Resubmissions
31-03-2023 23:46
230331-3sn6dafg8x 10Analysis
-
max time kernel
630s -
max time network
663s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 23:46
Static task
static1
Behavioral task
behavioral1
Sample
MEMZ.zip
Resource
win10v2004-20230220-en
Errors
General
-
Target
MEMZ.zip
-
Size
8KB
-
MD5
69977a5d1c648976d47b69ea3aa8fcaa
-
SHA1
4630cc15000c0d3149350b9ecda6cfc8f402938a
-
SHA256
61ca4d8dd992c763b47bebb9b5facb68a59ff0a594c2ff215aa4143b593ae9dc
-
SHA512
ba0671c72cd4209fabe0ee241b71e95bd9d8e78d77a893c94f87de5735fd10ea8b389cf4c48462910042c312ddff2f527999cd2f845d0c19a8673dbceda369fd
-
SSDEEP
192:8xI2dw4xXlsUjs1ScK3ZeD6dUqENj710+MZ9R1SVBIpp:b2dHiosKA6OqEx2t9R1SLIL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
MsiExec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Program Files (x86)\\Def Group\\PC Defender\\pcdef.exe\"" MsiExec.exe -
Processes:
antivirus-platinum.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" antivirus-platinum.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
antivirus-platinum.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" antivirus-platinum.exe -
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
302746537.exewscript.exewscript.exewscript.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 302746537.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 7 IoCs
Processes:
302746537.exeantivirus-platinum.exerundelay.exerundelay.exerhc7hlj0ecwn.exepphc3hlj0ecwn.exerhc7hlj0ecwn.exepid process 4592 302746537.exe 5000 antivirus-platinum.exe 3156 rundelay.exe 1748 rundelay.exe 3544 rhc7hlj0ecwn.exe 4736 pphc3hlj0ecwn.exe 1852 rhc7hlj0ecwn.exe -
Loads dropped DLL 17 IoCs
Processes:
regsvr32.exeregsvr32.exeantivirus-platinum.exeEndermanch@XPAntivirus2008.exerhc7hlj0ecwn.exeEndermanch@XPAntivirus2008.exerhc7hlj0ecwn.exepid process 3632 regsvr32.exe 4712 regsvr32.exe 5000 antivirus-platinum.exe 5064 Endermanch@XPAntivirus2008.exe 5064 Endermanch@XPAntivirus2008.exe 5064 Endermanch@XPAntivirus2008.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 3524 Endermanch@XPAntivirus2008.exe 3524 Endermanch@XPAntivirus2008.exe 3524 Endermanch@XPAntivirus2008.exe 1852 rhc7hlj0ecwn.exe 1852 rhc7hlj0ecwn.exe 1852 rhc7hlj0ecwn.exe 1852 rhc7hlj0ecwn.exe -
Processes:
resource yara_rule C:\Windows\302746537.exe upx C:\Windows\302746537.exe upx C:\WINDOWS\302746537.exe upx behavioral1/memory/4592-572-0x0000000000400000-0x0000000000410000-memory.dmp upx C:\Windows\antivirus-platinum.exe upx \??\c:\windows\antivirus-platinum.exe upx behavioral1/memory/4592-585-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/5000-588-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/5000-1084-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Processes:
antivirus-platinum.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" antivirus-platinum.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
Endermanch@XPAntivirus2008.exeEndermanch@AntivirusPro2017.exeEndermanch@XPAntivirus2008.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Endermanch@XPAntivirus2008.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMrhc7hlj0ecwn = "C:\\Program Files (x86)\\rhc7hlj0ecwn\\rhc7hlj0ecwn.exe" Endermanch@XPAntivirus2008.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows\CurrentVersion\Run Endermanch@AntivirusPro2017.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Antivirus Pro 2017.zip\\Endermanch@AntivirusPro2017.exe" Endermanch@AntivirusPro2017.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Endermanch@XPAntivirus2008.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMrhc7hlj0ecwn = "C:\\Program Files (x86)\\rhc7hlj0ecwn\\rhc7hlj0ecwn.exe" Endermanch@XPAntivirus2008.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeEndermanch@AntivirusPro2017.exemsiexec.exedescription ioc process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\P: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\S: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\H: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\O: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\V: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\K: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\R: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\M: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\T: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\U: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\X: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\Y: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\J: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\N: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: Endermanch@AntivirusPro2017.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\N: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Endermanch@AntivirusPro2017.exedescription ioc process File opened for modification \??\PhysicalDrive0 Endermanch@AntivirusPro2017.exe -
Drops file in System32 directory 1 IoCs
Processes:
rhc7hlj0ecwn.exedescription ioc process File created C:\Windows\SysWOW64\pphc3hlj0ecwn.exe rhc7hlj0ecwn.exe -
Drops file in Program Files directory 31 IoCs
Processes:
Endermanch@XPAntivirus2008.exemsiexec.exeEndermanch@XPAntivirus2008.exesetup.exedescription ioc process File created C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\msvcr71.dll Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\Uninstall.exe Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\Def Group\PC Defender\prockill32.exe msiexec.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\MFC71ENU.DLL Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230401015134.pma setup.exe File created C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe msiexec.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\license.txt Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\MFC71.dll Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\3677bdb6-7193-46cd-8787-48172bc39e07.tmp setup.exe File created C:\Program Files (x86)\Def Group\PC Defender\uninstall.bat msiexec.exe File created C:\Program Files (x86)\Def Group\PC Defender\pcdef.exe msiexec.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\msvcp71.dll Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\msvcr71.dll Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe.local Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\MFC71ENU.DLL Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe.local Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe msiexec.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\msvcp71.dll Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\MFC71.dll Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\database.dat Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\MFC71ENU.DLL Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\license.txt Endermanch@XPAntivirus2008.exe File created C:\Program Files (x86)\Def Group\PC Defender\prockill64.exe msiexec.exe File created C:\Program Files (x86)\rhc7hlj0ecwn\database.dat Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\msvcp71.dll Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\MFC71.dll Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\msvcr71.dll Endermanch@XPAntivirus2008.exe File opened for modification C:\Program Files (x86)\rhc7hlj0ecwn\Uninstall.exe Endermanch@XPAntivirus2008.exe -
Drops file in Windows directory 22 IoCs
Processes:
