef0f53abcdd

SHA1
9a1aca0f700182a16a1d76288624b57df35db4d0

SHA256
890ff1c5a9b373df8fb03739efbb37ee6de5d4cc59a562f0ddf1d2ad0df63d83

SHA512
60774868b769266f28a298c359a431066762b1e0fc34e1ab35cdc73c0808e88cd5542b1f3e6e20f376bc8964bb50b73811de0257d7bf8bf9fab3e2912adeeefc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
200fdeef4d6f937e24162ceb8b5bd2fc

SHA1
11d6cf8eb314caa861750e91508fcd2d1063db33

SHA256
0f5d78c45a26ed19e19995965e5db143db4d709b58d21e13b21fd2d0206060d6

SHA512
55175550ed8ca44dc194097f65659fe70ae8f857f087fac1df041ef9e3e902e4695e91c927c7c5d877c82f2462b77f9beab58cc7647fecacb0dd1cd99544eaba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
74ac54269688a5fe417061e83cc125c0

SHA1
24d383763f43e3d773328854aa4625102a93e97f

SHA256
deaa5aab9a1bb9e4e8ce9abf3ec49b0aa458a189bc3d523aff4f3dfea79d4ec9

SHA512
cf6f4091cb43929bee71575cf5517977fd069c183cb2aa473d31374487dc62e3694d85e4c8a4e3425ca630ee071350ac670446bd93a9167dfad94811f05d07d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
47ceae08ae244c233ad5e37d4783dca1

SHA1
81474b5cfe429eb5cbd412d03db5fbd8f028c636

SHA256
d9482831df190d096e6900e33e99ed2f3e1ef173c56e83cb4d2510dd0c311ac7

SHA512
96859adb6366eb4a92d7f157a4d1add5c09c7625350e7bb2419910e70824f1ecda3f34efd80a8fe44330ccedbd6f40f78e5c2fa78f6aa366c1fce9447026423f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
abf5b3facd990b2dcfe1a5ea85d76197

SHA1
225ec3e5357ec8c94e31c8c7e780023f5848dcd7

SHA256
d2cac326efb0a6e748619f839e6ea4651100a28ce63fa96c425044929035777f

SHA512
acb99fb02605db461ba51ff4270e0218cc30bc183d4900969a40182a62ca940c0f3b796c74eaa3674deb03a0149e27268eb186632e3cd854bb6b33fdaf504986

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
bea05d5b671095f0fb8fc9ed5f792b40

SHA1
996095821d916bcfd9531d844b22f14e8831da3f

SHA256
4ee5b776705b44a04e766a3c07f35e1a30370dda80fcfe3281bc9442613405ee

SHA512
8644d4da8d0d4b0588d819fbe6c2613f8f4fd1096e6e3a0bb56a9210870fab540a7330ed72fc1151a0c409ff45f07299f14690510b2ce09c0e22a89e066c7b0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
1ab49b6cb948927416bade05e2007b17

SHA1
ae47a7b11fa518409bceecf62f0914039b9c3045

SHA256
974b8f890f563493c3b7fd844700527f30629961f6d4a6ad94dcb531a69c0e4d

SHA512
9b9aa93abc612d237eccbc0782ff5ac52d4bbede988b7e13636df7848c57a5bb1987f92e603a620931abf02bd1529e453683de8ee2e21553c59b51ed36526646

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3ec33acd682f5fa94abe51380681a3ff

SHA1
688afb788f60b4e31306e5db40572f5e99406b51

SHA256
1340df729c640922686b2588bd79d539f865fc3010a27f9b1c169e95fac01018

SHA512
513ec4c1e0353e40c81a646e4292c27421648a4191d2b81b08ec2b2698a93c5bc1d138354ce75a76ac467af30b33bb8e36bd8257d7afc17a98a07e620f5ec850

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f69d6332bc37dd9a4e3539093219d65d

SHA1
a8364a448f12ead5b042aa233c8734e10e3fd4e4

SHA256
525b40e536bef851e976c838ad1e02b082945260d775fc2419658560550ea0be

SHA512
86abce61882d257771610da6ba2af4202b240f09377e425e452e6de34820e6f60e272cd6fecca37543b06aee8dd0f7b44ea64a7ff338a9d32d6db790d733eaef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
468b51b154ec880ebce2f990dbf41986

SHA1
32fea77df65d2621afa9fa3988285ceb7a5a3c8c

SHA256
fb75ab7653e6483ef3a0d8503f99e9509164e403c46df3475445f4a292526a76

SHA512
f9f963f2c56d581b963c42a8d9bacb8e4616c3a35bbf7bfae9e1981e22f81e187a30557be216902a222b53284cdfdc397353f21bb0cfd2ed831f74a2dc975511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
800ea4a78d9f74b9ae0df14a75543def

SHA1
fa84b4426bb7214bd258f135ad95d91bdcbd151d

SHA256
35fd06904f9c4d2d47c7dae3c91fa16d41ee6a2d215ee4767dc4b7d0e3cf5cad

SHA512
963ac73dd214e52e4cf0f116e058ecfb7f5ebc52879ce1823a78f09e0c48b45a936d51d23d75f29dc5f92f4fbe3e3afe1e443725d651624827fd508282fa4287

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
060cda425a91b661e0a22bd804011694

SHA1
e4f0bd578f8d3ae30773b96d56b38d0e4f54555b

SHA256
208cda1604f253a5d5f86386dfd0604fecdf323348fb5894e7afdbdfebb71ddf

SHA512
3a3bb55c95329569942d399f0d74ee589861772fcd1d461c4e93b14df3c6925686cb1348f30d9a10283efe566884e7749688c372bec59a5ed2e647ee67556f20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
987b064aef88cc7458876a91508e2a5c

SHA1
5e3125fff705fbcf4737d820853de78c0fba4c72

SHA256
51471781c8b02cea002e903aff81eba8a610106f675db42829e018e3cc4ff141

SHA512
dfa0b66570655aa70503d05a1ee43a066ed8e0fe9228cb74654ae569486c8dc3b1ccd85e299ee8702267925fc137e00a07e3c58c09635e5058e5267a09e74800

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
e98e993ee3cc8593a3309fec73d9a2d9

SHA1
f2a5af0306ce111ced68eb19e094046d8bc1db18

SHA256
1f5f608d31dd7a94e4f9af9de74f61f091263713d9c15b548aa2303fdb116cb1

SHA512
25704894c15396df8b94db6c19a68764085291c0cc6ff9d3b70dd5fa960481a469ac61bc62d1165d95b7a47739c1a5c9e4f74186211e2b9f49c3f42b72ea7ae7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9b8141349402569102b18bfd951b9c26

SHA1
c2924169fe21f1dcfce0d2a3971ce34fa37f9791

SHA256
d2e8e0f84f3f0987c390cc03ac7c3c629735548bedc6af70f6ce8626198c235b

SHA512
b926aff32f3df2eec99477ec50c9c2cef255bfe50f28116a9eda4790f0c91b9e890de0c66857e267e9aaf38ea55ee3da6bcad6aba6c7b89c3217c04c39cfc069

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
3d694a760fe3d41e2fc2b8bb01b0f573

SHA1
45ac1bb4ded95267fa478ea44d552ef081adb113

SHA256
b1805cc9cfe2c8bcb1e8ed5bb901cabf1518647cea477c438e1c6ad13c4e57b5

SHA512
47c922e15d0ec136995a3a10fab5f3957289066037e453f0de5ea9d50b893752f2ec21b82126aa19f337ffc6578297c0aac6e6b79a1631fca624a79675a8aeae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
823f9c9325ea9c8fa07a51684d708a48

SHA1
fb1a7f9601cca3d26e2ac3f7a2e48494f5ef0a5b

SHA256
96e081a84f0067cf7030130459aa31f21ff90a5044b500d6783104b62b5f0338

SHA512
5dcadf474cd97146a7ce1c1705fbef4db89e19ade16fb151c778614f350a5811a89bd55c7e6173d535e7f19df98aff37565c12a839f6412d7255d12821112b64

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
752f15226d713e0361069ac97150d8bb

SHA1
d26e727573b5c24cd315f41242ba0cdebd2d7e20

SHA256
71ce08c440f3f79d8cd9e0570bf6da12cbde09b5e87c70a7e5ab5b26a6d93d13

SHA512
06217060758a84f2cf47acf6efb6e417e322394cc7738ad1042f0ef57f26475c6ef577187e3f1a5ec3dff2e542f149941a15fa99e97f648dde6010777e05785b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f90a2f7674ece6149fd2aeaa1dd6c0e5