Endermanch@AntivirusPlatinum.exemsiexec.exeattrib.exedescription ioc process File created C:\Windows\antivirus-platinum.exe Endermanch@AntivirusPlatinum.exe File created C:\Windows\Installer\SourceHash{456A3B12-8FE6-41AE-9E5C-5E55F0712C09} msiexec.exe File opened for modification C:\Windows\Installer\MSID0AA.tmp msiexec.exe File created C:\Windows\Installer\e5bcf94.msi msiexec.exe File created C:\Windows\302746537.exe Endermanch@AntivirusPlatinum.exe File opened for modification C:\Windows\Installer\e5bcf91.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\__tmp_rar_sfx_access_check_240782515 Endermanch@AntivirusPlatinum.exe File opened for modification C:\Windows\antivirus-platinum.exe Endermanch@AntivirusPlatinum.exe File created C:\Windows\COMCTL32.OCX Endermanch@AntivirusPlatinum.exe File opened for modification C:\Windows\COMCTL32.OCX Endermanch@AntivirusPlatinum.exe File created C:\Windows\MSCOMCTL.OCX Endermanch@AntivirusPlatinum.exe File opened for modification C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_FC03FB89D84E75F2C05EA5.exe msiexec.exe File created C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_368235FAFDAA3CD0178CB7.exe msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_FC03FB89D84E75F2C05EA5.exe msiexec.exe File opened for modification C:\Windows\Installer\{456A3B12-8FE6-41AE-9E5C-5E55F0712C09}\_368235FAFDAA3CD0178CB7.exe msiexec.exe File opened for modification C:\Windows\MSCOMCTL.OCX Endermanch@AntivirusPlatinum.exe File opened for modification C:\Windows\302746537.exe Endermanch@AntivirusPlatinum.exe File opened for modification C:\windows\antivirus-platinum.exe attrib.exe File created C:\Windows\Installer\e5bcf91.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\rhc7hlj0ecwn\Uninstall.exe nsis_installer_1 C:\Program Files (x86)\rhc7hlj0ecwn\Uninstall.exe nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exetaskmgr.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009865abc95f2d4b980000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009865abc90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809009865abc9000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000009865abc900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
chrome.exemsedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Processes:
antivirus-platinum.exeIEXPLORE.EXEiexplore.exeEndermanch@AntivirusPro2017.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" antivirus-platinum.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe30000000002000000000010660000000100002000000027b71b9b6ba10a64376f462a65a93f02ff4620d154586be9791f91b177054c83000000000e8000000002000020000000c7bcb164e4b864aecb283018ddd2572b91df93181b261db6b8db8b58d59acdb120000000e53eccd127a7831452686d26e16cb5d829ce91894e991e9b9465660c8d9b346f40000000078f2fb8c18664482bd324f95562ccc4a86bb7e5fbc769c8363fae8cc65acd085c377b92568d0866427803df4d0af6398d3074d68703b169bc39a9c2a578bec1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2029ed513d64d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1055f4513d64d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" Endermanch@AntivirusPro2017.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31024189" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000016b1b6fc7cfc59429b2ebf78760d5fe300000000020000000000106600000001000020000000ea6059de0bc73b596819832333c0ee171c2e48c13fafbbd8cea933994a000d8d000000000e80000000020000200000002e1a2e77476d06e532ef0c8917df037484b4e487ce698313a6a3b26dbc6b211f200000005659a56d4d57a141cb1328b0f766ff65c8474b4b83a6dd53bb28fdcd69a9e23140000000c06d387ba5ad5c4bf4a7f0dac48c3e82fb195c9a73a36f725edc10864e110a59cc8c9ae2ea66fc36d7a63f9e2b18672ca74aad7e50dc864c4c769b39d6cf67f3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1371688070" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main antivirus-platinum.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\GPU Endermanch@AntivirusPro2017.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7CE8B2D2-D030-11ED-9EF6-7E7B9EA57A36} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1371688070" iexplore.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main antivirus-platinum.exe Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31024189" iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
Processes:
antivirus-platinum.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" antivirus-platinum.exe Set value (str) \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" antivirus-platinum.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
MsiExec.exerundelay.exechrome.exemsiexec.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rundelay.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rundelay.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rundelay.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247872473525689" chrome.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\delrstrui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BPZVQXCUTNGUFLS.bat" MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings MsiExec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsiExec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MsiExec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rundelay.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" rundelay.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeregsvr32.exereg.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ = "Microsoft ImageList Control, version 5.0 (SP2)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877892-E026-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.ProgCtrl.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}\ = "TreeView General Property Page Object" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_\Version = "33554432" reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Version\ = "1.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl\CLSID\ = "{35053A22-8589-11D1-B16A-00C0F0283628}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\ = "Microsoft ProgressBar Control, version 5.0 (SP2)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E953-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ = "INode10" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F049-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\CLSID\ = "{0713E8D2-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3B-8596-11D1-B16A-00C0F0283628}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\ = "IImageCombo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID\ = "{1EFB6596-857C-11D1-B16A-00C0F0283628}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl\CurVer\ = "MSComctlLib.ListViewCtrl.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ = "IButtonMenu" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\ = "ListView Sort Property Page Object" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\ToolboxBitmap32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290\SourceList reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6E1B5150-DB62-11D0-A0D8-0080C7E7B78D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\ = "IListView" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB955-5C57-11CF-8993-00AA00688B10}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ListViewCtrl.2\CLSID\ = "{BDD1F04B-858B-11D1-B16A-00C0F0283628}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsiexec.exerhc7hlj0ecwn.exetaskmgr.exepid process 1928 chrome.exe 1928 chrome.exe 3756 chrome.exe 3756 chrome.exe 4248 msedge.exe 4248 msedge.exe 1404 msedge.exe 1404 msedge.exe 380 identity_helper.exe 380 identity_helper.exe 2608 msiexec.exe 2608 msiexec.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
rhc7hlj0ecwn.exepid process 3544 rhc7hlj0ecwn.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
chrome.exemsedge.exepid process 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exedescription pid process Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe Token: SeShutdownPrivilege 1928 chrome.exe Token: SeCreatePagefilePrivilege 1928 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exeEndermanch@AntivirusPro2017.exemsedge.exepid process 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 1404 msedge.exe 3348 Endermanch@AntivirusPro2017.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exeEndermanch@AntivirusPro2017.exerhc7hlj0ecwn.exetaskmgr.exepid process 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 1928 chrome.exe 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 3544 rhc7hlj0ecwn.exe 3348 Endermanch@AntivirusPro2017.exe 3544 rhc7hlj0ecwn.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe 4284 taskmgr.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
Endermanch@AntivirusPro2017.exeantivirus-platinum.exerhc7hlj0ecwn.exerhc7hlj0ecwn.exeiexplore.exeIEXPLORE.EXEpid process 3348 Endermanch@AntivirusPro2017.exe 3348 Endermanch@AntivirusPro2017.exe 5000 antivirus-platinum.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 1852 rhc7hlj0ecwn.exe 3544 rhc7hlj0ecwn.exe 3160 iexplore.exe 3160 iexplore.exe 4352 IEXPLORE.EXE 4352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1928 wrote to memory of 1564 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1564 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 1744 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 224 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 224 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe PID 1928 wrote to memory of 396 1928 chrome.exe chrome.exe -
System policy modification 1 TTPs 4 IoCs
Processes:
antivirus-platinum.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" antivirus-platinum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" antivirus-platinum.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MEMZ.zip1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd49619758,0x7ffd49619768,0x7ffd496197782⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4432 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4812 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2796 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4008 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2772 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 --field-trial-handle=1836,i,10375275235514973362,1151454853191054405,131072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017.zip\Endermanch@AntivirusPro2017.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Pro 2017.zip\Endermanch@AntivirusPro2017.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Platinum.zip\Endermanch@AntivirusPlatinum.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Antivirus Platinum.zip\Endermanch@AntivirusPlatinum.exe"1⤵
- Drops file in Windows directory
-
C:\WINDOWS\302746537.exe"C:\WINDOWS\302746537.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F43.tmp\302746537.bat" "3⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\comctl32.ocx4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\mscomctl.ocx4⤵
- Loads dropped DLL
- Modifies registry class
-
\??\c:\windows\antivirus-platinum.exec:\windows\antivirus-platinum.exe4⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://secureservices2010.webs.com/update/update.txt5⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd49bd46f8,0x7ffd49bd4708,0x7ffd49bd47186⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:26⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:36⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:16⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:86⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff6e3d75460,0x7ff6e3d75470,0x7ff6e3d754807⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15183670833740023048,9628524130375670969,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:86⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\attrib.exeattrib +h c:\windows\antivirus-platinum.exe4⤵
- Drops file in Windows directory
- Views/modifies file attributes
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\Temp1_PC Defender v2.zip\Endermanch@PCDefenderv2.msi"1⤵
- Enumerates connected drives
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7AB2DDDB09274385A6B686A784DF9406 E Global\MSI00002⤵
- Modifies WinLogon for persistence
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" COPY HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290_ /s /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\SysWOW64\reg.exe" DELETE HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\21B3A6546EF8EA14E9C5E5550F17C290 /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe" /C "DEL /F /Q C:\Windows\Prefetch\pcdef*"3⤵
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe"C:\Program Files (x86)\Def Group\PC Defender\rundelay.exe" "shutdown -r -t 0" 14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 05⤵
-
C:\Windows\SysWOW64\shutdown.exeshutdown -r -t 06⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\Downloads\XP Antivirus 2008\Endermanch@XPAntivirus2008.exe"C:\Users\Admin\Downloads\XP Antivirus 2008\Endermanch@XPAntivirus2008.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\wscript.exewscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\wscript.exewscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Register Antivirus XP 2008.lnk"2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c nbje.bat "C:\Users\Admin\Downloads\XP Antivirus 2008\Endermanch@XPAntivirus2008.exe"2⤵
-
C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe"C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\pphc3hlj0ecwn.exe"C:\Windows\system32\pphc3hlj0ecwn.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\Endermanch@XPAntivirus2008.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\Endermanch@XPAntivirus2008.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\wscript.exewscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Antivirus XP 2008.lnk"2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\wscript.exewscript //B C:\Users\Admin\AppData\Local\Temp\pin.vbs "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008" "Register Antivirus XP 2008.lnk"2⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c mofg.bat "C:\Users\Admin\AppData\Local\Temp\Temp1_XP Antivirus 2008.zip\Endermanch@XPAntivirus2008.exe"2⤵
-
C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe"C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f8 0x4d41⤵
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3160 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa397b055 /state1:0x41c64e6d1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Winlogon Helper DLL
1Registry Run Keys / Startup Folder
1Bootkit
1Hidden Files and Directories
1Defense Evasion
Modify Registry
7Disabling Security Tools
2Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Config.Msi\e5bcf93.rbsFilesize
14KB
MD589eb33b1b0b2d81e2918665a3ac6a485
SHA1806834f389a8712baa623ab420f127533ebe1ea7
SHA25676543ba8d5b478b9b6a716a80ecfe661f92a705463299a10e7722dc2d15cc982
SHA512418c3bfa17ef37f2f6dfbf6178dc213ffd876d44e0c04326e5682f4fd50b6832a363539d8c681dfa9af1c7426ce66e5a832a89cc4cda11d0256fb0785cb69b88
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeFilesize
43KB
MD5c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeFilesize
43KB
MD5c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
C:\Program Files (x86)\Def Group\PC Defender\rundelay.exeFilesize
43KB
MD5c05ccc260692e8bfb5b6ba7238dbb943
SHA14ad185a7acb1c4ffcb3c03daa77cc77a833ae7e6
SHA2560d58d2b03e3f6d5f32216e74badae8ad0d7f94cc4f207d06883ba953a1594cba