SHA1
ec638b009c9ffb663058f18727df64e934bf296d

SHA256
707f0ba28fd257af53ef5858a4ec28238d60b90f6d1ac4be418b292f4e3dec74

SHA512
21efbbfb52e78f2000c0c79f123eb5f07e7d0c2985a86087c625d452f7192c693e22d0fc51ef572e744cada0d19cedcd2d5313ba3f76877a3f5101dc2442d42b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4a00f9115e45345d73d316d9f30666e4

SHA1
346514f5b0f58f0853d40612e4fa2ca17f01f91c

SHA256
bd977c8da32db4309dff519f1fe25d1a2a2e0aa6408b9f2a0f9aaa3c94178c47

SHA512
eb319edf0acca9e749eff7d177ad91ffba79e553e42368e6d14299225051fd56be47760107df49ead60d2b1f54fc738a7aa7e1c476f8e3e7a9ba924ea1321f10

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
97783da8d6f7fb731cdfce34a9b4f4fb

SHA1
027ed3d69c7e618e94864c6251e6a8c10e84c474

SHA256
7729b1c66bbfd48eb23dbc81a78cb0d13a211258a416d7e4109a1b0132dca484

SHA512
2577aef6b31e6126c411c3204a1c3c90e01bdbebecc823d1aedb2bf8f2565753e83c014d80c12b93d4d1dc30d98f9858a1f65e95c5bd7c1b7a838c6ac5732c8e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2426c1da0c1853629c764fd365453a74

SHA1
6116811a75e4ff5742da5efa262a8c9736bfcd6f

SHA256
8fd13574fba774ed7a60e3755a9380e41b9732b8146072eabe88bbe45201a506

SHA512
b9117b765f82a079639c482d85cad9d0d0a9052509efa8a5fff6b8d374d46b8b6b0f825db4370faff412af1e4d3037e2aefbf53045402679af9bd832382ca460

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4843e06d8373a8b6bb8fc2218b97e2d9

SHA1
da0930e2e370c3c7dc03a7ca3be2be294ca0b485

SHA256
976dbfd6f123d393768b812772d3c76d9b073d7998c819b18f7d72ab69ce8b50

SHA512
ad17839de30a1c74c1e15ddbead398bd4139f693e4e8d7c6a04790ed2357e9f81a5327fe3db694a3f7b94988127f22d01a5ec428a1ef8ae727acac8e5a6488dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
8709fccc651b405d3d10898eeb4d3071

SHA1
27c2f7b9885ed78d02bdad696cd2e0ca963ccd11

SHA256
fb1dc24fff2e051fe9e875f05dad02a011881d2558fe71720696e4fd1f0c4ba8

SHA512
183d7fdea63f1790bedb23e60816b79d2bdc35d2b5972399a7ee9bdb6e1f81f1cb006454fca28362f4e220855a98e1ea2abfb759d6c39162c8a6b92a56db1d15

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b2bd50c5e48d83b0ea145828b35bc1fa

SHA1
6767fe62825d858cef6757305fa0694f8507ead3

SHA256
4d78b74bd8c60b117f7b54c1fdbcb72e04a9c3a60c256220f760aeb8284c9292

SHA512
424be9754ea17b6cfca7bca7d873d0368989bae9caa42695302e8abbf5d28556779fa7851b31711ddff25b258ffda068e8dbfd544e9433895b28610c684cd40e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ba7897327b7e5b1d70de2ade60e1c30c

SHA1
1e4b38d4898160f20f3d9cbb9b5e1ee39cb1b857

SHA256
72b21a9fa0aeff434f9671fdf3f856fa2f14be7ca3811376ad627fef01c9836f

SHA512
8d678bbbecb26f1298e7f18a2b0ce142682368743671a21fea412ac75cfd59c03a37e4a6ed4ae44c42fec34768737f8f6f801c152fd1dac418b3e4214e110202

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
89993387937771f6c338d52197dd7a98

SHA1
d444a836751c3285de3123ec78066a83d41c282d

SHA256
a59ae36491bd106e9fb8ff13d3f0a50a892565aa6912a29396cf2f0fb845eb31

SHA512
022dbd71165c35ec8d39ddfd8f9c9a1a332a29557af3968fe780ac3a1037ae059d2c4cebd978da40fe010e4b19a502dc9ef1b71083f1e493bdbfe0bf9dcf0a2c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
16a75aafad8af21bc6b1efedf7ba57a7

SHA1
5c2b7fd8c12001024d4e6208d643927f808248d5

SHA256
d5cc5f00b26c63bda6881ba8f0f598e9e11f886d6d061767062b6cc8e05c45b0

SHA512
3bb3952c31265d84c11435f744c1619e950d38a1dd289e0a1899fae8c873a34bcd6ab22d1bc64e49a1ebc2e4e78815e56fb9939b7c184d5f4c9cb4a06854b629

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
2e5550108b53b3b026d43ae4a4c9ae16

SHA1
2fd682672a8a7d75313d07fe4cb054853f32bc0d

SHA256
6979e0f8ed00cce500a6624fc31da7268e3848195f26b5b27bab3818b17eef53

SHA512
001f17688b1a01f6bd6f21dcfddf11053cd980e76d6aa90b757cf6fd8efc3eb1bc3996bb2d616185a46f72100defe6a2e091b3817068f4ce164b2a0f3e32ec0e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f8da9dabd47ba10470c48f2abf279305

SHA1
c5a259a242f6deaf0b76f2805f419cdfc0b2e971

SHA256
f6c609a0d60fe2aedfc53762f9b14bcbc5812b9458684601ad3beaf3f571aac7

SHA512
a434d5315b2aeca92b1a9ee76b7b6a8741c371f947e0bd1f1dfbf13bcce9933d4fc735a75bf5ae3cb435b7e8a1464f0191e09adf95e11dedec3fedb872b58ebf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
096ad0dfc19aae752f1490543e5c744b

SHA1
7af7fcc8a1cfb0061048e6a98331e6334a8f0d1c

SHA256
75c56330a9606fc647c2a493883b5f8a32e71f36fda46caf0af1157ab5bdfa54

SHA512
beb9c0cb9634c63162666c030b760f1f5341fdb4d879571ad551dc30441e05100084bb159173169ff218dabdab45ea300fa1043bca872f96df22d0ad93ab9aa0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
5401fb5d95ca677028ced4da90a0bd3f

SHA1
4b3fef200654a0b50b2491040d40efe4913498da

SHA256
3cd0e7aac8aee9d8f807f589be57e6c4fcf29a0fac1045b1ed6899fc7eef99bf

SHA512
56140ddef6c2aef09970c67742cf32f671a05005bb2b84bfe371455d4ea40e7018638b6e8d556806b488fe830de053a71b154ed48dfd6ea466ee152cc3c25ec0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4e3a34907f9175141d78dd3d37d09798

SHA1
dfde071ad160145b90ca04e5ab695902844c9a8d

SHA256
19fb0d4f178a60b1cef63c920e976d5172e84a435a7bc62f5b96edb5306e31a4

SHA512
ea0dd295118eba22f54456ccb12646b5aac49d30b4924b3bb89b2ec3bfbd3b2221720c07e7fb1e2bcfd28dca4e23e851d60e4b3add4edfc8b4d2dde9b687f634

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
96ea49d662185d41dd01c72ab2bf9b23

SHA1
c9c18e7e411175dd65d7c53fd9dca22ae0770b74

SHA256
bfee7bfbeca9f5fdc7126d237c66ac798a4e871272757156d56954cb7e129688

SHA512
5de941b5fc09516712798b4def1789e984e6297203c5040f507316d5c820c10619f5a527554af41557abd7330554c114702638a0e94d76e0137f2eb8c02f44c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
a169f32260dbbf71344d1dd63ef7b3b5

SHA1
164c2fef662f5bedf90ffd07f5f3e578d54ade3e

SHA256
fa391b7b95e41fa3de3439835194310056e5d87c71dd4e8178725c2fc86aaf4d

SHA512
6bd93c98d5130edd6fca47defe3b5beb3b3b573652d0533637818e5b3d02484afc4cbfc83e822eab59509c5546c30a2228a1377a9f761412ca98ee96f79c47a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
378024c39d7411b52d696d717281399b

SHA1
307da8bec155e2a327c560aea0ba535f1c6ffbdb

SHA256
546c064dffdb3b9dd919f75ab305fdaaa3a9302f08175ebb7bbb8675a8dcf1dc

SHA512
0d40b93366e15a10092a396aba0adcdf0333e2700e8ed3cdb3d805c9edf2271e4de0e548c56f2ab4a57c118401b7f8f0beea600bbc0ecc619368672c04a2ed7b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
963e4b583c293b5524102692eebc038d