SHA5127707d1c3f9085a710527e2d1559c8268ca3a1fb70fca9f1cf391a02cd81002193c6971cefd7b00b371e14adf5ae7b83b63206b88ead13b04a20ad08c7154ac22
-
C:\Program Files (x86)\rhc7hlj0ecwn\MFC71.DLLFilesize
1.0MB
MD5f35a584e947a5b401feb0fe01db4a0d7
SHA1664dc99e78261a43d876311931694b6ef87cc8b9
SHA2564da5efdc46d126b45daeee8bc69c0ba2aa243589046b7dfd12a7e21b9bee6a32
SHA512b1ced222c3b7e63e22d093c8aa3467f5ea20312fe76a112baed7c63d238bbe8dee94dfe8f42474f7b1de7aa7acb8ba8e2b36fdd0a3cda83ee85ac9a34f859fa4
-
C:\Program Files (x86)\rhc7hlj0ecwn\MFC71.dllFilesize
1.0MB
MD5f35a584e947a5b401feb0fe01db4a0d7
SHA1664dc99e78261a43d876311931694b6ef87cc8b9
SHA2564da5efdc46d126b45daeee8bc69c0ba2aa243589046b7dfd12a7e21b9bee6a32
SHA512b1ced222c3b7e63e22d093c8aa3467f5ea20312fe76a112baed7c63d238bbe8dee94dfe8f42474f7b1de7aa7acb8ba8e2b36fdd0a3cda83ee85ac9a34f859fa4
-
C:\Program Files (x86)\rhc7hlj0ecwn\MFC71ENU.DLLFilesize
56KB
MD5baf751e7061ff626aa60f56d1d5d1fdc
SHA1b0382c3ac0c0dad7d793c9a3335316b5fcae2690
SHA256177b0bac987e7882449bd7c5900406f61a997f97ea1797614c8d86f40f03648b
SHA512f7333b481f1498b5eab2688856a5b86fec96b6bf7b781564dfcc018882ded4d7ee5a1fc0c2498607195a66d42a74034f9649a8b61fa548d3d6029f25c5a9648d
-
C:\Program Files (x86)\rhc7hlj0ecwn\MFC71ENU.DLLFilesize
56KB
MD5baf751e7061ff626aa60f56d1d5d1fdc
SHA1b0382c3ac0c0dad7d793c9a3335316b5fcae2690
SHA256177b0bac987e7882449bd7c5900406f61a997f97ea1797614c8d86f40f03648b
SHA512f7333b481f1498b5eab2688856a5b86fec96b6bf7b781564dfcc018882ded4d7ee5a1fc0c2498607195a66d42a74034f9649a8b61fa548d3d6029f25c5a9648d
-
C:\Program Files (x86)\rhc7hlj0ecwn\MSVCP71.dllFilesize
488KB
MD5561fa2abb31dfa8fab762145f81667c2
SHA1c8ccb04eedac821a13fae314a2435192860c72b8
SHA256df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
SHA5127d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
-
C:\Program Files (x86)\rhc7hlj0ecwn\MSVCR71.dllFilesize
340KB
MD586f1895ae8c5e8b17d99ece768a70732
SHA1d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA2568094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
SHA5123b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
-
C:\Program Files (x86)\rhc7hlj0ecwn\Uninstall.exeFilesize
75KB
MD5373ab9f3666e444d538dab8e35d56730
SHA1e5498ad390b38983a887e850e48c6235b4be3249
SHA2568536a124573aee7b65d87e6d7d7bbc480a3084bef0ea75c1e82816a64817a451
SHA512f18112b60ac9ad4b563fec2b895e82be08d776d99a613855c646e1160923c16ca377cc66f7190ce603b2e32b21832d5eb0335daa4f6057ee47cb79110db9bc07
-
C:\Program Files (x86)\rhc7hlj0ecwn\msvcp71.dllFilesize
488KB
MD5561fa2abb31dfa8fab762145f81667c2
SHA1c8ccb04eedac821a13fae314a2435192860c72b8
SHA256df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
SHA5127d960aa8e3cce22d63a6723d7f00c195de7de83b877eca126e339e2d8cc9859e813e05c5c0a5671a75bb717243e9295fd13e5e17d8c6660eb59f5baee63a7c43
-
C:\Program Files (x86)\rhc7hlj0ecwn\msvcr71.dllFilesize
340KB
MD586f1895ae8c5e8b17d99ece768a70732
SHA1d5502a1d00787d68f548ddeebbde1eca5e2b38ca
SHA2568094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
SHA5123b7ce2b67056b6e005472b73447d2226677a8cadae70428873f7efa5ed11a3b3dbf6b1a42c5b05b1f2b1d8e06ff50dfc6532f043af8452ed87687eefbf1791da
-
C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exeFilesize
9.0MB
MD504b88c7067b53a9bdf844cd1cb4b9c30
SHA17d081a1053cd9ef3d593f5ef9a27303824b779f5
SHA256d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9
SHA512566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42
-
C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exeFilesize
9.0MB
MD504b88c7067b53a9bdf844cd1cb4b9c30
SHA17d081a1053cd9ef3d593f5ef9a27303824b779f5
SHA256d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9
SHA512566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42
-
C:\Program Files (x86)\rhc7hlj0ecwn\rhc7hlj0ecwn.exeFilesize
9.0MB
MD504b88c7067b53a9bdf844cd1cb4b9c30
SHA17d081a1053cd9ef3d593f5ef9a27303824b779f5
SHA256d42b135a1e70b6f7d0d98c340f4b529f722953cf57e573bb21a078f50f2016b9
SHA512566f36f804d3027daab0e01f6d816b0420ba21fc276f2fabda4d0ed37b0e830704dcba8ccc3d30a7023c69f8ad3da0b9b58a49a26b3bb239d8ae0762bc157a42
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnkFilesize
1KB
MD51cbf6bb33544d4c2b86d9a5f5ccfdeb7
SHA1c5ddbbdc818b6e31a70d4a07b439d69e3e70c0e5
SHA256b3c816bde4eaa47ae8d4a6fd9ddd420ac640d02653e55ac042b5b210d1c19290
SHA512e0d99868ff9317602863c0d1ba6e19db58badd050826a1091e7e614edd6d84805d281b400fb1df0ae19c8647126cfb4b9f192574deb8000824dea4a53e2d6706
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnkFilesize
1KB
MD56e39e4abbb8cfafd52c699a4fe9c29a6
SHA12bf114a110a4f766fadda6bddf356f5b13856565
SHA256a4d9bc2c00e07eaab62e6afd0755340a4a7791f58664b7c0451b08d14f026d14
SHA5123c0d0b69f23d983e76c64062843287099af35e2cec7adb3a884b68f4bf987a292ef7aae3d120c6ac0e91592dfc9eb3a8e4f74505ec99b8410cc871ae6e478cc4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5adc6f45150a51c9aca1ce88597d95484
SHA18ea36d2a9997310072f9b0112f705c0cadc1c048
SHA2568920e83128950059fb483e007adc7b6173555a3811a32fc16e3a45047224a343
SHA5124437c737a583807c7e8a1fea508d9ed740ba82556c764c4c72ede4d449839a9bd217ec1dff385b87be0ccc192e59c8e01837f3939ac6e59f8e818eafc33507e8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5bb66bc2b498db5c703342d7464115ab4
SHA1c3d6cd3eda86639c1e22a859ad1704a3f1ae7888
SHA2567cecdee3eeed78937eb08696b64abf08da790707f9505bd1e2ebe8ad537a026d
SHA51278fd02331cef419021f2dba1b1918254eda72ddc0b256a33a288751609e28b59dd8ea950eb63da4052784b5b9f59e590efa7dc6acb82b968cb2f8ebd257ca3fb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD5701fd4210f951483ce14f083208b491b
SHA1704da61694ac0e9ae934a7e890a8a066551649af
SHA256898ab1ce95e690264212619907fb262215c2a44d727877e3b9b5c0b87e70c99a
SHA512c708bea87e1fe21496edc8e162094b3e37a2dd11cf31f7bce16247747eaa9a75d1e441f3bad3dcdfb89d9a25ba79f4e83439723acd09aeadaee535d959cbb7e8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5773e850109985cb013c7cd9ea3b41a5c
SHA13536883d49ed1916b8e63fe919b6041d5d07a346
SHA25634788dc2fe1de4d4dccab10ee32a246579f45170b01b53b556416a2c07204f96
SHA512efee20dd0c6cc5b38540b09fd31b01f78da9ce7b3af4e5a55c4b2858af0718f3a9b36eca6531bfc87c47940a1f1c318a990ff5c1112beecdb9c5ebfbb5040c3d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD51133ed79737e627887b34e808b860204
SHA1ba7ae8702da2a3fdbe390bbbadf74e2975d8bd23
SHA2560b5b973833ec87eb7a7576cff8fbe967c630d336215c513a766c4d468e0ee51b
SHA512ac5f7e168fb217d6f6047d9e2dea8881f3efffd0844e37f2fe0d2964c7dcf31ac503e0a4405bab7f5bb41d7085aec9bb7543034fab6ea9c57590f78fdcc9260e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD5763de0940da99a6a76076fd830b3b73d
SHA1fd64ce038e0e78ae639d349c044f322f04c3d471
SHA2564d2656d98b989978db2bea3d2a26b8f4d512017fe38e8babce1ec1e2445426e1
SHA5123a5b9207c1acd4b0a12af0739f1dd9f803a6a9af7a1e9927690459dceb543aa0d034dea3dd387dc6421a238544246b2a1630e46c32be40bb00772cf3143cb872
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1KB
MD52dd5f69d4153d822920661fb515bea06
SHA186c4d28fdaf2da921d421b4c7f44f5c71cf05bd4
SHA256fb60a714a8a6042edf8f0dc0c68bfb4407c64b64c2b78f53f4525fc3c734e5ff
SHA5128e1cd13584bec5a86694c918a0f69393dbef72efdcdc2fd61ba584121c4bf4250d63defe8bc86ff25eb393795229f5d9272504bf3c2a7395bb1efd616acb446c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
2KB
MD586d5a07f804917e1d72dc7d13109441a
SHA1b72920a00271679962d558ced0b7bb782c39d6b1
SHA256e62107eda2e537e1cb92ef9028bcb829319a403252a51baf27d622baa460c476
SHA512d719ddabdc08cd4f9a88cb180fc26f1ab84c5e93e2b62f680b45de1b034f1527c0412396dd824cb3a5a38d525c5b8273061615509db5c3e0d39e05332bba203c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD519ae1b99ea9f8aef21e1ff34461773ca
SHA162b6b98921815201eedfda4091bd945c3d2ce90d
SHA256532efd87cc51dbb0c1c72b980f28688a97bbd22dfdb1430b01e215063a8eb7f3
SHA51227687244caf986c867495a2114d56b531b2b8290ff247c5d4f9cbd2c736d0c8d9a972cfde186e786f9f269aab2e7ce2ba9786acf8b6158c0aee90969dd56a41e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD51e989cbcfa416010e940c7900f7cc481
SHA15060703dff56919753d8932d766c03f56ceb538c
SHA256635aa25d5d5d724db2758124a1680c4ab60cbf596ae64dff5662bd3131d53b14
SHA5123c34ef4a359c01501f368ca5671ca7cf1c748b8d7f7315cf080be0bcc75a2cfbcb6874127509f36842c94d368833580b3d09d7f52a751963bace6356daced3fb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56de15626c71dfde8439006e53edd78b1
SHA128f0667edd53f761ec7068aa32243978d2a143f2
SHA256f85c2f72a81a8e928cec829ccbc04942f7ff71f958bc5939a00fac3dfd775673
SHA512a785a3440a2bd5539c1254ce49fa08f0eacc72c6141a9f6d149abcb87a229bf0d6d2fdd477bc39b2d367563b63fc6d583152658fd7e47e67638e1ac69706fdec
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD5479d7950e4f3c7b89b60e4946e1eb152
SHA13ba45d1bdb2316818153867b1f0e95d29d179029
SHA2568ea3ece69892c2f9c2d571d14f3df227d2d203ed6187859c55a4f86458148852
SHA512abf85567d1f47b65804f9c2991886fe705d6a8a3d8d123598aea3e22a20044d977c0ef6d1697ed1fc91312d3c3506228121c196ca6c22168f72c86d8d010fcdd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56e30971d3f1d72b64d8f195a684f5fb5
SHA1a4cef82c745d95182e5d79cf0ed9d8ebabf35dcc
SHA256c897a88d00fc616b1cfab1edca532d25e45ea5e9746af76749407b08a675e355
SHA51271bdab5d5ff86397caef1c0e752a02d7cee883d13115e98363c11c29cd59d1bf96d2a3433c3411f0b342b80df75825bd6451a1762fad4fdc738b5fe713ce5c1b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD52ce509a869f098d64fa21ce362a6947d
SHA1000d3e8dfa82aa05580216dbd211a73be8930b14
SHA25674401984a5dda9793bb42f8f1f07bf1d27bcfd11bd10e1f1b04d6512f4b0788c
SHA512d54fbf2c48080916429cf4631f0faf5b5c96a9b26391a757ed8cbfa8ac8a4bb7e654c93920a351e7ffaa69d06a3d01d8e8ba5ba6cc2ddece74b2be07ab8508e4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD51f1aac3936794be5408381ddec1b899a
SHA1557478a66abb3b2ac52a346452d40ba44a7fe48b
SHA256097aa2baa222e95981eb802f103f6deac7b1646ea8da8c4314e6f0cc97b5b30c
SHA512be52914262123548b04601c3fadb7fdcbc63e11d7f387bc46730e530dc0580dcfd45a88688b1828acbcb11ed2c0988083b9d761fcce4eac5bab9a4617b79e9d5
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD53983c2cc53242e040c28464760477ca1
SHA14d8ccf47df744e539752e2b5fc5ee583f6b5aaf1
SHA25696cb800c5be1f998f0d809f94936f07996cc578fb0a367ab66987b71667408d1
SHA512821a48e62c043f605f718fdf4e6187cd249e370342770b0c4983b1fda0c739d934d2dd89db65b9d0b50f81aaa250384ef49c91d28d0b2555cc69b8c19e0a0ada
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5efd7634ae39f1be882ffe86d1d67fd9c
SHA12a7db3a394b1b571c1ad1e42378e499b45eaf9bc
SHA256d3039ae8e82687875cda1552711dd7da238d0adb949f27ef743edcfd50390192
SHA51297456bd7b9b785348bef273f80203b62143ebb9f9f5daf51320ceb3dc7af5733dabec1ecbf80a43e3357a6961da6af6908ab8b481bd520258c1233150e31463d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5514ea4ceb0a652d5dc3afaf6bc99e36f
SHA18c4db9517b66aa98bd2301237b73d3b18f2d5241
SHA2560ff665c42943ea163828bd12a09c9538b71e7704fedcbdc584e4b164e21ed0a1
SHA51257e0609f8c10b97d4172f0c62625b3851a2c2d3a1b41ca49d9df6c901d78d3118274f1b3ccd3abdd688342d95162c30e86ccbd0e40504cde0a7a1d834ae7c291
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5c5ff7e44dc7d3eceb0bbcba027d5fce8
SHA1060f8c43516f87aabb49865ff36f12f7ce68760f
SHA25606430d11b559d3b13728b21d33e7cbf620c66bb05a8ab2e400fef565308f2c2e
SHA512c96079d1c68551fb013e4e244ec61c54b384c8c3453a913a10dd01e6ac12682b41bafad5a68b2b8d2cd1f12d54f45b00f1decf91f2e4f94c54cd41559753cc4e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD59d4b78ce88ce4c478a09d273ded6324b
SHA101303ff87f265b32b2e952317cf9de22eec10cad
SHA25636f539be6d04844cecde8e8ac7121021ba6231cda78a881bcd45641a74ac7e1b
SHA51239528d799f73ecb798e4b4278f729c060caa2a38f06b648620c80957bc3c5b0ce1a570997a25eb3a20300b007b5661fe0f753d1148b33d5568fc1a100e8e4d0e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5b43bb95009c8ad525aa425b249ba03c3
SHA1cf0e5c412e9fb7d4e79d1aad94bda14245f884d5
SHA256241a26ca1192626623f911f6c9ca5064a87de4c23ad9c3093bde41786d7a44a9
SHA512973f8838672cb15ee080ac6769ad6db2a7c2007e9ff6e26df96880064a9be92418a743e926193d8b4a851623bacea32e67d1fa15ca87fcb18a7e54837c909ae3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD55aca1b9c9b33ec90c1dd3c5e4696a27a
SHA13c1cd13fe18157f45c6eb5319a17d1ae04d150b7
SHA25612f5d3d413134a6a395cb6d4fb3829a7642ddc3b836d25076eb2be2a6a5ece71
SHA5128946796baaa4f810fd8a64a1f5839929ac1a617241c089e864c4b01cddef228a7d5a8decc5eea81cf47c66a888343ed240067aa647fa56614c83bdf478efb234
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5304d56a6400ee00d006e760e27ab0524
SHA1dfff47b778419532aecf10fdf2fe5488f50be259
SHA2562db8de37a13f06a94b6f837764c8b898bf3fa964c23c60bb7581ab3c69c336b5
SHA512d8e9ab455f534473e12f552ad381dd4a472fcd1afa55a1a307ee72fc8ad6a51650dbf1d62d660f5269aaa8e0042ee3c4d306f55c5d492173ab12b4a2579bc852
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD56c8553e670ed4049501fef765538f707
SHA1794a830a0e85bba41357942df1752022a386e1a1
SHA2569829236c9d073299ba0d1dca3af58f79013c923807ab3d9d01f9ca984bb0078b
SHA512ac51e5b5b94ec1238d6d0007b20f5d24feb013c9b155e9401e015ca24dc74b7d2889d02e51a3b2b817c97bc17ffd344b4438c0973fce10ec079c7d7aa4af5951
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD50adfbcd5951a07c650ad635f2540b802
SHA19d7681c0085ca40137a89f2aee8b73fcbb511d04
SHA256ecd673a541fc5dff517308570c46e5d99cf58dc03d9febe446f127007bda147c
SHA5126039a1c40dc297ee1d4e33bec35e5acbd77317d86b98d6b1155f810e158ee1d85909f23d4027cd1c9c061188788663d68246d96be9b6b0483d86e7460bbf9096
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5a5763ed304b2eca3b158dfa51d9d0077
SHA1d663eb2f1a141654439318654b34fcd98a0995a9
SHA256fc3e57242625ce6fe74af866650e41bbee45696c3d141d9b7de34b22212e2956
SHA512eb44a82f363d2e45226e51b4ef348d73a0442091734215b4491854d8b787b08a1513d4b19491d253b15b10a97e0606a317d4e7a6c41a1411fb517f691c4cb897
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5c0eb26e5e380e26ce283b01f460317d6
SHA1de50725f3efe919344f63d766fdf67e266e366df
SHA25673b1897b958cf60620f419eaede3013c63ecbaa35aaa46f91c655caf8c234ce5
SHA512af7f4f001cda8de21734b2dc1a83b60382e7995d8a5f2fc8bcac15f67b86a9b6adcab1460215be43e67ee24314976eb294833825aac01354d835f7bde88bb8ec
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD5d51013b794be98e51524a2be30c8f58f
SHA129d10b79256e006c5a6cbdc7e1db781a740c1c7f
SHA256403c0b954edeb57662c16011408d809dbb24ac64a7c430fbdd87516e94a59fcd
SHA512c82b73936c0527debcdea15d8ad713b2d1f3bdaecf63fb8281b8799ea06d657a211f29c26cf0ca9789ed663af8288149c494e57e373312e61043bd8ab04ca0ef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5320dc725d5a785b38ee60fe21643ff1c
SHA1fbd99c0c15248c102db9fd27508fde7a07266ae9
SHA2564d12bdc97386dcf7f87b26c8b3bf3c55b2b2bbaec48a7e08fcf645bb770f104f
SHA5127473fddad0ddbc8ec96d01cfbaf5d2dfa872eedb28202471e52d042b55c8ec4e351d5e285dd9ac78ef3a3f7793fd6a470532c9f3e952f8c68e640a9e49087f27
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5c209b06093f9dd7aa9f931af2b546a69
SHA1090ae82b8ee949ceec510455e4421b0558608d92
SHA2560e1d9cfebcbed10223e2f9fcaa54a6bc9fe3afa43c8ea057c3ac2d0ac67fabfb
SHA51225b2647a2b901d665d1418111d52d821cb19b744c5b41e2a03db1bce32c828c18d47bb936cde9711350b3ee13ac04ca5d5f30f7c8acbd6a19380207f7d0d611d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f14b668d1cb99665e71819f672f56b14
SHA19e80d9f3700e99000919ba8e840abaaedcb08890
SHA25660ea95ebea0337a8e493c74f86828061597702e68610cd3687141a0ac3503ad9
SHA51270fdb8674cb77e5cc6b359a2321b46c34a3226099e972ed0faee66de82d8c5012a3d0b0f2a6af4a85841d980966fa42b6a16c739f93558a818177488c5572934
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5ddfa58e838453fde01aad3388e8aa413