SHA1
9319ba27a027703d23f9037f53326786c5d56a3f

SHA256
cd6b65e6c715b167da44870154fe7c7d05b97d041925ff6e4b2477ba894e56ba

SHA512
4239912fbebb074ed367606c28ffe28b1631f441c637908f07d6a1066c39395c30b243a625cc8ffdc028d36d694ba2124497bfd78f4070abf0e86fa1883cc799

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
ac333c856b2c9f68bd6fd97a57d8d3cb

SHA1
c2a3e127776c377a780ae0e3539e52fbb35166f6

SHA256
75d9acb3a0b37e777e573a5cf052def02e8766f156b6d20fda6dda80f0988a02

SHA512
0b612846e895d224a961986356311dfec5ab2b3a7a0cdefb26fcabbced530afad663aeeb31130df082b41928c42994cf66431333730fdaa7d670e6b8bdec24bb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
1bce8b8465ce97a958ff2cc92f870c9d

SHA1
1b9c2d20563bbd14c97e618d42a93bcdf672e6da

SHA256
bebbe50ac8deb1e9d581545e591c9114e1ef70d8a4070ef0f55eb7f85a28da0a

SHA512
76cd133730128ad51f547cffdbf1074299382d7bb5885fdcc8767175bde51cf5a4b545e09fea0ce755f4f6477330d4ea8d8d4b324e39b553325bce490125cdf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
57f83bbdb753cc6b7a41481495d90610

SHA1
e710cda20161d0fe52e8062095c7b63602c2d5f2

SHA256
49caf018f71e31a234bbfc502b1bb1d0b387b229e57872da14435b8082632396

SHA512
85e271336666694f5d91d168fb546274218237476e0b7f65c8c38b3f20f2e03d02e344ba9a29b37802845d4dad6c3b4e4535eb52bded0cf54e202c5236a5d710

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
dde94bd072037750818064debee7484d

SHA1
5562f7c641d82363ef9c357fe2c22bbb295c4700

SHA256
4ee02c550b2fc4d4edd49d36e88acf619405a3417e9ceba6df569276797853e5

SHA512
b5c516929e5a122998727a5bca40ec48cd834b049de093bc2466ffd599c76f4f5c534cc9dba5e411b31c293dabf998383395ea2f659f1963004613e1ce9187e7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
245KB

MD5
30839bf8216835ee005c2761404271ad

SHA1
fcd794c150387a1fdcfb608b8d1ca9d13b272232

SHA256
b6387e62575d1c622ed80b6ce477e9062e3b926a3cffd5fa3e9a583a524585b8

SHA512
f2ab5c79b520d45202b1bbc19a238d645bc04e1a42985936cddc2cf6e57548a686d0726397a06c6636dfb64683266aa633e011c52114369be5ad75189ad38608

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\SDL2.dll

Filesize
635KB

MD5
ec3c1d17b379968a4890be9eaab73548

SHA1
7dbc6acee3b9860b46c0290a9b94a344d1927578

SHA256
aaa11e97c3621ed680ff2388b91acb394173b96a6e8ffbf3b656079cd00a0b9f

SHA512
06a7880ec80174b48156acd6614ab42fb4422cd89c62d11a7723a3c872f213bfc6c1006df8bdc918bb79009943d2b65c6a5c5e89ad824d1a940ddd41b88a1edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\SDL2_image.dll

Filesize
58KB

MD5
25e2a737dcda9b99666da75e945227ea

SHA1
d38e086a6a0bacbce095db79411c50739f3acea4

SHA256
22b27380d4f1f217f0e5d5c767e5c244256386cd9d87f8ddf303baaf9239fc4c

SHA512
63de988387047c17fd028a894465286fd8f6f8bd3a1321b104c0ceb5473e3e0b923153b4999143efbdd28684329a33a5b468e43f25214037f6cddd4d1884adb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\SDL2_mixer.dll

Filesize
124KB

MD5
b7b45f61e3bb00ccd4ca92b2a003e3a3

SHA1
5018a7c95dc6d01ba6e3a7e77dd26c2c74fd69bc

SHA256
1327f84e3509f3ccefeef1c12578faf04e9921c145233687710253bf903ba095

SHA512
d3449019824124f3edbda57b3b578713e9c9915e173d31566cd8e4d18f307ac0f710250fe6a906dd53e748db14bfa76ec1b58a6aef7d074c913679a47c5fdbe7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\SDL2_ttf.dll

Filesize
601KB

MD5
eb0ce62f775f8bd6209bde245a8d0b93

SHA1
5a5d039e0c2a9d763bb65082e09f64c8f3696a71

SHA256
74591aab94bb87fc9a2c45264930439bbc0d1525bf2571025cd9804e5a1cd11a

SHA512
34993240f14a89179ac95c461353b102ea74e4180f52c206250bb42c4c8427a019ea804b09a6903674ac00ab2a3c4c686a86334e483110e79733696aa17f4eb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\VCRUNTIME140.dll

Filesize
117KB

MD5
862f820c3251e4ca6fc0ac00e4092239

SHA1
ef96d84b253041b090c243594f90938e9a487a9a

SHA256
36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153

SHA512
2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\VCRUNTIME140_1.dll

Filesize
48KB

MD5
68156f41ae9a04d89bb6625a5cd222d4

SHA1
3be29d5c53808186eba3a024be377ee6f267c983

SHA256
82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd

SHA512
f7bf8ad7cd8b450050310952c56f6a20b378a972c822ccc253ef3d7381b56ffb3ca6ce3323bea9872674ed1c02017f78ab31e9eb9927fc6b3cba957c247e5d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_asyncio.pyd

Filesize
38KB

MD5
7f59c16979faddfc2f032d0e94bfd8fe

SHA1
c2c319d0727c20ab71594b04c34bdae7823b2ad3

SHA256
bb405bb73362b4820b7f387e5372df5aabcdb4e4dc2797481beb2f8be6e6373b

SHA512
9be4e48d3531c2845b6fcfc0f6fbbd9cdddf31c857e2a73830ad1a6afec66e0037810a1da4b36816dc9d0e6f5ad77b6e51b85551d392ef5ebbb5c4fa055a5ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_bz2.pyd

Filesize
50KB

MD5
94309558eb827e8315d0f201bbe7f2b1

SHA1
b0a511995528860239b595774a1912e8f1220c42

SHA256
fe14d1af436b07370607c6798c3eb15fc439837cc9cbe7cbc3271b07c9ed55b6

SHA512
1163da89470b4f4f11786961d2b24a0c01939a174415fac8321f402d85c067572f18d7a8f43ec8abdcc6f14dc76f780ec36004ac34593988240f6a7642e60365

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_cffi_backend.cp313-win_amd64.pyd

Filesize
71KB

MD5
345b9e4fe71e70b8188a739bab2f6163

SHA1
3c88da659602a8dfb07602e36221ab4185010530

SHA256
56dd9d1092fffdefc47b5963ee9d8ba2a9a8270d959fe00d43e927300abdee94

SHA512
dd929cf31678924435736011cdb06a2cf77cbac300874621bda1f67f7857d1aa84523d15231891eb74f66019efa4d0e7aee640f92293436205cddc74062ef899

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_ctypes.pyd

Filesize
64KB

MD5
fc40d41aff12417142c0256e536b4a1a

SHA1
237157d6af4ec643c4d8480cf3d332951a791cc1

SHA256
0712d9412ea0d276c9a726765c072e00146f5aea853818d177b1a5b425839641

SHA512
b7625a5325a5b184b1733931dc3857ea5c118d85a506875dcb6b195c2372723b9c6cf80e4688c0fc1383ea063c9d831dd4c0e10ec429dd0f363aa678b1c99f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_decimal.pyd

Filesize
119KB

MD5
0e02b5bcde73a3cc01534fba80ec0462

SHA1
decd14b79adf47cc74085beed8a997552d97b965

SHA256
286c99901c103d39c3e79bf30ce06f2825260e04ef7d2f0d77fcc08fb93e1d4b

SHA512
9556fbd408a5f5e0c21212cda2e2c164cd5093bb8668c152db4b72d03944f1f172ac8e0e194b3eedd1d4697ca2e7d50fcc77fe47014eda14ab658648005cb338

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_elementtree.pyd

Filesize
61KB

MD5
214370927d31ba80cac972fe49d264cb

SHA1
eb927e9a5b2f3db829a2181271f35abac1dfb7af

SHA256
10fa9a8662844a6c0213b032242548a21e1a67acdb2764a69f2bd6829bc7984f

SHA512
a4908f89e33f53283e993612b076c2e0e8e62724f2aa1a7cce970e0ee0ddcd4b267790a1c18dd6b16f4eb3bab8af0b8f85f823e5f4cf43b5e28c672c108abae1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_hashlib.pyd