SHA1fd80c07ba60e3a301774d9b9b9d139c809aba431
SHA256887bbbe21ea4fe88311435dcf761ab523e9fda0d8e7c4fba2db008a48bf4c7d5
SHA5123d64433fd0a1819280044a2ebba46d5c68aeecccd2a2507c18d11b192e5e21f6711c94dc97107c1bfae7264cc14d79eb15111ae29286af9749075bded0e69922
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5dffcf22e5500e6284a1e2cca87a3eb4d
SHA101248dce3b023c87630b27411f472a18e1d1c6f0
SHA256d43bb5d498cbb403ec5c9ab1723c27e85fe80a56dcfdb249a9e5c3aa3967fd21
SHA51200086262adf24130dd125ce85abbf60c478445479c3dbfd084adbf451fe2b33575c6b719918819bfc8e4c64296897fdd1a4ee3e919e4879f092f9141275fd3c4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5ce8d50f6a42523186be8562685eed984
SHA1c25604faf6e70663bed098899b2ca220898f1a90
SHA25615fdbf7f1f4d1795a991a51d62a1d4966a7793c6566186d8d1e70eb97639b851
SHA5124b11b08fc21c45c0bebcfcfc41d7dbf07316337bfac0c11179279a64001055d37b51d47efddc58f48ae3c3758bf34c0ea0f4aab033b8aba6d1993d3b70689bbd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5489844b41c8d41df9e44239f81fcba02
SHA17e319e0f9710166c46b5d4d5f5e1fa2f14c07b74
SHA256579a65019bb422f98cdf685409170efc373207e8b7f3bfbb314b39e85972dac0
SHA512393b8a0639865f77bdd35fafd435a270f5e140f5a77a4831a0fba42f6946732a2dee9a295abd46063478e9c598d1a7abf8d2a42534083dd9c33670a93fd8b963
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5e99c5ad6510e8c0724890dd9ad629c04
SHA1c280655ce92be83cba48c92c04a83fd6908cccdf
SHA25639c6d28cf95dc560c03dfdf8a7b57dfd1833b58949021cdaaa4afca2d9216800
SHA512e2f7fb2a7f8c921f8743282e81d4adeda76165ad2c56bcf0637a1b3b5b71dcd1891a8826f6e15e24da55afd2a40c64f32fd96204b6240c6ab93cafbf2ba6934d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5bf4702cde55ccea66fecf564e9764dfd
SHA11ff13b10bcdc85ee3cab90c1b1b487619f57a49b
SHA256e44236ff063c2554f6e1f4d13043f8709cd9d6e2e8730f3f4d4508c95f044537
SHA5123efcc597432317564d50fc6b5e63c4dd863127a23372dc312486338e8cbe8f6da78a45a4da1b8f2b67fb39a67e2d4f0904fce1fb9353b0ece344cd8b85128e54
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD583076ab67729619f7e943825090688d7
SHA1426df18358f82299a4fb6d357c7a517b62a645e6
SHA2563f22c8636a634e37dd3f25904651abb492333d97106400668d544a9ecc5ee203
SHA5122be9c20f4e981e56671ce34c308a89b9de32133a29c8ca49f0d20cebbe7ef7493964b75550e62e35a834ca49dc62d764fe93099457381041ab1e7cbce448e22e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5015bf26d6d4ba49e80d718b95d504013
SHA13cfeff5e677b094657514624d30a12861d42bad3
SHA2565b0f3e5b8215c10536be6b0c1e18692ebd55d25737c1cab57b56149bd7d7e684
SHA5128cd9e7b32ae1c635d974d6a8b2589a2e3145c0737bab64dfc98a548486855a0a0cbf8d9f451c38e0328a9c08d7cb6a26da1f4b440c5db3a5b43bc5ec6e7b5cfd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5b69d83c46390d070b8155b178b431951
SHA1ca392735775a335c30e867720f50e8c8c80abe7b
SHA256692c664850de7d7b4cf7372d9d837d12a95a1d1cc8c535fd748fb527adaf1b59
SHA512c7d42bd317aed4036f99157a7395d21eda65850f16a0f03bfb4258d8bc1acd070a175b6d29154b0b3636ea3446d07d7ba3f5c8116504e433a88e03ef0153357e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5f1a71e60e6999b005e3886e01819169e
SHA1e960f53d3e2501293dd9a7881c2dc0c7b2b90384
SHA256480c76edbbfb826fc3429ce1983b3c17c0a98adac25d5d035588837cab159456
SHA5124aa32fb2ff5b2e55b8c92a2db16dd0de26d292bd011ab89c36f04e991aa95fde9abbaa63d0d4d55c05f08df92c3c108874be9043889162081cbe2205c17490ed
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
6KB
MD5925a3a153d1ad4a6d5ee5e0a2eb8c977
SHA1ceebbd05dfe905fb22074b03086e2aeb9e144803
SHA25674cd0c92cecb5b520ff2fcf174c825f00053649c399ceb65e1bc277159433b86
SHA5121d2405bb52129deed39b2f652d941ae8274ad28c6635d854062fe84dc94bf503e467d9888cfbc91b8824e0623ba7373fd5d634abb8bb27d9709358930172ad5b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5d3809c315a473aff67fbdcea86f343f4
SHA1738255372e29f77f2ef1e354b8a687d4b97fb576
SHA256458a975ac6c8d937e0c8b1c054f68dbde20cd476f047157ee554569320a1f6e1
SHA512890ea005a4563b0af810ff7dbd14b1efbf933a6160ae00f872c037bc75b82036819ef438fcfa20b48c2318799505c6cfeb6a2576ae3f2da6ec0d9a18278848d3
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff69bd2b-2a7d-4251-a7d0-f05ba944806d.tmpFilesize
6KB
MD54f14b97319635e55809a96f2de54390b
SHA10695516f4a0bfd0b13051b7240b25944d6c66d95
SHA256a07c893b83bc9a7cbc981a0e6062ecc47f7fbb61e7abfa4e08421bd0e7f7125e
SHA512270ed053618f58b62b878d7de32a93a315a58e3a296f91c50a724b237c0fa3069e04400153c3fc6078ccd653814121a20e551635ae57bc926edb256755d5880d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD5e1ddfd1ad8f1ba289051641d8355536d
SHA1a76d1b23dbc9024a69e68f9840235afd70bb5b19
SHA256e8ed41b7de9758185d47ffe3866f8066311c8e952363106bb45b9b4a4c3ea7f0
SHA5123e43562598c40e07eb29cbbfc26e36750f8ea43b0886e4949b8e2b363f9ce77597b67ab0eed972036084bc8835385b814dd39b29e4629a45e4cadcfd00ab091a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD5e1ddfd1ad8f1ba289051641d8355536d
SHA1a76d1b23dbc9024a69e68f9840235afd70bb5b19
SHA256e8ed41b7de9758185d47ffe3866f8066311c8e952363106bb45b9b4a4c3ea7f0
SHA5123e43562598c40e07eb29cbbfc26e36750f8ea43b0886e4949b8e2b363f9ce77597b67ab0eed972036084bc8835385b814dd39b29e4629a45e4cadcfd00ab091a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
173KB
MD51c7121b84830ce4ab79930293c407f74
SHA13654565ae57ed9f64d12a55bfef987e48015b635
SHA2569088b4ef0bae7242fb482483e95cbc0b8732335fcbf6e428f025f863fd86f0ad
SHA512b0245e75db40cf8eb75d020ddebaea939ab6000706d94557e0be3542f0eb56316354e80e7635b2a7010ea3f3be92ce991523542c6101da5e5187f9dceff60d1b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
98KB
MD5a927a6a126d70529f83de0be4b7cd5d0
SHA1325289fdaad6b4651569a2303a9541e3211e9eae
SHA256bb5fa61e34de5bfc9f45cd7e61125e69e613d9c60abb5eb23c1a7117c3fabd54
SHA512f758f95c376096e08e0cedc3f05f21ed659149e27eeffbb018966edf9de924c88091dd8e199c8b31cc578e1e594312f3a93bbec2a13d4a8bac535c2848e1246b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info CacheFilesize
108KB
MD5cdc1d7c52e209bd02e7367b0b01359db
SHA13da95cbae576ba399b556b3866497046d34eb859
SHA2568c112eeecfa3bd86fcc60ae4234127fc5826439c7aa5c06687b19d0aeb5cde59
SHA512a1c99411389520458b2f32b5b302042479a12df179ed9064d2e77cc3ad5d86cfb0222102285a591f01aa86784e37aa0a759f07405056fa1f3a884e81835de049
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57d62c.TMPFilesize
96KB
MD569cf4472dcf5d6d5867224361cf5f13a
SHA14e454ae0a89752825a369dbc439cdfede61305c0
SHA256994851a71c1a08360a57a666c10394a52628addb438ba9da8a546b9bf47b768f
SHA51264a6cf5d3a0ba9b42b6487b81b115157f77573207dd57094abd9e6658a4e8098b4f98a56ba13684199e947fc21c398bbdea9555e6ee717c2ea6bd3a376092346
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.jsonFilesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD578c7656527762ed2977adf983a6f4766
SHA121a66d2eefcb059371f4972694057e4b1f827ce6
SHA256e1000099751602ae1adcec6f1c74e1d65f472936817b45239dfed4b043984296
SHA5120a8e58ae95163b3cdf8e81b5085887761e73cb7c836a1a6a972e837fb3df69b2ac70cfd6311d06d40656344ec35eb48e512f007561480f0345486ac2b329be0b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5099b4ba2787e99b696fc61528100f83f
SHA106e1f8b7391e1d548e49a1022f6ce6e7aa61f292
SHA256cdb1db488e260ed750edfe1c145850b57ee8ab819d75237a167e673116a33ee8
SHA5124309375e10785564ceb03e0127ced414e366a5b833f16a60d796471d871b479e4c044db5268902d9dfd14715ca577cb26042bab8f7b0f31fe8abf33947feb9d1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
168B
MD5deb83297a975ea21e7792d57e2f9539c
SHA1dbab4f31703c2571ee969bd57f672e6e43f7f84b
SHA2562b13abc6763ce65517c1af4973b6f2698dbaa4d125d266715990ddd98104270c
SHA512e05883f98df85fdea3e17c85e4f520c486e362db4fa50bb2626234f2472fd603557b39ca8e68a524ec1a4d8800e9a488aeb029c6f98f8f54dee8371583d2a2fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a8733.TMPFilesize
48B
MD5d68c16a16d905a17bb841fdb7978eeda
SHA14f976bb8a70002ba95b4b750d7c7fe3c381a6e2b
SHA256c5537e9ccecc2642cc7c3f32eb18b3895a25cdf4423545213ae0159c443e3f33
SHA5123da9295a1884a85f23518a04464f7d96c1c707e2caf15c98185f967e147ac8a692723ba7886686e04bc49a512b2fc92b8e4410b42520d110394e15d289a69c95
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.icoFilesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnkFilesize
2KB
MD5469a14e2d958fc4c043664d03962a5e5
SHA17424e6404da1e92b533e84b3beb170c84e02aa62
SHA256750350cdc39b7f44d44436ebd661d784dbef4589c02b1270cae1f95905c3cb0e
SHA5124dfe1f5768911636e17b1e904dabf22c68ed1c191e011a09e624d0af183fd277ddfa44007bdf2bc837d94383a2c65b6e0a49418dbdb29140fe9f351ce6e250ce
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
1KB
MD50b95da09adf786929847aa4a5127d649
SHA1704f5b4106f7cb431e4474843e1e3b38c6560e9a
SHA256de8262c588f193c6c838ebec48e856146790ee460e439e4892b0fe0678d7cc34
SHA512dc392a44551e8e15674382ad93ef40c1c8623894bc4fa41218701bffac6af5ef3db1899751306afcd02f0b2772dd94abe66dd368f6810c0ffa9b89ab0eedf960
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
4KB
MD5abb7b44804dddd6b9e1ffea9e8b3276d
SHA1b525186bb2ee7516bfd0765ac2ff89e82dcbfcda
SHA256cb9fa76f2fa3dace21ede96964034e77991ea9e973eebaa11b337e59597375fa
SHA512bed441e07e44e6989eb4e7ea70e9a5018148f2f9a45f7ba6166eca4c8c9115d33e1416a4ad08be5c3b75be473b10b0ce909bd58a4fc0511a0256d053969e0027
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5d0970c835791757a1895e6a0976b7582
SHA1af3fb1b1dc6e480ac27741bf008540330a6b1216
SHA256c94e41b14d04de722be7d992484d3812d8f61e0c57e49bbb6d5061d7d65a7f4c
SHA5120330dca55541d1ebe83df52da8a3b51cafd821837e13a99fc728e2338d08d6e4c31bec6dc967a51c1ea9c5aed9c716516c4e7dae35a83bce8deae154a2a78ff3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56c2c7dd19aca9c482cb014f027e0dec0
SHA1aaf0b9cd03327e6a9a8cd1b5f9069f8c19166355
SHA256735574b1755a4b41198c6996eaa3c3a1a8e7349fa19c4ce12a37e65c7acf9a91
SHA5126c0247a724643484084a930f6e6032989d029aed3b93bb187d65afda0c91173bb5611752855e5cee1d55a0d8616003bb1930875ae6c823c71e222caf50cd6367
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure PreferencesFilesize
24KB
MD502ee7addc9e8a2d07af55556ebf0ff5c
SHA1020161bb64ecb7c6e6886ccc055908984dc651d8
SHA256552d3ed359b7a52278ce621674d16428d8a7969f6cd5663df18e240cce66aadc
SHA512567989543c3848a0c3276d96b96ca761f750e4b71fb74f36d809f590ffe16a72fd5ece251737a8b1ffe65f0051e211bd7ad19d2b8b0b7ca1b7ffc86dd2a52883
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD5b620624f75d71136a2e2b9195846bdab
SHA1568052f886a1ac8ee7a50688edc04fbcfce0d3bc
SHA2567b36849be4a55c3ffe129e69e581e9dc6e7d170c7e2c6d1292725f0dc619d3be
SHA512e873c9557b718e084cd946486388f9356b4e0f934f7269566e4ef092057467f2957fc6f8b85fb980e6853c47e8bfb503f55b7f2d411cab0328df025332ca6638
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
9KB
MD5b5e4a2b6e392bf579ec2875f484863a7
SHA1f4414dc7dbe2f08f8c3c68036e22f831c9aacccc
SHA25671baaed19b270b5091d0c0c4e2b49d33f7b59813c5b41bd0b123a785b5b3df2d
SHA5120b0692ac36bb86ef9dc597cf9f8d6ededc9147d0a379b648c387848c4aa011ede96c47351c6a866b2004d650b2d4aa7268914a068737b4f24cf6e184b4c0db52
-
C:\Users\Admin\AppData\Local\Temp\F43.tmp\302746537.batFilesize
348B
MD57d8beb22dfcfacbbc2609f88a41c1458
SHA152ec2b10489736b963d39a9f84b66bafbf15685f
SHA2564aa9ed4b38514f117e6e4f326cb0a1be7f7b96199e21305e2bd6dce289d7baa2
SHA512a26cf9168cf7450435a9fe8942445511f6fda1087db52bd73e335d6f5b544fc892999019d9291d9dcc60c3656de49688f6d63282c97706e2db286f988e44fd94
-
C:\Users\Admin\AppData\Local\Temp\nbje.batFilesize
70B
MD5bc5aca38e505da47e1ea8bcfb9df5bbb
SHA167dd2324979ff2c2dfc97f89db0fb939bd08c87a
SHA25630c55012548697052877b13150bedae3156f9a502557d1ea816dbed647b4a8f8
SHA51237ce0ab1b0ea58d3fddb8a25f6da6b970c454a7cd614932ea3a2c7f8d9c763172fee2a455d7d381397a67071d3f10e7b9159ce02dde0e0176c8e4180c47451cf
-
C:\Users\Admin\AppData\Local\Temp\nsk5D72.tmp\update.iniFilesize
479B
MD56be0521c6a3934b32ab42366789f884c
SHA1059a086b435b7803d826930c608dc7ff4e495e88
SHA2560edb0b13bd6b6dacc8686c74295b25fbc2a7b6709b5f77bd65f69b244975f298
SHA512903c24e4045b5e88ec01053f3797c371f523ee916f697f29532176231f9d87b80d7a8519bcb2a0fd3094934c91ef6855cf45736060cd22cae4af8bb4d66b09f7
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\KillSelf.dllFilesize
5KB
MD58b49e96b0bd0fe3822bd4f516ad543ab
SHA13d04d3a4377e2e1888cc2be333b129daa8d2894d
SHA256c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037
SHA51246826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\KillSelf.dllFilesize
5KB
MD58b49e96b0bd0fe3822bd4f516ad543ab
SHA13d04d3a4377e2e1888cc2be333b129daa8d2894d
SHA256c25cbc60ff1ccca811239655636717c9ff4decb9190a557489389504b248d037
SHA51246826285f213137cedefe379ece413730a36dcde016e5ac114743cb011e587fde503df1d70ea0e6c4213993749ac4d246e4c3c980b02e01239b392d0f5892e26
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\MachineKey.dllFilesize
52KB
MD5819265cb9b45d837914f428373b06318
SHA10725f84eba20acdbd702b688ea61dee84e370b0c
SHA256dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf
SHA512ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\MachineKey.dllFilesize
52KB
MD5819265cb9b45d837914f428373b06318
SHA10725f84eba20acdbd702b688ea61dee84e370b0c
SHA256dd2f2d8c0a7d767be40b0f83ac6339ec86068e4ba0f4cd0e3e5b99050dd84fcf
SHA512ae4dd3f773568072e86e694c72a08d06b9206cb704a22ced1a922bc04a61a504aee67fc32ffb4d39f9e75f74c533d409756d4d953eaf9ab89cc9fe11f702b30c
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\Mutex.dllFilesize
3KB
MD56899249ce2f6ede73e6fcc40fb31338a
SHA1385e408274c8d250ccafed3fe7b329b2f3a0df13
SHA256d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212
SHA5120db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\Mutex.dllFilesize
3KB
MD56899249ce2f6ede73e6fcc40fb31338a
SHA1385e408274c8d250ccafed3fe7b329b2f3a0df13
SHA256d02a2c0c9917a5ff728400357aa231473cd20da01b538a0e19bc0c0b885ea212
SHA5120db15d8050a3d39a14ebe6b58ebd68f0241d3ee688988e1e2217e2c43a834dff0959ba050d7e458ab6dfb466c91a3109ead350fe58fb3daa0753f6ca1ed9d60d
-
C:\Users\Admin\AppData\Local\Temp\nsu36B0.tmp\lastpage.iniFilesize
214B
MD514f51baaf9e518780594e20887e6fe36
SHA119f934f6a8cb11c53ae06f71457bfa643bb06576
SHA25699cc25682aa82e36757361afdd6e0436ff56cdc03993e6d60f20d052f8b9dbe5
SHA512d48e9a9e12a69fef2b6c324a9c2f1fb46d8eb931a4cde955f2c196c3ee78ac80dcfdb98cc17530854c3775db41de66b09b9ba498c550ac500ec40cdefe4caf81
-
C:\Users\Admin\AppData\Local\Temp\pin.vbsFilesize
287B
MD53f764ed6ee61afced5405a2e3f62738b
SHA1ce56c02f451bdbf20a1003df87fc2692ca06d0ed
SHA25622804ed36ad186b3ab18605719c83e70b6244f60aba00e16ca8f97d80b5cc0e4
SHA5126ed1d6327b67b3c863f71ede1d8be2f24c51454aab25b104d474024bfafcd732ba84a63ea60b218ce0e97a740c2717f87f4a38fcf211e780d027d36f4bc1d859
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-msFilesize
3KB
MD5f8be1420b8265fb6d53b07201f57cfb3
SHA1879fc3419369b4f242f0aada74bb9569bce5aeb0
SHA256be59e8391106235365fd64fe930e8b8023f4e3c76c95f9c4b36a6055dc669c8e
SHA512f69103f9ecbf6d38df7aee957a81a36d26cf657a41a37daa9f8d204c0350758bb04ede0dcd89908af231ec3b68e8099d9d5e0edcd2fa4252fc18fd7b616a8acd
-
C:\Users\Admin\Downloads\Antivirus Platinum.zip.crdownloadFilesize
699KB
MD5ff84853a0f564152bd0b98d3fa63e695
SHA147d628d279de8a0d47534f93fa5b046bb7f4c991
SHA2563aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2
SHA5129ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb
-
C:\Users\Admin\Downloads\Antivirus Pro 2017.zip.crdownloadFilesize
794KB
MD5ab1187f7c6ac5a5d9c45020c8b7492fe
SHA10d765ed785ac662ac13fb9428840911fb0cb3c8f
SHA2568203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a
SHA512bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2
-
C:\Users\Admin\Downloads\InternetSecurityGuard.zip.crdownloadFilesize