Filesize
36KB

MD5
933a6a12d695c7d91ef78a936ab229c7

SHA1
ff16c267921ed4dd7f2a129df675a2bc6a52be2a

SHA256
60d239d691eb3e31d99848ba9167b5797c897b2896fa5605e61f5bce08e9cb11

SHA512
fd5416529061851e90aba6782e1550d9c48d0b10d39f52bd3ff984fbb88d0c06ee54675108508aad819d49362fb6ba74e9d3ad6dd0f3aa17654a07cae6ae099a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_lzma.pyd

Filesize
87KB

MD5
042ac1b18a7f6fff8ed09ec9efa9e724

SHA1
643f3dca141f8fea4609b50907e910be960ce38a

SHA256
491b8a4f143c7a505e7c36a2279e84aca902e65a1e28aa6d50bcc37dbf6b5334

SHA512
940a44363d385e4e9fa23c06cf6d013d2585424e6a174e2afbdaa5a0cd21836a5df438859eff45a3b6e70e47322d8c8c5fa5d83315be34cfd6769e8fc2084a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_multiprocessing.pyd

Filesize
29KB

MD5
eeab027eb533a71710e4a4c4e2fa81f5

SHA1
03205932bf5de8f6747d2978ac9262d8eeef895f

SHA256
b7afd23c4c19abd518ce04f45c55008636dcc837088c3b39e33ac2ecb0e42f6e

SHA512
ea14ba911069efa12052292aa0652b5cc883f2686fb6bd8b9bd8735e5114a3fa5298ef78656d20f87f3b6e4dda185447ebef94e222ddf4d9e70e83f4c3e9ad5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_overlapped.pyd

Filesize
35KB

MD5
ec52defd68e1214e6d284e27c4cf46e9

SHA1
c581b0b1576f893a2930fb10b1df4c6dc82ecf0c

SHA256
5e6a86bc5d0a348408fe921dcebff835a834940fa299e2cfb81061e93410f006

SHA512
62995e58337122ef48594c9cdfb31dacde4db54c57a9afd785a4cc344ed840240530103bc05d5af7160de849ecd5c61825733ff7afdc71944afd452c2d10d36e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_queue.pyd

Filesize
27KB

MD5
1073d3147f0d6a1880b78a5a5695fc70

SHA1
d97b690c490a51182e9757c15d14dfefd840e746

SHA256
65ad239871835a3823401647b2dad935075b4e33a5913fd12d7f2a02b6c49d82

SHA512
45d046d2e702447aa00bada25d76fe17c3a4c8822ac62739fe820e9eac66c5262323d66ad90cddde31dd01ecd6db0128cd96950e9857c9c5c59524027c75255f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_socket.pyd

Filesize
45KB

MD5
fcfdf8cd83a8d506a4483a72eb57026c

SHA1
74428908c0068c3de2f4281aba16c13cdd28be04

SHA256
2a6b686817b640dcabc58e60289d9ace9ace3e4bc217d78953439549cee65a8a

SHA512
3b63e08370fa76ca8c81fc7639492367d250d507f0fb7e0e582078997ba2fa246c48eeaa9faed866dface4fcb08319096a83048dc333ad4be21947f5146b1768

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_sqlite3.pyd

Filesize
59KB

MD5
1e16d084725d9b79f17ccb1996df7410

SHA1
3c49ba7b3acf317eedaa7c75319f1b39f91b79ba

SHA256
cc17586da3a099b45644ce76cd53ffcb3f5836e9db213152e3a880569c50ca7a

SHA512
4932f891e386792a03f6340ac7c9fe9dfd52e6f4a948951520c24b5f6204b26e3fc9455658e52efdce188a98c1e0f33d86493547dad47517ffafb9bb2c088549

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_ssl.pyd

Filesize
68KB

MD5
0a56191c7fb0ae4f75de0859aeba458f

SHA1
6b1c4d1906bea388c6690fe93f12013db959a4f9

SHA256
e07199062e32fb086f8cb35c36239f1bdfe15ea10f72864fed1953dc0c2dd61c

SHA512
014b18a33f7ed88f4c326a7981ec670c197d1fba54f7e050c64fe409551cdc89e8fc3ce7205cd8f45cc548c6982e00049e03ea2aeb2360b1c85ce9beb1aa8410

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_tkinter.pyd

Filesize
40KB

MD5
0b0d437cc1f778086ec4a9be2c56fb6c

SHA1
049b846bab3f4c3cb9379ea941ea8914cfe729c2

SHA256
a78f45ed8dda40723e69ad5a36a455c375b383c723aab23d230e6ec5dec2f618

SHA512
d303bbb66a3ed9fb286bbd58e1c3fcd4e7a7a1bf6ec9229ab60961766592da5f5a06388c48597b5aa518f35a60cf536b2a07aae85402c0ebef68793751f1db2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_uuid.pyd

Filesize
27KB

MD5
ccf609ae4416f13fcb80a122c4345348

SHA1
be60263e7cbb2702733a37513d5fb717f6b30216

SHA256
99e97e0af615f43150778aaa44d82bc58b70bf595a8412cfafcc5d38be38bdfb

SHA512
9dfe0e4aa31e50e5b799cdc86a276c6576ffc44c919657e4230e17c9b739b8e69e0865eed38ab9ec0b07e77090a6f2c03c415e68fa431fde108d2d92cb3e8987

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\_wmi.pyd

Filesize
30KB

MD5
b05038e355519e16b555d405e9c19927

SHA1
f3b2468b3d16fcaaf4c4d28ab2dd9ad7b31b9b3b

SHA256
ef3e38977c56a5d7e941ff89a86420fa2ae11e53a8837272b38d75462e684bf6

SHA512
e1da404f1e56828ab63afe9c29fddd0300295703d2528727b13f49d896eac6a55411b217cad55053c540caffcac0312aee22d7d3288c12ebe0a39a15a7c1b50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\base_library.zip

Filesize
1.3MB

MD5
5c732fd26520aac97fcca2f9854abedf

SHA1
81df618cff426749cc2df391f388ac9453547554

SHA256
1cd5147045812a8d278f4cfb7421d96f25d304dcec411df74e656a166522a9bb

SHA512
9df9117d11c0bb79840609cdabd2d55d4e532f6654d44d9c457bce5634f1f793236b136984304d837d219a48d044ca7cb5b83d53fdfd125961af01db7023f05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\charset_normalizer\md.cp313-win_amd64.pyd

Filesize
9KB

MD5
499b4daf2025955396752d47aa542cbf

SHA1
40eda0bfe656c8dedad6483ff6dfcde4a3c09dee

SHA256
2d500e623d0050012e3b029b6c1814e2464ea9941d07208d6daf0ddcd5adbd99

SHA512
6e39a8b0ce27eede4d866b793c74c8e40c98739d3862f68aad28100f33f681e7a94e21942e0d03e1f06ee5d54d500796f54873b5ab149ef1428a831a7d367c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\crypto_clipper.json

Filesize
155B

MD5
8bff94a9573315a9d1820d9bb710d97f

SHA1
e69a43d343794524b771d0a07fd4cb263e5464d5

SHA256
3f7446866f42bcbeb8426324d3ea58f386f3171abe94279ea7ec773a4adde7d7

SHA512
d5ece1ea9630488245c578cb22d6d9d902839e53b4550c6232b4fb9389ef6c5d5392426ea4a9e3c461979d6d6aa94ddf3b2755f48e9988864788b530cdfcf80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\freetype.dll

Filesize
292KB

MD5
04a9825dc286549ee3fa29e2b06ca944

SHA1
5bed779bf591752bb7aa9428189ec7f3c1137461

SHA256
50249f68b4faf85e7cd8d1220b7626a86bc507af9ae400d08c8e365f9ab97cde

SHA512
0e937e4de6cbc9d40035b94c289c2798c77c44fc1dc7097201f9fab97c7ff9e56113c06c51693f09908283eda92945b36de67351f893d4e3162e67c078cff4ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libcrypto-3.dll

Filesize
1.6MB

MD5
8377fe5949527dd7be7b827cb1ffd324

SHA1
aa483a875cb06a86a371829372980d772fda2bf9

SHA256
88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d

SHA512
c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libffi-8.dll

Filesize
29KB

MD5
08b000c3d990bc018fcb91a1e175e06e

SHA1
bd0ce09bb3414d11c91316113c2becfff0862d0d

SHA256
135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece

SHA512
8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libjpeg-9.dll

Filesize
108KB

MD5
c22b781bb21bffbea478b76ad6ed1a28

SHA1
66cc6495ba5e531b0fe22731875250c720262db1

SHA256
1eed2385030348c84bbdb75d41d64891be910c27fab8d20fc9e85485fcb569dd

SHA512
9b42cad4a715680a27cd79f466fd2913649b80657ff042528cba2946631387ed9fb027014d215e1baf05839509ca5915d533b91aa958ae0525dea6e2a869b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libmodplug-1.dll

Filesize
117KB

MD5
2bb2e7fa60884113f23dcb4fd266c4a6

SHA1
36bbd1e8f7ee1747c7007a3c297d429500183d73

SHA256
9319bf867ed6007f3c61da139c2ab8b74a4cb68bf56265a101e79396941f6d3b

SHA512
1ddd4b9b9238c1744e0a1fe403f136a1def8df94814b405e7b01dd871b3f22a2afe819a26e08752142f127c3efe4ebae8bfd1bd63563d5eb98b4644426f576b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libogg-0.dll

Filesize
16KB

MD5
0d65168162287df89af79bb9be79f65b

SHA1
3e5af700b8c3e1a558105284ecd21b73b765a6dc

SHA256
2ec2322aec756b795c2e614dab467ef02c3d67d527ad117f905b3ab0968ccf24

SHA512
69af81fd2293c31f456b3c78588bb6a372fe4a449244d74bfe5bfaa3134a0709a685725fa05055cfd261c51a96df4b7ebd8b9e143f0e9312c374e54392f8a2c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libopus-0.dll

Filesize
181KB

MD5
3fb9d9e8daa2326aad43a5fc5ddab689

SHA1
55523c665414233863356d14452146a760747165

SHA256
fd8de9169ccf53c5968eec0c90e9ff3a66fb451a5bf063868f3e82007106b491

SHA512
f263ea6e0fab84a65fe3a9b6c0fe860919eee828c84b888a5aa52dea540434248d1e810a883a2aff273cd9f22c607db966dd8776e965be6d2cfe1b50a1af1f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libopus-0.x64.dll

Filesize
217KB

MD5
e56f1b8c782d39fd19b5c9ade735b51b

SHA1
3d1dc7e70a655ba9058958a17efabe76953a00b4

SHA256
fa8715dd0df84fdedbe4aa17763b2ab0db8941fa33421b6d42e25e59c4ae8732

SHA512
b7702e48b20a8991a5c537f5ba22834de8bb4ba55862b75024eace299263963b953606ee29e64d68b438bb0904273c4c20e71f22ccef3f93552c36fb2d1b2c46

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libopusfile-0.dll

Filesize
26KB

MD5
2d5274bea7ef82f6158716d392b1be52

SHA1
ce2ff6e211450352eec7417a195b74fbd736eb24

SHA256
6dea07c27c0cc5763347357e10c3b17af318268f0f17c7b165325ce524a0e8d5

SHA512
9973d68b23396b3aa09d2079d18f2c463e807c9c1fdf4b1a5f29d561e8d5e62153e0c7be23b63975ad179b9599ff6b0cf08ebdbe843d194483e7ec3e7aeb232a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libpng16-16.dll

Filesize
98KB

MD5
55009dd953f500022c102cfb3f6a8a6c

SHA1
07af9f4d456ddf86a51da1e4e4c5b54b0cf06ddb

SHA256
20391787cba331cfbe32fbf22f328a0fd48924e944e80de20ba32886bf4b6fd2

SHA512
4423d3ec8fef29782f3d4a21feeac9ba24c9c765d770b2920d47b4fb847a96ff5c793b20373833b4ff8bc3d8fa422159c64beffb78ce5768ed22742740a8c6c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libssl-3.dll

Filesize
221KB

MD5
b2e766f5cf6f9d4dcbe8537bc5bded2f

SHA1
331269521ce1ab76799e69e9ae1c3b565a838574

SHA256
3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4

SHA512
5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libtiff-5.dll

Filesize
127KB

MD5
ebad1fa14342d14a6b30e01ebc6d23c1

SHA1
9c4718e98e90f176c57648fa4ed5476f438b80a7

SHA256
4f50820827ac76042752809479c357063fe5653188654a6ba4df639da2fbf3ca

SHA512
91872eaa1f3f45232ab2d753585e650ded24c6cc8cc1d2a476fa98a61210177bd83570c52594b5ad562fc27cb76e034122f16a922c6910e4ed486da1d3c45c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\libwebp-7.dll

Filesize
192KB

MD5
b0dd211ec05b441767ea7f65a6f87235

SHA1
280f45a676c40bd85ed5541ceb4bafc94d7895f3

SHA256
fc06b8f92e86b848a17eaf7ed93464f54ed1f129a869868a74a75105ff8ce56e

SHA512
eaeb83e46c8ca261e79b3432ec2199f163c44f180eb483d66a71ad530ba488eb4cdbd911633e34696a4ccc035e238bc250a8247f318aa2f0cd9759cad4f90fff

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\portmidi.dll

Filesize
18KB

MD5
0df0699727e9d2179f7fd85a61c58bdf

SHA1
82397ee85472c355725955257c0da207fa19bf59

SHA256
97a53e8de3f1b2512f0295b5de98fa7a23023a0e4c4008ae534acdba54110c61

SHA512
196e41a34a60de83cb24caa5fc95820fd36371719487350bc2768354edf39eeb6c7860ff3fd9ecf570abb4288523d7ab934e86e85202b9753b135d07180678cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\pyexpat.pyd

Filesize
89KB

MD5
46c06ec5b8f34ba97f7903a5d4e86a94

SHA1
bb9de5d26854c2481a014de43bde33b4d0ab6829

SHA256
e304d3d2baf8e9f7c967b7326c85c6035cedb15954b61200b68ab4131775b51b

SHA512
e7e08b04adaa4540ddfbcc734759246df0e287b4974fab8f38715a390e49e877699b1ee2cdc555942429a5bcae7de35548476613eeffb8064f844a566b4411fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\python3.DLL

Filesize
70KB

MD5
98b008be9834bfc362b4c2eef4e8cdb9

SHA1
a4a50ced1329c3986e3c1576f089b25aff5ffdf2

SHA256
4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638

SHA512
d594ffd7d44d4d862475711973df87b08fb63a900ddfd87c7771ad27f0cc71e5fbdce92da4d4ad5856fe3cfb803257ce0b71cd8dc24ca5c421ddb1b9b44c7881

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\python313.dll

Filesize
1.8MB

MD5
2a4aad7818d527bbea76e9e81077cc21

SHA1
4db3b39874c01bf3ba1ab8659957bbc28aab1ab2

SHA256
4712a6bb81b862fc292fcd857cef931ca8e4c142e70eaa4fd7a8d0a96aff5e7e

SHA512
d10631b7fc25a8b9cc038514e9db1597cec0580ee34a56ce5cfc5a33e7010b5e1df7f15ec30ebb351356e2b815528fb4161956f26b5bfaf3dce7bc6701b79c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\select.pyd

Filesize
26KB

MD5
fbb31cb3990b267f9c5fb02d1aa21229

SHA1
cdae1c90d80c81927edb533fb5850c6efd541812

SHA256
8e2c5b74031b80a20bd16c149a389e60b3845d9719d97e030c42e9718cc08937

SHA512
af71f8be59d062cb4d095772e30ba63d0fef1e8285d549d7638c009cd67a2610f6d07e486e75f3eb1d94d8dc349d92b996f3ef83bd1d1c3617ac801d571be439

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\sqlite3.dll

Filesize
645KB

MD5
a7a7f5664333083d7270b6f6373c18b2

SHA1
f8b7729e18c1dad2974514fc685aaa05ed3ff513

SHA256
85b1d4d0b7db01ecb9b8c6b1b68ab122e0807eaa607551ba08849fdd957b889a

SHA512
cd9a0d4a55a58f18ce565f1525339e84f22496b6264f1fa235310ff6fa3531a0b24fe6e90bdf21b8f9ef2556e726480fe3bd7e69d737f5a580d6bd3e0b8d799f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\tcl86t.dll

Filesize
661KB

MD5
85e80ff00391700f9a2070834b0e33a8

SHA1
728a04d86d2411f277ddbaef9add929c5f4cdfc1

SHA256
0e412a521c89dda73bdd5539dd0fd203576d17de4126e925597f6b531f0e4acd

SHA512
d703a5eb72b760059b88a90c4a9193b594a58279625bdc653d16cdfde43fe1f90efe59a3744854f83cf7fb9d40c4482703f32ccbdac28bc0b506739765e60bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\tk86t.dll

Filesize
637KB

MD5
9831f1324f9deb5b1fd835ab89eb1cfe

SHA1
f8f59a57fb44042642343da95e44c20f9b16d916

SHA256
7ebf6781c4f7dbefa440feb44cc87673fb42d117422b8ab2fea7de43c4eccf01

SHA512
8248509d6ddf99b87cf0f43f50cf5b6cbe1e2997449931f078d6def152970e3994fc3cf7ce31e916dd27d4b6c97b7825a0b5131c2a9f085e1fcc1876c7d16f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\unicodedata.pyd

Filesize
261KB

MD5
48a942c3930a1fee7d4404989171f5fb

SHA1
b6ea31aedbc3d17136b7c7015f687020dd8723d4

SHA256
bc52593f047cba026641ebd758133551289dcca17817c836cbb006d4529d7aa7

SHA512
dcea8380f7c7a38cc827bd685cd76ac4d3dc2635f42675f5afaa8ab9e07fb72fc5f6e6fc246bb82f88bf8459caa09f4a0dd6c0d145e245986cfd15d0a49d1c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI28802\zlib1.dll

Filesize
52KB

MD5
ee06185c239216ad4c70f74e7c011aa6

SHA1
40e66b92ff38c9b1216511d5b1119fe9da6c2703

SHA256
0391066f3e6385a9c0fe7218c38f7bd0b3e0da0f15a98ebb07f1ac38d6175466

SHA512
baae562a53d491e19dbf7ee2cff4c13d42de6833036bfdaed9ed441bcbf004b68e4088bd453b7413d60faaf1b334aee71241ba468437d49050b8ccfa9232425d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3036_1042444916\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\Downloads\ArcticBomb.exe

Filesize
125KB

MD5
ea534626d73f9eb0e134de9885054892

SHA1
ab03e674b407aecf29c907b39717dec004843b13

SHA256
322eb96fc33119d8ed21b45f1cd57670f74fb42fd8888275ca4879dce1c1511c

SHA512
c8cda90323fd94387a566641ec48cb086540a400726032f3261151afe8a981730688a4dcd0983d9585355e22833a035ef627dbd1f643c4399f9ddce118a3a851

Download Submit
C:\Users\Admin\Downloads\Avoid.exe

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
C:\Users\Admin\Downloads\BlueScreen.exe

Filesize
9KB

MD5
b01ee228c4a61a5c06b01160790f9f7c

SHA1
e7cc238b6767401f6e3018d3f0acfe6d207450f8

SHA256
14e6ac84d824c0cf6ea8ebb5b3be10f8893449474096e59ff0fd878d49d0c160

SHA512
c849231c19590e61fbf15847af5062f817247f2bcd476700f1e1fa52dcafa5f0417cc01906b44c890be8cef9347e3c8f6b1594d750b1cebdd6a71256fed79140

Download Submit
C:\Users\Admin\Downloads\CrimsonRAT.exe

Filesize
84KB

MD5
b6e148ee1a2a3b460dd2a0adbf1dd39c

SHA1
ec0efbe8fd2fa5300164e9e4eded0d40da549c60

SHA256
dc31e710277eac1b125de6f4626765a2684d992147691a33964e368e5f269cba

SHA512
4b8c62ddfc7cd3e5ce1f8b5a1ba4a611ab1bfccf81d80cf2cfc831cffa1d7a4b6da0494616a53b419168bc3a324b57382d4a6186af083de6fc93d144c4503741

Download Submit
C:\Users\Admin\Downloads\DanaBot.exe

Filesize
2.7MB

MD5
48d8f7bbb500af66baa765279ce58045

SHA1
2cdb5fdeee4e9c7bd2e5f744150521963487eb71

SHA256
db0d72bc7d10209f7fa354ec100d57abbb9fe2e57ce72789f5f88257c5d3ebd1

SHA512
aef8aa8e0d16aab35b5cc19487e53583691e4471064bc556a2ee13e94a0546b54a33995739f0fa3c4de6ff4c6abf02014aef3efb0d93ca6847bad2220c3302bd

Download Submit
C:\Users\Admin\Downloads\DesktopBoom.exe

Filesize
1.1MB

MD5
f0a661d33aac3a3ce0c38c89bec52f89

SHA1
709d6465793675208f22f779f9e070ed31d81e61

SHA256
c20e78ce9028299d566684d35b1230d055e5ea0e9b94d0aff58f650e0468778a

SHA512
57cdb3c38f2e90d03e6dc1f9d8d1131d40d3919f390bb1783343c82465461319e70483dc3cd3efdbd9a62dfc88d74fc706f05d760ffd8506b16fd7686e414443

Download Submit
C:\Users\Admin\Downloads\Fagot.a.exe

Filesize
373KB

MD5
30cdab5cf1d607ee7b34f44ab38e9190

SHA1
d4823f90d14eba0801653e8c970f47d54f655d36

SHA256
1517527c1d705a6ebc6ec9194aa95459e875ac3902a9f4aab3bf24b6a6f8407f

SHA512
b465f3b734beaea3951ff57759f13971649b549fafca71342b52d7e74949e152c0fbafe2df40354fc00b5dc8c767f3f5c6940e4ba308888e4395d8fd21e402b3

Download Submit
C:\Users\Admin\Downloads\Launcher.exe

Filesize
197KB

MD5
7506eb94c661522aff09a5c96d6f182b

SHA1
329bbdb1f877942d55b53b1d48db56a458eb2310

SHA256
d5b962dfe37671b5134f0b741a662610b568c2b5374010ee92b5b7857d87872c

SHA512
d815a9391ef3d508b89fc221506b95f4c92d586ec38f26aec0f239750f34cf398eed3d818fa439f6aa6ed3b30f555a1903d93eeeec133b80849a4aa6685ec070

Download Submit
C:\Users\Admin\Downloads\MadMan.exe

Filesize
2KB

MD5
a56d479405b23976f162f3a4a74e48aa

SHA1
f4f433b3f56315e1d469148bdfd835469526262f

SHA256
17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23

SHA512
f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a

Download Submit
C:\Users\Admin\Downloads\MistInfected_newest.exe

Filesize
22KB

MD5
1e527b9018e98351782da198e9b030dc

SHA1
647122775c704548a460d6d4a2e2ff0f2390a506

SHA256
5f7471c215b433f1b28dd4b328b99362099b6df7cb9e5c1d86a756388e0c7aeb

SHA512
4a11c811f30016218075d43a9f983fa7a484a06f22d625b1bd2d92b4cfabbfb142945ca0a9ca1cf91391a3e73c154f6121140d2f1d42aa35ad7f10817534a21b

Download Submit
C:\Users\Admin\Downloads\MistInstaller.exe

Filesize
83KB

MD5
8813125a606768fdf8df506029daa16f

SHA1
48e825f14522bd4d149ef8b426af81eec0287947

SHA256
323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c

SHA512
9486a027029a27cbf0424760625c08d73aa62e28e45081751c5bada7c07ca05b4e44239da7774cf4f76298fb6b71769ae62595ae439b470c8308d39e1b2289d8

Download Submit
C:\Users\Admin\Downloads\MistInstallerRC.exe

Filesize
83KB

MD5
d81acaef0db08aac297d4bd3c58ddf50

SHA1
02e6ac2c001c639078c3e842132f91509a6f7466

SHA256
95d5594cac9cfa5826e1c0b12fec980ff8a01136364aed2831164b46cbb13ca1

SHA512
45b1f047816f4ba8e730cf6914331f9ced81c1e6614f594a748eb6469efb2f311f0ef86e3241cafb2794b580df14302f9cb279175bc1064e79c6c501fa2dc738

Download Submit
C:\Users\Admin\Downloads\SpySheriff.exe

Filesize
48KB

MD5
ab3e43a60f47a98962d50f2da0507df7

SHA1
4177228a54c15ac42855e87854d4cd9a1722fe39

SHA256
4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

SHA512
9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f

Download Submit
C:\Users\Admin\Downloads\WinNuke.98.exe

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\YouAreAnIdiot.exe

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
memory/1672-3793-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2708-3819-0x0000000002150000-0x00000000023BB000-memory.dmp

Filesize
2.4MB

Download
memory/2868-1266-0x00007FF879510000-0x00007FF87952B000-memory.dmp

Filesize
108KB

Download
memory/2868-1251-0x00007FF880500000-0x00007FF88050C000-memory.dmp

Filesize
48KB

Download
memory/2868-1366-0x00007FF888870000-0x00007FF88887B000-memory.dmp

Filesize
44KB

Download
memory/2868-1365-0x00007FF888880000-0x00007FF88888C000-memory.dmp

Filesize
48KB

Download
memory/2868-1364-0x00007FF888920000-0x00007FF88892B000-memory.dmp

Filesize
44KB

Download
memory/2868-1363-0x00007FF888930000-0x00007FF88893C000-memory.dmp

Filesize
48KB

Download
memory/2868-1362-0x00007FF888940000-0x00007FF88894B000-memory.dmp

Filesize
44KB

Download
memory/2868-1361-0x00007FF888950000-0x00007FF88895B000-memory.dmp

Filesize
44KB

Download
memory/2868-1358-0x00007FF888A40000-0x00007FF888A68000-memory.dmp

Filesize
160KB

Download
memory/2868-1357-0x00007FF888C60000-0x00007FF888C6B000-memory.dmp

Filesize
44KB

Download
memory/2868-1356-0x00007FF888EE0000-0x00007FF888EED000-memory.dmp

Filesize
52KB

Download
memory/2868-1355-0x00007FF888A70000-0x00007FF888B3E000-memory.dmp

Filesize
824KB

Download
memory/2868-1354-0x00007FF888EF0000-0x00007FF888F23000-memory.dmp

Filesize
204KB

Download
memory/2868-1350-0x00007FF888F50000-0x00007FF888F64000-memory.dmp

Filesize
80KB

Download
memory/2868-1349-0x00007FF888F70000-0x00007FF888F9B000-memory.dmp

Filesize
172KB

Download
memory/2868-1348-0x00007FF8891E0000-0x00007FF8891F9000-memory.dmp

Filesize
100KB

Download
memory/2868-1347-0x00007FF88E1B0000-0x00007FF88E1BF000-memory.dmp

Filesize
60KB

Download
memory/2868-1345-0x00007FF879AC0000-0x00007FF87A124000-memory.dmp

Filesize
6.4MB

Download
memory/2868-1384-0x00007FF879230000-0x00007FF87927D000-memory.dmp

Filesize
308KB

Download
memory/2868-1359-0x00007FF888980000-0x00007FF888A33000-memory.dmp

Filesize
716KB

Download
memory/2868-1353-0x00007FF889D70000-0x00007FF889D7D000-memory.dmp

Filesize
52KB

Download
memory/2868-1352-0x00007FF888F30000-0x00007FF888F49000-memory.dmp

Filesize
100KB

Download
memory/2868-1346-0x00007FF889200000-0x00007FF889227000-memory.dmp

Filesize
156KB

Download
memory/2868-1368-0x00007FF880520000-0x00007FF88052D000-memory.dmp

Filesize
52KB

Download
memory/2868-1369-0x00007FF880510000-0x00007FF88051E000-memory.dmp

Filesize
56KB

Download
memory/2868-1370-0x00007FF880500000-0x00007FF88050C000-memory.dmp

Filesize
48KB

Download
memory/2868-1371-0x00007FF8804F0000-0x00007FF8804FB000-memory.dmp

Filesize
44KB

Download
memory/2868-1372-0x00007FF8804E0000-0x00007FF8804EB000-memory.dmp

Filesize
44KB

Download
memory/2868-1373-0x00007FF8804D0000-0x00007FF8804DC000-memory.dmp

Filesize
48KB

Download
memory/2868-1374-0x00007FF8804C0000-0x00007FF8804CB000-memory.dmp

Filesize
44KB

Download
memory/2868-1375-0x00007FF8804B0000-0x00007FF8804BD000-memory.dmp

Filesize
52KB

Download
memory/2868-1376-0x00007FF87FEB0000-0x00007FF87FEC2000-memory.dmp

Filesize
72KB

Download
memory/2868-1377-0x00007FF87FEA0000-0x00007FF87FEAC000-memory.dmp

Filesize
48KB

Download
memory/2868-1378-0x00007FF87FE80000-0x00007FF87FE96000-memory.dmp

Filesize
88KB

Download
memory/2868-1379-0x00007FF87FE60000-0x00007FF87FE72000-memory.dmp

Filesize
72KB

Download
memory/2868-1380-0x00007FF879560000-0x00007FF879574000-memory.dmp

Filesize
80KB

Download
memory/2868-1381-0x00007FF879530000-0x00007FF879552000-memory.dmp

Filesize
136KB

Download
memory/2868-1382-0x00007FF879510000-0x00007FF87952B000-memory.dmp

Filesize
108KB

Download
memory/2868-1383-0x00007FF879280000-0x00007FF879298000-memory.dmp

Filesize
96KB

Download
memory/2868-1387-0x00007FF8791A0000-0x00007FF8791BE000-memory.dmp

Filesize
120KB

Download
memory/2868-1388-0x00007FF879180000-0x00007FF879194000-memory.dmp

Filesize
80KB

Download
memory/2868-1389-0x00007FF879120000-0x00007FF87917D000-memory.dmp

Filesize
372KB

Download
memory/2868-1390-0x00007FF8790E0000-0x00007FF879118000-memory.dmp

Filesize
224KB

Download
memory/2868-1385-0x00007FF879210000-0x00007FF879221000-memory.dmp

Filesize
68KB

Download
memory/2868-1351-0x00007FF879580000-0x00007FF879AB3000-memory.dmp

Filesize
5.2MB

Download
memory/2868-1386-0x00007FF8791D0000-0x00007FF879202000-memory.dmp

Filesize
200KB

Download
memory/2868-1360-0x00007FF888970000-0x00007FF88897F000-memory.dmp

Filesize
60KB

Download
memory/2868-1340-0x00007FF878DC0000-0x00007FF878DCD000-memory.dmp

Filesize
52KB

Download
memory/2868-1160-0x00007FF879AC0000-0x00007FF87A124000-memory.dmp

Filesize
6.4MB

Download
memory/2868-1310-0x00007FF878280000-0x00007FF8782D9000-memory.dmp

Filesize
356KB

Download
memory/2868-1309-0x00007FF8782E0000-0x00007FF878ADE000-memory.dmp

Filesize
8.0MB

Download
memory/2868-1308-0x00007FF878AE0000-0x00007FF878D45000-memory.dmp

Filesize
2.4MB

Download
memory/2868-1303-0x00007FF878DA0000-0x00007FF878DB2000-memory.dmp

Filesize
72KB

Download
memory/2868-1304-0x00007FF878D90000-0x00007FF878D9C000-memory.dmp

Filesize
48KB

Download
memory/2868-1305-0x00007FF878ED0000-0x00007FF87904F000-memory.dmp

Filesize
1.5MB

Download
memory/2868-1306-0x00007FF878D50000-0x00007FF878D86000-memory.dmp

Filesize
216KB

Download
memory/2868-1307-0x00007FF878EB0000-0x00007FF878EC8000-memory.dmp

Filesize
96KB

Download
memory/2868-1302-0x00007FF879050000-0x00007FF879075000-memory.dmp

Filesize
148KB

Download
memory/2868-1292-0x00007FF878E30000-0x00007FF878E3D000-memory.dmp

Filesize
52KB

Download
memory/2868-1293-0x00007FF878E20000-0x00007FF878E2E000-memory.dmp

Filesize
56KB

Download
memory/2868-1294-0x00007FF878E10000-0x00007FF878E1C000-memory.dmp

Filesize
48KB

Download
memory/2868-1295-0x00007FF878E00000-0x00007FF878E0B000-memory.dmp

Filesize
44KB

Download
memory/2868-1296-0x00007FF878DF0000-0x00007FF878DFB000-memory.dmp

Filesize
44KB

Download
memory/2868-1297-0x00007FF878DE0000-0x00007FF878DEC000-memory.dmp

Filesize
48KB

Download
memory/2868-1298-0x00007FF878DD0000-0x00007FF878DDB000-memory.dmp

Filesize
44KB

Download
memory/2868-1299-0x00007FF8790B0000-0x00007FF8790DA000-memory.dmp

Filesize
168KB

Download
memory/2868-1300-0x00007FF879080000-0x00007FF8790AF000-memory.dmp

Filesize
188KB

Download
memory/2868-1301-0x00007FF878DC0000-0x00007FF878DCD000-memory.dmp

Filesize
52KB

Download
memory/2868-1284-0x00007FF878EA0000-0x00007FF878EAB000-memory.dmp

Filesize
44KB

Download
memory/2868-1285-0x00007FF878E90000-0x00007FF878E9B000-memory.dmp

Filesize
44KB

Download
memory/2868-1286-0x00007FF878E80000-0x00007FF878E8C000-memory.dmp

Filesize
48KB

Download
memory/2868-1289-0x00007FF878E50000-0x00007FF878E5B000-memory.dmp

Filesize
44KB

Download
memory/2868-1290-0x00007FF878E40000-0x00007FF878E4C000-memory.dmp

Filesize
48KB

Download
memory/2868-1291-0x00007FF879120000-0x00007FF87917D000-memory.dmp

Filesize
372KB

Download
memory/2868-1170-0x00007FF88E1B0000-0x00007FF88E1BF000-memory.dmp

Filesize
60KB

Download
memory/2868-1168-0x00007FF889200000-0x00007FF889227000-memory.dmp

Filesize
156KB

Download
memory/2868-1175-0x00007FF8891E0000-0x00007FF8891F9000-memory.dmp

Filesize
100KB

Download
memory/2868-1176-0x00007FF888F70000-0x00007FF888F9B000-memory.dmp

Filesize
172KB

Download
memory/2868-1218-0x00007FF888F50000-0x00007FF888F64000-memory.dmp

Filesize
80KB

Download
memory/2868-1220-0x00007FF879580000-0x00007FF879AB3000-memory.dmp

Filesize
5.2MB

Download
memory/2868-1224-0x00007FF889D70000-0x00007FF889D7D000-memory.dmp

Filesize
52KB

Download
memory/2868-1229-0x00007FF888A70000-0x00007FF888B3E000-memory.dmp

Filesize
824KB

Download
memory/2868-1228-0x00007FF879AC0000-0x00007FF87A124000-memory.dmp

Filesize
6.4MB

Download
memory/2868-1227-0x00007FF888EF0000-0x00007FF888F23000-memory.dmp

Filesize
204KB

Download
memory/2868-1283-0x00007FF8791D0000-0x00007FF879202000-memory.dmp

Filesize
200KB

Download
memory/2868-1287-0x00007FF878E70000-0x00007FF878E7B000-memory.dmp

Filesize
44KB

Download
memory/2868-1288-0x00007FF878E60000-0x00007FF878E6C000-memory.dmp

Filesize
48KB

Download
memory/2868-1281-0x00007FF879210000-0x00007FF879221000-memory.dmp

Filesize
68KB

Download
memory/2868-1282-0x00007FF878EB0000-0x00007FF878EC8000-memory.dmp

Filesize
96KB

Download
memory/2868-1280-0x00007FF878ED0000-0x00007FF87904F000-memory.dmp

Filesize
1.5MB

Download
memory/2868-1279-0x00007FF879230000-0x00007FF87927D000-memory.dmp

Filesize
308KB

Download
memory/2868-1277-0x00007FF879280000-0x00007FF879298000-memory.dmp

Filesize
96KB

Download
memory/2868-1278-0x00007FF879050000-0x00007FF879075000-memory.dmp

Filesize
148KB

Download
memory/2868-1276-0x00007FF879080000-0x00007FF8790AF000-memory.dmp

Filesize
188KB

Download
memory/2868-1275-0x00007FF8790B0000-0x00007FF8790DA000-memory.dmp

Filesize
168KB

Download
memory/2868-1274-0x00007FF8790E0000-0x00007FF879118000-memory.dmp

Filesize
224KB

Download
memory/2868-1273-0x00007FF879120000-0x00007FF87917D000-memory.dmp

Filesize
372KB

Download
memory/2868-1272-0x00007FF879180000-0x00007FF879194000-memory.dmp

Filesize
80KB

Download
memory/2868-1271-0x00007FF8791A0000-0x00007FF8791BE000-memory.dmp

Filesize
120KB

Download
memory/2868-1270-0x00007FF8791D0000-0x00007FF879202000-memory.dmp

Filesize
200KB

Download
memory/2868-1269-0x00007FF879210000-0x00007FF879221000-memory.dmp

Filesize
68KB

Download
memory/2868-1268-0x00007FF879230000-0x00007FF87927D000-memory.dmp

Filesize
308KB

Download
memory/2868-1267-0x00007FF879280000-0x00007FF879298000-memory.dmp

Filesize
96KB

Download
memory/2868-1239-0x00007FF879580000-0x00007FF879AB3000-memory.dmp

Filesize
5.2MB

Download
memory/2868-1240-0x00007FF888950000-0x00007FF88895B000-memory.dmp

Filesize
44KB

Download
memory/2868-1241-0x00007FF888930000-0x00007FF88893C000-memory.dmp

Filesize
48KB

Download
memory/2868-1242-0x00007FF888920000-0x00007FF88892B000-memory.dmp

Filesize
44KB

Download
memory/2868-1223-0x00007FF888F30000-0x00007FF888F49000-memory.dmp

Filesize
100KB

Download
memory/2868-1244-0x00007FF888880000-0x00007FF88888C000-memory.dmp

Filesize
48KB

Download
memory/2868-1232-0x00007FF888EE0000-0x00007FF888EED000-memory.dmp

Filesize
52KB

Download
memory/2868-1245-0x00007FF888870000-0x00007FF88887B000-memory.dmp

Filesize
44KB

Download
memory/2868-1231-0x00007FF889200000-0x00007FF889227000-memory.dmp

Filesize
156KB

Download
memory/2868-1246-0x00007FF882620000-0x00007FF88262C000-memory.dmp

Filesize
48KB

Download
memory/2868-1367-0x00007FF882620000-0x00007FF88262C000-memory.dmp

Filesize
48KB

Download
memory/2868-1252-0x00007FF8804F0000-0x00007FF8804FB000-memory.dmp

Filesize
44KB

Download
memory/2868-1253-0x00007FF8804E0000-0x00007FF8804EB000-memory.dmp

Filesize
44KB

Download
memory/2868-1254-0x00007FF8804D0000-0x00007FF8804DC000-memory.dmp

Filesize
48KB

Download
memory/2868-1255-0x00007FF8804C0000-0x00007FF8804CB000-memory.dmp

Filesize
44KB

Download
memory/2868-1257-0x00007FF888A40000-0x00007FF888A68000-memory.dmp

Filesize
160KB

Download
memory/2868-1259-0x00007FF888980000-0x00007FF888A33000-memory.dmp

Filesize
716KB

Download
memory/2868-1261-0x00007FF888970000-0x00007FF88897F000-memory.dmp

Filesize
60KB

Download
memory/2868-1264-0x00007FF879560000-0x00007FF879574000-memory.dmp

Filesize
80KB

Download
memory/2868-1265-0x00007FF879530000-0x00007FF879552000-memory.dmp

Filesize
136KB

Download
memory/2868-1262-0x00007FF87FE80000-0x00007FF87FE96000-memory.dmp

Filesize
88KB

Download
memory/2868-1263-0x00007FF87FE60000-0x00007FF87FE72000-memory.dmp

Filesize
72KB

Download
memory/2868-1260-0x00007FF87FEA0000-0x00007FF87FEAC000-memory.dmp

Filesize
48KB

Download
memory/2868-1258-0x00007FF87FEB0000-0x00007FF87FEC2000-memory.dmp

Filesize
72KB

Download
memory/2868-1256-0x00007FF8804B0000-0x00007FF8804BD000-memory.dmp

Filesize
52KB

Download
memory/2868-1247-0x00007FF880520000-0x00007FF88052D000-memory.dmp

Filesize
52KB

Download
memory/2868-1248-0x00007FF888EF0000-0x00007FF888F23000-memory.dmp

Filesize
204KB

Download
memory/2868-1249-0x00007FF888A70000-0x00007FF888B3E000-memory.dmp

Filesize
824KB

Download
memory/2868-1250-0x00007FF880510000-0x00007FF88051E000-memory.dmp

Filesize
56KB

Download
memory/2868-1243-0x00007FF888940000-0x00007FF88894B000-memory.dmp

Filesize
44KB

Download
memory/2868-1237-0x00007FF888F50000-0x00007FF888F64000-memory.dmp

Filesize
80KB

Download
memory/2868-1238-0x00007FF888970000-0x00007FF88897F000-memory.dmp

Filesize
60KB

Download
memory/2868-1235-0x00007FF888A40000-0x00007FF888A68000-memory.dmp

Filesize
160KB

Download
memory/2868-1236-0x00007FF888980000-0x00007FF888A33000-memory.dmp

Filesize
716KB

Download
memory/2868-1234-0x00007FF888C60000-0x00007FF888C6B000-memory.dmp

Filesize
44KB

Download
memory/3260-3594-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3586-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3593-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3590-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3591-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3592-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3595-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3584-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3585-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3260-3596-0x000001F0809D0000-0x000001F0809D1000-memory.dmp

Filesize
4KB

Download
memory/3824-3316-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5952-3815-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/5952-3804-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/6188-3820-0x0000000002530000-0x000000000279B000-memory.dmp

Filesize
2.4MB

Download