2.5MB
MD5c5afbb8da79525ba74aa0fdc5bb5d17a
SHA119a7bb8f31f40592c350555eb450924193aa5aef
SHA2565f3c2e1ad778441373cbfdc5d07884376175a9409e260e60edd292a95f9bc4ca
SHA51236cd962ae3c4c0bec993a1c379130ffbd5ef475e234e4ccfebd51f4e52ff6861bc3c1ee6ab20df4e8a1b04f4ba7f2f9437c9bcfbad9573cffc74a4680ddec589
-
C:\Users\Admin\Downloads\PC Defender v2.zip.crdownloadFilesize
789KB
MD5cad618323b07c0f4f6273ae08df1779e
SHA1e67715f81f83ce7cda32f12a116cc950b6fd0dac
SHA256854113f2737ee276ba34fac399e8a615e4de4c712dd7a761ab0e198fa09d87fc
SHA512efd9403706accfe996b5df58300b5e0a0b461727bdf7c5492e9914369fef09ae06cdc2d00d30ac6d494fc68dadcf423d800741f7c22d5c1d565ef3fc675c4565
-
C:\Users\Admin\Downloads\RegistrySmart.zipFilesize
1.0MB
MD57958e5251e5e6f9c3b7752ff1543e28a
SHA186f6a8439ce6a6b30e6347c5bde7e091e5fad0ac
SHA256b31c3f9d08337314050552a7dfdceaf42bb6d22baee287cde6238a6d965d87cd
SHA512aec50b136792aebbd5aa8e5d316c39b728ff28e411dd54db99a18d5c7b9447f25629c4220800ee8dd8cd2b24a98a11d46f32b45a62bda5135c2ff0a731e032ee
-
C:\Users\Admin\Downloads\VAV2008.zip.crdownloadFilesize
765KB
MD5b698aefa1322550e130867cbd69ce67b
SHA174c12404ed33cfd13b58606757f9ff0e06650c41
SHA256a2247754d4305d00900da86b8957562696f80ae025c8d8eac27f38e4023e7f89
SHA512b1242e7cd5506955d6d999213f98f16321cb866f7fc6a14ed9d11e1a8735c9b4632e9e8cb83073797b5ace91b963d57bbbb63ef8d3640c1048c962778834b5bb
-
C:\Users\Admin\Downloads\XP Antivirus 2008.zip.crdownloadFilesize
1.3MB
MD5a06ce8cd000f726c1aa2485a841f9640
SHA1c2fad57e9c22ea6714d8bee9941339aca1cc7e8d
SHA25620c562166df0c0a76fe9ff901b20983321b2e9a4b045e3c3c3a20f8e4f22a5a3
SHA51232947e6424359499ec393db8e9776b4fcfb4419e5b8e821515d1220078458d3bbbe879b22a6a18b6d3f457369ba9369b0970f8905b431dd5e9732c805b0d7be2
-
C:\WINDOWS\302746537.exeFilesize
22KB
MD58703ff2e53c6fd3bc91294ef9204baca
SHA13dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA2563028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
-
C:\Windows\302746537.exeFilesize
22KB
MD58703ff2e53c6fd3bc91294ef9204baca
SHA13dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA2563028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
-
C:\Windows\302746537.exeFilesize
22KB
MD58703ff2e53c6fd3bc91294ef9204baca
SHA13dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA2563028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
-
C:\Windows\COMCTL32.OCXFilesize
595KB
MD5821511549e2aaf29889c7b812674d59b
SHA13b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA5128b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd
-
C:\Windows\Installer\e5bcf91.msiFilesize
860KB
MD5b3dce5c3f95a18fd076fad0f73bb9e39
SHA1e80cc285a77302ee221f47e4e94823d4b2eba368
SHA256df2e3b2222dcdbb5e0dbdd1200ec8fd5f67fcbea99e0023df54307eab60030ff
SHA512c184436055cf74884ad0d2bd5ca00bcd5a62d6be46253fe8c71b4daaa5c710b9df34af1b6e41f6d1af94bcdec0d33679a6a1b34bf9755678b4e177f368c11d4c
-
C:\Windows\MSCOMCTL.OCXFilesize
1.0MB
MD5714cf24fc19a20ae0dc701b48ded2cf6
SHA1d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA25609f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
-
C:\Windows\MSCOMCTL.OCXFilesize
1.0MB
MD5714cf24fc19a20ae0dc701b48ded2cf6
SHA1d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA25609f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
-
C:\Windows\antivirus-platinum.exeFilesize
9KB
MD5cd1800322ccfc425014a8394b01a4b3d
SHA1171073975effde1c712dfd86309457fd457aed33
SHA2568115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA51292c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6
-
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2Filesize
23.0MB
MD58fd8caf8cdb82d622006d7c92210e59a
SHA1c2680de570658934a2ab85aa95e06f9d25db3e02
SHA2565eda8858f0098fa0fd5281cf7d2076d0682897c2cf738304e35bc782a95e09de
SHA512ab446052e453b7ff637ba667357a2487dd60babc293e3716202d889936c6fafa62240111c4f6b5c7c44ef3ca419b9d2c4bc76d0c2b251a62fbd2f18232e252dc
-
\??\Volume{c9ab6598-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c4f2d0e-cd49-4625-af8b-85e9a883558a}_OnDiskSnapshotPropFilesize
5KB
MD5b5a8322a0e77b986043bdc069f3f0a6f
SHA123339b25408179a06399d14f489f28fcbd89d4d4
SHA2566fdbfe8128d33f5034ee5362204bb7f5bde04616cd501db13b1784cc3869a56a
SHA5121a307bf8538319d7791c25c4a431025a64cc542aacacae95fc7b7196ba12e5a2e396d4218169cfb34762d5d135b9ab851646178ca19524918b83c1eb19bfe7fb
-
\??\c:\windows\antivirus-platinum.exeFilesize
9KB
MD5cd1800322ccfc425014a8394b01a4b3d
SHA1171073975effde1c712dfd86309457fd457aed33
SHA2568115de4ad0b7e589852f521eb4260c127f8afeaa3b0021bfc98e4928a4929ac0
SHA51292c22c025fd3a61979fa718bf2e89a86e51bf7e69c421a9534fbf9c2d5b23b7a9224d0e9f3e0501992038837015214d1ef73b532a68b7d19de559c9ab9c6e5f6
-
\??\c:\windows\comctl32.ocxFilesize
595KB
MD5821511549e2aaf29889c7b812674d59b
SHA13b2fd80f634a3d62277e0508bedca9aae0c5a0d6
SHA256f59cdf89f0f522ce3662e09fa847bca9b277b006c415dcc0029b416c347db9c4
SHA5128b2e805b916e5fbfcccb0f4189372aea006789b3847b51018075187135e9b5db9098f704c1932623f356db0ee327e1539a9bf3729947e92844a26db46555e8cd
-
\??\c:\windows\mscomctl.ocxFilesize
1.0MB
MD5714cf24fc19a20ae0dc701b48ded2cf6
SHA1d904d2fa7639c38ffb6e69f1ef779ca1001b8c18
SHA25609f126e65d90026c3f659ff41b1287671b8cc1aa16240fc75dae91079a6b9712
SHA512d375fd9b509e58c43355263753634368fa711f02a2235f31f7fa420d1ff77504d9a29bb70ae31c87671d50bd75d6b459379a1550907fbe5c37c60da835c60bc1
-
\??\pipe\crashpad_1928_HBEDMJYVNHBBROKLMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1852-1381-0x0000000001310000-0x0000000001340000-memory.dmpFilesize
192KB
-
memory/1852-1382-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/3348-1027-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1034-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-724-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-591-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-589-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-498-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-958-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-499-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/3348-973-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-984-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-500-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/3348-501-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1083-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-502-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/3348-1005-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1025-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1029-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-950-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1085-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1079-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1107-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-1097-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-532-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3348-512-0x0000000000400000-0x0000000000A06000-memory.dmpFilesize
6.0MB
-
memory/3544-1384-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/3544-1305-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/3544-1303-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/3544-1304-0x0000000000FD0000-0x0000000001000000-memory.dmpFilesize
192KB
-
memory/3544-1302-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/3544-1519-0x0000000000400000-0x0000000000D72000-memory.dmpFilesize
9.4MB
-
memory/4592-572-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4592-585-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5000-1084-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/5000-588-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB